Summary of the Most Recent HIPAA Changes (2024-2025)

MLJ CONSULTANCY LLC
Oct 3
2 min read

**Summary of the Most Recent HIPAA Changes (2024-2025)**

The landscape of healthcare compliance is evolving rapidly, and 2025 marks a pivotal year for HIPAA regulations. The U.S. Department of Health and Human Services (HHS) has proposed significant updates to the HIPAA Security Rule, representing the first major overhaul in two decades. Here’s what healthcare organizations need to know:

**Key Proposed Changes to the HIPAA Security Rule**

- **Mandatory Multi-Factor Authentication (MFA):** All users accessing electronic protected health information (ePHI) must use MFA, adding a critical layer of security.

- **Continuous Asset Inventories:** Organizations are now required to maintain up-to-date inventories of all devices and systems that access or store ePHI.

- **Ongoing, Real-Time Risk Assessments:** The days of annual risk assessments are over. The new rule emphasizes continuous, real-time evaluation of security risks.

- **Elimination of Unauthorized Software:** Only approved and authorized software may be used, reducing the risk of vulnerabilities.

- **Encryption Requirements:** Data must be encrypted both at rest and in transit, ensuring that sensitive information remains protected at all times.

- **Automated Audit Logging:** Enhanced logging and monitoring are required to detect and respond to security incidents promptly.

**Operational Impact**

These changes require a shift from periodic compliance checks to continuous security monitoring. Healthcare entities must invest in new technologies and processes to meet these requirements, moving beyond traditional annual audits.

**Timeline and Enforcement**

The final rule is expected to be published in late 2025, with enforcement likely beginning in 2026 after a grace period. Organizations should begin preparing now to ensure compliance when the new requirements take effect.

**Recent Privacy Rule Developments**

In 2024, HHS updated the HIPAA Privacy Rule to strengthen protections for reproductive health information. However, a Texas court vacated this update in June 2025, creating uncertainty as appeals are considered.

**Looking Ahead**

Additional changes are anticipated to support interoperability and align with HHS’ broader Healthcare Cybersecurity Strategy. These updates represent a significant operational and compliance shift for healthcare organizations, underscoring the need for proactive planning and investment in robust security measures.

**Conclusion**

Staying ahead of regulatory changes is essential for healthcare providers, business associates, and subcontractors. The upcoming HIPAA updates will require a comprehensive approach to security and compliance, ensuring the confidentiality, integrity, and availability of protected health information in an increasingly digital world.

References

1. **HHS Notice of Proposed Rulemaking (NPRM) – HIPAA Security Rule (2025)**

- U.S. Department of Health & Human Services (HHS) official press release and NPRM summary:

https://www.hhs.gov/about/news/2025/01/10/hhs-proposes-updates-hipaa-security-rule.html

- Federal Register:

https://www.federalregister.gov/documents/2025/01/10/hipaa-security-rule-proposed-changes

2. **Industry Analysis and Summaries**

- Axonius: “HIPAA 2025 Changes: The Impact and How to Address the New Requirements”

https://www.axonius.com/blog/hipaa-2025-changes-the-impact-and-how-to-address-the-new-requirements

- Duo Security: “Security Updates to Get Ahead of Proposed 2025 HIPAA Amendments”

https://duo.com/blog/security-updates-to-get-ahead-of-proposed-2025-hipaa-amendments

- HIPAA Journal: “New HIPAA Regulations”