October 21, 2026
What is the HIPAA Security Rule and why was it delayed?
HHS originally proposed the Security Rule overhaul in December 2024 to strengthen protections for electronic protected health information (ePHI) as cyberattacks and ransomware continued to affect the healthcare sector. The new rule is still under consideration, but HHS has pushed its projected timeline to July 2027 and moved it to its long-term rule-making agenda.
HIPAA Security Rule timeline
- December 2024: HHS issued its proposed HIPAA Security Rule overhaul
December 2024: HHS issued its proposed HIPAA Security Rule overhaul
- January 2025: The proposed rule was published in the Federal Register
January 2025: The proposed rule was published in the Federal Register
- May 2026: HHS had previously chosen this date for final action
May 2026: HHS had previously chosen this date for final action
- July 2026: HHS moved projected final action to July 2027
July 2026: HHS moved projected final action to July 2027
- July 2027: Current projected timeframe for final action
July 2027: Current projected timeframe for final action
The July 2027 date is a projected agency timeframe, not a statutory deadline. HHS could still delay the final decision past July 2027.
What would change under the proposed HIPAA Security Rule update?
The proposed updated rule would change how organizations protect ePHI, requiring more specific, documented controls and more consistent testing. Several safeguards that were previously classified as “addressable” would become mandatory, and the rule would place greater emphasis on demonstrating effective security measures rather than simply documenting policies.
Among the new requirements for healthcare organizations would be:
- MFA: Enforce mandatory MFA to strengthen identity controls for systems that access ePHI
MFA: Enforce mandatory MFA to strengthen identity controls for systems that access ePHI
- Network segmentation: Segment networks to isolate critical systems and limit lateral movement
Network segmentation: Segment networks to isolate critical systems and limit lateral movement
- 72-hour restoration capability: Show that critical systems and data can be restored within 72 hours after a security incident
72-hour restoration capability: Show that critical systems and data can be restored within 72 hours after a security incident
- Asset inventory and network visibility: Keep an up-to-date inventory of systems that store, process, or transmit ePHI, as well as accurate network maps showing how data moves
Asset inventory and network visibility: Keep an up-to-date inventory of systems that store, process, or transmit ePHI, as well as accurate network maps showing how data moves
- Audit and compliance evidence: Show that security controls are being enforced and working in practice, not just documented in policies
Audit and compliance evidence: Show that security controls are being enforced and working in practice, not just documented in policies
These provisions aren’t in effect yet, but they signal where federal healthcare cybersecurity requirements may be headed.
The delay gives organizations time to strengthen their defenses and prepare for potential new requirements while the rule is being finalized.
Why do healthcare organizations need stronger defenses?
Healthcare networks were built to be flat so physicians could quickly access information from anywhere in the hospital. But that accessibility also means that the network depends heavily on perimeter defenses to keep threats out.
Perimeter defenses can reduce the risk of an initial compromise, but they can’t eliminate it. A phishing attack, stolen credential, vulnerable internet-facing system, or compromised medical device can provide an initial foothold. Without network segmentation, an attacker can then move laterally toward more critical areas, including systems that house electronic health records (EHRs).
Healthcare networks are complex — and that complexity is multiplying
Healthcare networks are complex; they connect clinical systems, EHR platforms, medical devices, administrative applications, third-party services, and cloud-based workloads. Many of these systems can’t be easily replaced or taken offline without affecting patient care, which makes a cyberattack particularly disruptive. Without network segmentation, ransomware can quickly spread from a single compromised endpoint to other systems across the organization.
This operational complexity is multiplying as healthcare systems deploy AI applications, diagnostic large language models, and automated workflow agents. AI tools require dynamic access to ePHI across disparate systems, turning east-west network traffic into an expanded attack surface. Without microsegmentation, compromised AI integrations and machine-driven APIs become unseen gateways for ransomware to spread across the network.
According to Akamai's Segmentation Impact Study, 76% of healthcare and life sciences organizations faced at least one attack in the past two years. For healthcare organizations, that makes limiting lateral movement just as important as preventing unauthorized access in the first place.
How can healthcare organizations prepare for the new Security Rule?
Healthcare organizations can start preparing now by using microsegmentation to isolate endpoints, limit blast radius, shorten restoration windows, and demonstrate compliance. A structured four-step approach can help teams implement these controls effectively:
- Map systems that communicate with ePHI
Map systems that communicate with ePHI
- Segment critical systems
Segment critical systems
- Plan for containment and recovery
Plan for containment and recovery
- Build evidence into security
Build evidence into security
Map systems that communicate with ePHI
Start building visibility now by mapping which systems communicate with one another and identifying where sensitive information moves across the environment.
Segment critical systems
Establish security boundaries around critical applications, EHR environments, and other sensitive systems. Determine which users, devices, and workloads can communicate across those boundaries.
Plan for containment and recovery
Take steps to isolate systems and limit blast radius, then determine restoration priorities based on the most critical systems.
Build evidence into security
Think beyond just having a policy. Invest in solutions that offer real traffic and communication activity visibility, providing you with live proof through detailed enforcement logs, automated compliance records, and a trusted audit trail.
Preparing for a new cyber reality
The HIPAA Security Rule may not be finalized until July 2027, but healthcare organizations don’t have to wait until then to address the risks behind the proposed changes. Since the new rule would mark a transition away from perimeter defenses and an emphasis on proving compliance, preparing also means building a stronger defense against current threats.
Start by assessing your network’s readiness across segmentation, MFA, visibility, containment, restoration capability, and compliance demonstration.
Get started
Ready to take action? Use our HIPAA checklist to evaluate your readiness, or watch our on-demand webinar for a deep dive into the technical details.
About the authors
Neil Jennings
Neil Jennings is a Solutions Engineer on Akamai’s healthcare and life sciences team, working with leading health systems, payers, healthcare technology, and pharma/medtech organizations. His work as a generalist spans Akamai’s portfolio of security, cloud, AI, and infrastructure products and services. He began his career in healthcare IT, where he led strategic projects and initiatives over 12 years across the EHR, go-to-market strategy, cloud and modernization, API and interoperability, and value-based care domains. He brings this broad healthcare experience to his Akamai customers, translating business needs into future-ready technical solutions.
Kaitlyn Sullivan
Kaitlyn Sullivan is a student at Penn State University studying Security and Risk Analysis with a focus in artificial intelligence. She was a Product Management Intern at Akamai, where she worked within the Security Technology Group on projects involving API security, partner ecosystems, and healthcare security. She is particularly interested in the intersection of cybersecurity, artificial intelligence, and healthcare.
Security and compliance should act as guardrails, not speed limits.
Security
Secure Sensitive Data with Cyera and Akamai Guardicore Segmentation
Protect sensitive data by pairing Cyera's data discovery with Akamai Guardicore Segmentation to enforce dynamic, data-aware microsegmentation rules.
Protections that teams must routinely disable or bypass to keep the business running are not delivering the outcomes that they need.
Security
Akamai Named a Leader in IDC MarketScape: Worldwide Web Application and API Protection Platforms 2026 Vendor Assessment
IDC MarketScape has named Akamai a Leader in the 2026 MarketScape WAAP assessment.
A site that performs flawlessly in July can buckle under the load it sees when the enrollment window opens in November.
Security
Open Enrollment Is Where Digital Strategy Gets Tested. Are You Ready?
Open enrollment puts payer infrastructure, security, APIs, and member experiences under pressure. Learn six ways that health plans can prepare from edge to core.
