HIPAA 2.0 is Coming? What Healthcare Practices Should Know

Will your medical or dental practice need to change how it protects and restores patient data under HIPAA 2.0 – and is your current backup provider prepared?

The proposed HIPAA Security Rule changes would introduce more prescriptive cybersecurity safeguards, including encryption, multi-factor authentication (MFA), vulnerability scanning, recovery testing, and documented restoration procedures.

The need for stronger security is supported by federal data. According to the U.S. Department of Health and Human Services (HHS), reports of large healthcare data breaches increased 102% between 2018 and 2023, while the number of individuals affected increased by 1,002%.

Although the proposal is not yet law, healthcare practices can evaluate their existing safeguards now. Central Data Storage (CDS) already supports several relevant capabilities through encrypted backup, verified recovery, and automated restoration testing, while continuing to develop additional security automation.

What is HIPAA 2.0 & Is the Proposed Security Rule in Effect?

The proposal applies to HIPAA-regulated entities, including covered healthcare providers, health plans, healthcare clearinghouses, and business associates.

Its central objective is to strengthen the confidentiality, integrity, and availability of ePHI through updated administrative, physical, and technical safeguards.

When Will HIPAA 2.0 Take Effect, and What Is the Proposed Compliance Timeline?

The 2026 federal regulatory agenda currently projects July 2027 for final action on the HIPAA Security Rule update.

This is a planning date, not a confirmed effective date or compliance deadline.

Under the proposal, a final rule would take effect 60 days after publication, with most provisions requiring compliance no later than 180 days after the effective date. Those timelines may change before the rule is finalized.

The rulemaking has also raised concerns about implementation costs, technical feasibility, and the resources smaller healthcare organizations would need.

For now, practices must continue satisfying the current Security Rule. The delay does not suspend existing obligations to protect ePHI or maintain appropriate security and contingency procedures.

What are the Proposed HIPAA 2.0 Security Rule Changes?

The proposed rule would make certain safeguards more prescriptive, require more extensive written documentation, and strengthen expectations for testing security and recovery procedures.

In its 2024 Annual Report to Congress, HHS reported 663 large healthcare breach notifications affecting approximately 242.9 million individuals. Hacking was the most frequently reported breach category.

The affected-individual figure reflects reported breaches and does not necessarily represent 242.9 million unique people.

These findings help explain why HHS is proposing stronger technical controls and more explicit accountability for protecting ePHI.

Required vs. Addressable HIPAA Safeguards: What Would Change?

The current HIPAA Security Rule distinguishes between required and addressable implementation specifications.

• Required specifications: Organizations must implement the specified safeguard.
• Addressable specifications: Organizations must evaluate whether the safeguard is reasonable and appropriate, implement it where appropriate, or document the decision and use an equivalent alternative when reasonable and appropriate.

Addressable does not mean optional. Organizations still need to satisfy the applicable Security Rule standards.

The proposed rule would remove the distinction between “required” and “addressable” implementation specifications, making them required subject to specific, limited exceptions.

For healthcare practices that have relied on alternative safeguards, this could require changes to existing policies, technical controls, and supporting documentation.

Which Technical and Cybersecurity Safeguards Would HIPAA 2.0 Require?

The HHS proposed Security Rule fact sheet identifies the following changes.

Proposed safeguard	What the proposal would require
Encryption	Encrypt ePHI at rest and in transit, with limited exceptions
Multi-factor authentication	Require MFA, subject to limited exceptions
Technology asset inventory and network mapping	Maintain inventories and maps, review them at least annually, and update them after relevant changes
Vulnerability scanning	Conduct vulnerability scans at least every six months
Penetration testing	Perform penetration testing at least every 12 months
Configuration management	Deploy appropriate anti-malware protections, remove unnecessary software, and manage network ports based on risk analysis
Backup and recovery	Establish more specific backup, restoration, and testing procedures
Business associate verification	Verify relevant technical safeguards at least every 12 months through written analysis and certification

The proposal also addresses network segmentation, annual compliance audits, written security incident response plans, and regular effectiveness testing of specified security measures.

These are proposed requirements, not new enforceable obligations under the current Security Rule.

What Does the Proposed HIPAA 72-Hour Data Restoration Requirement Mean?

One of the most important proposed changes for healthcare backup and disaster recovery is a requirement to establish written procedures for restoring certain relevant electronic information systems and data within 72 hours.

This proposed timeframe concerns recovery, not HIPAA breach notification.

It should also not be interpreted as an unconditional requirement that every application, workstation, and clinical system must be completely operational within 72 hours. The proposal includes evaluating system criticality and prioritizing restoration.

For example, a medical practice may have a successful backup of its electronic health record (EHR) database, but restoring operations may also require functioning servers, applications, network connections, and user access.

A successful backup does not automatically establish that the underlying systems can be restored within a required timeframe.

Healthcare organizations need to understand how their restoration procedures perform under realistic conditions.

How Would HIPAA 2.0 Change Contingency Planning and Backup Recovery Testing?

The existing HIPAA contingency plan standard, 45 CFR § 164.308(a)(7), already includes:

• Data backup plan: Required procedures for creating and maintaining retrievable exact copies of ePHI.
• Disaster recovery plan: Required procedures to restore lost data.
• Emergency-mode operation plan: Required procedures to continue critical business processes while protecting ePHI during emergencies.
• Testing and revision procedures: Currently addressable procedures for periodically testing and revising contingency plans.
• Applications and data criticality analysis: Currently addressable assessment of the relative importance of applications and data.

The proposal would strengthen these requirements through more explicit recovery procedures, testing expectations, and documentation.

For practices, that makes the ability to demonstrate successful restoration particularly relevant.

How Does CDS Support Automated Backup Restore Testing and Recovery Documentation?

CDS has focused on recoverable data since 2008, well before the proposed Security Rule changes.

Its recovery practices progressed from quarterly documented test restores to automated testing through UnisonBDR v2.1.9.

The platform runs scheduled test restores and generates a printable Test Restore Certificate, helping healthcare practices maintain records of recovery testing without depending entirely on manual reminders.

This approach supports:

• Scheduled verification: Recovery tests can run at defined intervals.
• Restore integrity: Test results help demonstrate whether the tested data was successfully restored and usable.
• Documented evidence: Certificates provide records of test activity and outcomes.
• Recovery planning: Results help organizations identify issues requiring additional investigation.

CDS also provides managed recovery assistance. Based on its stated operating experience, CDS can typically make a full backup available within 24 hours once replacement hardware is ready, often the same day depending on data size.

Actual recovery performance depends on the protected systems, incident conditions, infrastructure availability, and agreed service scope. Making backup data available is not necessarily the same as restoring every clinical application to full operation.

These capabilities support preparation for the proposed restoration requirements without constituting an unconditional 72-hour recovery guarantee.

Learn more about UnisonBDR and CDS backup verification and recovery.

How Is Central Data Storage Preparing for the Proposed HIPAA Security Rule?

The proposed Security Rule addresses a broader set of safeguards than any backup provider can independently manage.

CDS already supports several capabilities relevant to backup protection, recovery verification, and external security visibility. Additional automation is in development, while other safeguards remain the responsibility of healthcare practices and their IT providers.

How Does CDS Support the Proposed HIPAA Security Safeguards?

The following table explains how CDS’s existing capabilities relate to the proposed requirements and where responsibilities remain with customers or their IT providers.

What the proposed rule would require	How CDS supports it and who is responsible
Written procedures to restore certain systems and data within 72 hours	CDS: Managed recovery support. CDS provides restoration assistance within its agreed service scope. Once replacement hardware is available, CDS can typically make a full backup available within 24 hours, often the same day depending on data size. This is not a guaranteed recovery-time objective and does not ensure that every clinical application or workflow will be fully operational within that period.
Testing and documenting recovery	CDS: Existing capability. UnisonBDR performs scheduled test restores and produces printable Test Restore Certificates to support documented recovery testing.
Encryption of ePHI at rest and in transit	CDS: Data within its service scope. CDS encrypts protected data at rest and in transit using its 448-bit encryption approach, within its private U.S. infrastructure and ISO 27001-certified UnisonBDR platform. The practice and IT provider remain responsible for ePHI stored or processed on their own servers, workstations, and applications.
Anti-malware protection and related security controls	Shared responsibility. Backups are immutable and scanned for malware before restoration, with safeguards intended to prevent compromised or corrupted data from entering the recovery process. Unison Secure provides endpoint protection within its deployed scope. The IT provider manages other endpoint, network, and application protections.
Vulnerability scanning at least every six months	Shared responsibility. CDS backups are immutable and scanned for malware before restoration, with safeguards intended to prevent compromised or corrupted data from entering the recovery process. Unison Secure provides endpoint protection within its deployed scope. The IT provider manages other endpoint, network, and application protections.
Technology asset inventory and network mapping	The practice, with CDS support. CDS can identify systems visible within its backup environment. The healthcare organization and IT provider must maintain the complete relevant technology inventory and network map.
Multi-factor authentication	The practice and IT provider manage MFA across organizational accounts, workstations, and applications. CDS manages applicable authentication safeguards within its own service environment.
Penetration testing at least every 12 months	The practice and IT provider, or a qualified security firm. Organization-wide penetration testing is not represented as part of CDS’s standard managed backup offering.
Workstation and system configuration management	The IT provider manages workstation, server, application, and network settings, including unnecessary software and unused ports. CDS manages applicable configurations within its own infrastructure.
Annual business associate verification	CDS: Potential future obligation. CDS provides a BAA for applicable customer relationships. The proposal would introduce annual written verification of deployed technical safeguards. If adopted, CDS would need to fulfill the obligations applicable to its services.

This division of responsibility matters because no individual vendor can make an entire healthcare organization HIPAA-compliant.

CDS supports defined safeguards related to protected backup data, recovery procedures, and documented testing. Other technical, administrative, and physical controls must be managed across the practice’s broader environment.

How is CDS Preparing for the Proposed Six-Month Vulnerability Scanning Requirement?

CDS currently offers a Free Cyber Vulnerability Scan that evaluates externally visible security exposure.

The assessment includes checks for:

• Open ports and exposed services.
• Expired security certificates.
• Missing security headers.
• Reported dark web activity.
• Other observable external configuration risks.

Findings are graded and reviewed with customers to help them understand which issues warrant attention.

CDS is also developing recurring external scanning automation, intending to make external assessments and reports available on a scheduled basis.

The proposed six-month scanning interval is informing this development, but the automated recurring feature is not yet being presented as available or assigned a release date.

Importantly, external exposure scanning is only one component of vulnerability management. Internal scanning across workstations, servers, and networks remains a separate responsibility requiring appropriate IT or security resources.

What Would Annual HIPAA Business Associate Verification Require?

Under the proposed rule, business associates would verify at least once every 12 months that applicable technical safeguards have been deployed.

HHS proposes that this verification be supported by a subject-matter expert’s written analysis and written certification of its accuracy.

This differs from a Business Associate Agreement (BAA).

A BAA establishes contractual responsibilities for protecting health information. The proposed verification process would introduce additional evidence concerning the safeguards actually implemented.

CDS provides a Business Associate Agreement for applicable services.

If the proposal becomes final, CDS will need to assess and fulfill any additional verification duties applicable to its operations. The details depend on the final regulatory language, and no unconditional annual certification commitment is being made at this stage.

For healthcare practices, this creates a useful vendor-review question:

Can your backup provider explain which security safeguards it manages and provide appropriate evidence of those controls?

HIPAA 2.0 Readiness Checklist: What Should Healthcare Practices Do Now?

Healthcare organizations do not need to wait for a final rule to evaluate safeguards already relevant to protecting ePHI.

Start with these practical actions:

1. Review your ePHI inventory. Identify the EHR systems, servers, workstations, applications, and vendors that handle patient information.
2. Evaluate authentication and encryption. Check existing controls and identify gaps based on the organization’s risk analysis.
3. Review your contingency plan. Confirm that backup, disaster recovery, and emergency-mode procedures reflect current operations.
4. Verify actual restoration. Review recent test results, recovery times, data usability, and any unresolved failures.
5. Assess external exposure. Identify publicly accessible services, expired certificates, and other relevant externally visible risks.
6. Confirm vendor responsibilities. Review BAAs, service agreements, available documentation, and safeguards provided by each vendor.
7. Follow regulatory developments. Monitor HHS updates before treating any proposed technical requirement or deadline as final.

For existing CDS customers, reviewing available Test Restore Certificates and discussing any outstanding recovery concerns with CDS is a practical starting point.

Organizations evaluating their current provider can also explore CDS’s HIPAA-aligned backup services to understand how managed backup and recovery support healthcare data protection.

HIPAA 2.0 FAQs 

Is HIPAA 2.0 a Final Rule or Still a Proposal?

HIPAA 2.0 remains a proposal as of October 2026. HHS has not issued a final Security Rule update. The existing HIPAA Security Rule remains enforceable.

When Will HIPAA 2.0 Take Effect?

There is no confirmed effective date. The federal regulatory agenda projects July 2027 for final action, but this is not a binding deadline. Any final rule would establish its effective date and compliance timeline.

If HIPAA 2.0 Is Not Final, Can Healthcare Practices Wait?

The proposed changes are not yet enforceable, but the current Security Rule remains in effect. Practices should continue meeting existing obligations and addressing security and recovery weaknesses identified through their risk analyses.

What Does Addressable Mean Under the Current HIPAA Security Rule?

Addressable means a safeguard must be evaluated for reasonableness and appropriateness, with implementation or an appropriately documented alternative where warranted. It does not mean the safeguard can simply be ignored.

Is Encryption Required Under HIPAA Right Now?

Encryption at rest and in transit is currently addressable under the Security Rule, meaning organizations must evaluate and address it appropriately. The proposal would generally require encryption, subject to limited exceptions.

What Are HIPAA Data Backup Requirements?

Under 45 CFR § 164.308(a)(7), HIPAA requires data backup, disaster recovery, and emergency-mode operation plans. Testing and revision procedures and applications and data criticality analysis are currently addressable implementation specifications.

What is the Proposed HIPAA 72-Hour Restoration Rule?

The proposal would require written procedures to restore certain relevant electronic information systems and data within 72 hours. It is not currently an enforceable new requirement and is separate from HIPAA breach notification timelines.

Does the Proposed HIPAA Security Rule Specifically Regulate AI?

The proposed Security Rule does not establish AI-specific requirements. However, systems using AI that handle ePHI may fall within applicable security obligations. Healthcare organizations should include relevant systems in their risk analysis and asset inventory.

Would My Backup Provider Have to Verify Its Security Safeguards?

The proposal would require business associates to provide annual written verification of applicable deployed technical safeguards, supported by expert analysis and certification. This proposed obligation goes beyond executing a BAA.

Is CDS Already HIPAA 2.0 Aligned?

CDS already supports several capabilities relevant to the proposed requirements, including encrypted backup, automated restore testing, and recovery documentation. Other safeguards remain shared responsibilities, and additional features are in development. Because HIPAA 2.0 is not final, CDS does not claim comprehensive compliance with the proposed rule.

The Last Words

The proposed HIPAA Security Rule may change, but healthcare practices already need appropriate safeguards for protecting ePHI and preparing for data loss or system disruptions.

CDS has been developing backup and recovery capabilities since 2008, with a focus on verified restoration, encrypted data protection, and documented recovery testing.

For current customers, these capabilities provide an established foundation as security expectations evolve. For organizations reviewing their backup providers, they offer practical criteria for assessing recovery readiness.

Visit Central Data Storage to explore our healthcare backup and recovery services, or request a Data Risk & Recovery Assessment to review your current protection.