HIPAA Security Rule: Data Inventory, Risk Analysis and Safeguards

Key Takeaways

• The HIPAA Security Rule requires administrative, physical, and technical safeguards for electronic protected health information (ePHI).
• It applies to covered entities and their business associates.
• The 2025 proposed update would add stricter requirements but is not final; the current rule is what OCR enforces.
• Data inventory, risk analysis, and tested backup and recovery are at the core of HIPAA security compliance today.

What Is the HIPAA Security Rule?

The HIPAA Security Rule sets national HIPAA security standards for protecting the confidentiality, integrity, and availability of ePHI. The Health Insurance Portability and Accountability Act (HIPAA) was enacted in 1996. The HIPAA Security Rule was finalized in 2003, with compliance required by 2005, and it has continued to evolve alongside the shift from paper to digital records. As a direct result of record-setting cyberattacks in the healthcare industry in 2023 and 2024, the Office for Civil Rights (OCR) at the Department of Health and Human Services (HHS) published a Notice of Proposed Rulemaking (NPRM) in January 2025 to modify the HIPAA Security Rule in order to strengthen cybersecurity protections for ePHI.

If finalized, the proposed rule would strengthen cybersecurity by updating the Security Rule’s standards to better address ever-increasing cybersecurity threats to the health care sector. The proposed updates would demand faster response times, rigorous security measures, and improved visibility into vulnerabilities. These new standards may present major challenges for many organizations — especially those that have struggled to meet past legislative requirements. Considering these factors, it is important to have an accurate understanding of how both the current HIPAA security rule requirements and the proposed changes affect healthcare organizations, and what steps can be taken to implement them.

Who Must Comply With the HIPAA Security Rule

The HIPAA Security Rule applies to covered entities and their business associates, including:

• Health care providers: Doctors, clinics, psychologists, dentists, chiropractors, nursing homes, and pharmacies, but only if they transmit any information in electronic form in connection with a transaction for which HHS has adopted a standard.
• Health plans: Health insurance companies, HMOs, company health plans, and government programs that pay for health care, such as Medicare, Medicaid, and military veterans’ health care programs.
• Health care clearinghouses: Entities that process nonstandard health information they receive from another entity into a standard format, or vice versa.
• Business associates: Vendors that create, receive, maintain, or transmit ePHI on behalf of a covered entity, including IT, cloud, and backup providers.

The same covered entities must also comply with the HIPAA Privacy Rule, which governs how protected health information (PHI) in any form may be used and disclosed.

HIPAA Security Rule Safeguards

HIPAA security standards fall into three safeguard categories: administrative, physical, and technical. Each standard includes implementation specifications that are either required or addressable.

Addressable does not mean optional. It means you must assess whether the specification is reasonable and appropriate for your environment, then implement it, adopt an equivalent alternative, or document why neither applies.

Administrative safeguards

Administrative safeguards are the policies and procedures that govern how your organization manages security. They make up the largest share of HIPAA security rule requirements and include:

• Security management process: Risk analysis, risk management, sanction policy, and regular review of information system activity.
• Assigned security responsibility: A named security official who is accountable for the security program.
• Workforce security and training: Appropriate workforce access to ePHI, plus security awareness training.
• Security incident procedures: Processes to identify, respond to, mitigate, and document security incidents.
• Contingency plan: A data backup plan, a disaster recovery plan, and an emergency mode operation plan, along with testing and revision procedures and applications and data criticality analysis.
• Evaluation: Periodic technical and non-technical evaluations of how well your safeguards meet the rules.
• Business associate contracts: Written assurances that business associates will appropriately safeguard ePHI.

Physical safeguards

Physical safeguards protect the facilities, equipment, and media where ePHI is stored or accessed. They include:

• Facility access controls: Limits physical access to systems that hold ePHI, including procedures that support contingency operations.
• Workstation use and security: Policies for how workstations that access ePHI are used, and physical safeguards that restrict access to them.
• Device and media controls: Rules for the disposal, reuse, and movement of hardware and electronic media, including backup media and the creation of retrievable copies of ePHI before equipment is moved.

Technical safeguards

Technical safeguards are the technology, and the policies for using it, that protect ePHI and control access to it. The HIPAA security rule technical safeguards include:

• Access control: Unique user IDs, emergency access procedures, automatic logoff, encryption, and decryption.
• Audit controls: Mechanisms that record and examine activity in systems that contain ePHI.
• Integrity controls: Measures that protect ePHI from improper alteration or destruction.
• Person or entity authentication: Verification that anyone seeking access to ePHI is who they claim to be.
• Transmission security: Protection against unauthorized access to ePHI sent over a network, including integrity controls and encryption.

Backup and recovery are already part of today’s rules. The contingency plan standard requires a data backup plan, a disaster recovery plan, and an emergency mode operation plan under the current rule. If you’re building or updating yours, see our guide on how to build a disaster recovery plan.

Proposed Changes to the HIPAA Security Rule

Status as of October 2026: HHS published the Notice of Proposed Rulemaking (NPRM) in the Federal Register on Jan. 6, 2025. The proposal is not final, and its provisions may change before a final rule is issued. Until a final rule takes effect, OCR will continue to enforce the current HIPAA Security Rule.

If finalized, the update would remove the distinction between “required” and “addressable” implementation specifications, along with eliminating most exceptions. These changes would enforce consistent compliance measures across healthcare organizations.

Proposed documentation requirements would cover:

• Compliance audits at least every 12 months.
• Security policies and procedures.
• Testing plans for data security.
• Incident response processes and analysis.
• Increased emphasis on proactive documentation for audits and proof of compliance.

Proposed risk management requirements

• Mandated system hardening: Would require the application of secure configurations and controls to all systems interacting with ePHI.
• Vulnerability scanning at least every six months: Ensures identification and remediation of security gaps every six months.
• Penetration testing at least every 12 months: Tests whether security controls hold up against real-world attack techniques.
• Multi-factor authentication: Would be required for access to relevant systems, with limited exceptions.
• Detailed risk analysis: Expanded to include assessments of insider threats, third-party risks, and evolving cyber threats.
• Required data encryption: Would be mandatory, with limited exceptions, for both data in transit and at rest, with stricter enforcement on encryption methods.

Proposed incident reporting and response requirements

• 72-hour data restoration requirement: Organizations would need to restore relevant systems and data within 72 hours following an incident.
• 24-hour notification of ePHI access changes: Notification within 24 hours when a workforce member’s ePHI access is changed or terminated.
• Business associate 24-hour reporting requirement: Business associates would notify covered entities within 24 hours of activating a contingency plan.

Proposed data inventory and security audits

• Written technology asset inventory and network map: Reviewed at least every 12 months and covering all systems that create, receive, maintain, or transmit ePHI.
• Annual testing of security measures: Ensures continued effectiveness of implemented controls.
• Validation of business associate safeguards: Annual verification that all business associates comply with required security standards.

Proposed backup and recovery requirements

• Annual review and testing of backup measures: Organizations would need to test backup systems to ensure they can recover ePHI as required.
• Implementation of separate technical controls: These ensure the integrity of backup and recovery processes, preventing contamination or compromise.
• Data prioritization restoration analysis: Formalized procedures for determining which ePHI data must be restored first in case of an incident.

Many organizations already build toward these expectations with the 3-2-1 backup rule: three copies of data, on two different media, with one copy offsite.

How to Meet HIPAA Security Rule Requirements

Understanding the rule is the first half of the battle. Organizations also must take the proper steps to ensure that their security controls meet current HIPAA security compliance requirements and prepare for the proposed changes. To do this, healthcare organizations should take the following steps:

• Build an ePHI data inventory: Identify every system that creates, receives, maintains, or transmits ePHI, including EHR and clinical applications, databases, SaaS applications such as Microsoft 365, endpoints, cloud workloads, and backup copies. For each, capture the owner, location, data flows, and recovery priority.
• Conduct a documented risk analysis: Identify threats and vulnerabilities to each inventoried asset, rate likelihood and impact, and feed the results into a risk management plan. Revisit annually and after major changes. OCR settlements frequently cite missing or incomplete risk analyses.
• Zero trust principles: Zero trust principles are the implementation of continuous authentication and authorization when a user, device, or application tries to access the network. No person, device, or program is automatically granted unlimited access to an organization’s network.
• Implement robust backup solutions: Maintain data backup, disaster recovery, and emergency-mode operation plans to meet the current HIPAA Security Rule’s contingency plan standard, and prepare for the proposed requirement to restore critical electronic information systems and data within 72 hours. Keep immutable backup copies so ransomware can’t encrypt or delete your last line of recovery. This includes regular testing of backup systems to ensure they function correctly in the event of a data loss incident.
• Conduct regular compliance audits: Establish a schedule for periodic evaluations, at least annually, to review and update security policies, procedures, and plans. This includes maintaining detailed records of all security measures and conducting thorough risk assessments.
• Enhance cybersecurity measures: Strengthen cybersecurity protocols to protect ePHI from cyber threats. This includes implementing encryption, access controls, and continuous monitoring of data access and modification logs.

“Ensuring HIPAA compliance is not just a regulatory obligation for us; it’s essential to maintain the trust of our patients. Implementing a robust incident response process enables us to swiftly address potential breaches, safeguard sensitive data, and minimize disruptions to our services.”

Andrew Mosio, Director of Technology & Service Delivery, UI Health

How Veeam Helps Clients Address HIPAA Compliance

Healthcare customers are one of the Cybersecurity & Infrastructure Security Agency’s (CISA) 16 critical infrastructure sectors. In recognition of the importance of this industry, Veeam provides comprehensive solutions to help healthcare organizations meet HIPAA compliance requirements. One way is through Coveware by Veeam. They have expertise, experience, and tools designed to drive decisions to minimize damage and determine the best recovery path, not to mention they deal with cyber extortion every day. Coveware experts are always on hand to guide your organization through stressful times, with a team who has a proven track record to help you every step of the way.

Veeam also empowers healthcare organizations to achieve compliance while enhancing operational resilience. Our solutions are purpose-built to align with HIPAA requirements and provide the following benefits:

• Deep dataAI context: Discover and classify ePHI stored across hybrid and multicloud environments to build an inventory. The DataAI Command Graph brings together the full context in one place.
• Compliance Monitoring: Conduct gap analysis and monitor regulatory adherence using built-in reporting tools. Ensure audit readiness with detailed logs and immutable backup copies.
• Accelerated recovery: Meet contingency plan requirements and prepare for the proposed 72-hour restoration standard with enterprise-grade recovery speeds. Rely on automated recovery testing to validate ePHI availability and integrity.
• Proactive threat defense: Leverage ransomware detection and incident response to safeguard critical data. Utilize immutable backups for enhanced protection against malicious attacks.
• Modernized data operations: Integrate hybrid cloud and multi-cloud environments for scalable backup and recovery. Optimize costs and efficiency using advanced deduplication and storage-tiering technologies.

Explore Veeam healthcare solutions to see how organizations protect and recover ePHI across on-premises, cloud, and SaaS environments.

Final Thoughts

The HIPAA Security Rule, and the proposed update to it, represent a pivotal shift in how healthcare organizations must manage and protect their data. With the increasing threat of cyberattacks, particularly in the healthcare sector where the stakes are incredibly high, adherence to HIPAA security standards is not just a legal obligation but a moral one as well.

By embracing strategies such as robust backup and recovery solutions, enhanced cybersecurity measures, and zero-trust principles, organizations can significantly mitigate risks and enhance their ability to respond effectively to potential incidents. As the digital landscape continues to evolve, staying proactive and informed about compliance requirements will be crucial for healthcare providers to thrive in an increasingly interconnected world.

For a deeper look at what the proposed changes could mean for your organization, read the Updated HIPAA Regulations whitepaper.

Frequently Asked Questions