What the 2025 HIPAA Security Rule update means for a 12-person practice

For twenty years the HIPAA Security Rule let practices decide whether many safeguards were “addressable”. The January 2025 proposed update removes most of that discretion. It is a proposal, not a final rule, but if you run a small practice, here is what it would change, in the order it will affect you.

1. Encryption stops being optional

Encryption of ePHI in transit and at rest becomes required, with narrow exceptions. For email that means two things: transport encryption must be enforced, not merely available, and there must be a fallback when a recipient’s server can’t encrypt. A BAA with your email provider does neither; a gateway in front of it does. The current standard at 45 CFR 164.312(e) already asks for transmission security; the proposal turns the addressable encryption specification into a requirement.

2. Multi-factor authentication everywhere

MFA becomes required for access to ePHI. For most practices the gap is email: shared front-desk logins, phones without passcodes, no MFA on the Google or Microsoft account. Fix order: enforce MFA on the mail provider, require device passcodes, retire shared logins in favor of delegated shared mailboxes.

3. Asset inventory and network map

You must know what systems touch ePHI. Write down the obvious ones (EHR, email, billing), then the ones people forget: the fax-to-email service, the appointment-reminder tool, the scanner that emails PDFs. Each is a vendor needing a BAA under 45 CFR 164.308(b).

4. Annual penetration test, six-month vulnerability scans

Practices won’t run these themselves; they will ask vendors for evidence. Ask your email vendor for a penetration-test letter and a scan cadence. Ask the same of your EHR. (PXCMail’s own independent pentest letter is ROADMAP, scheduled before general availability; see the compliance roadmap for the current status.)

5. Restore within 72 hours

Contingency planning gains a clock. Confirm your email vendor’s recovery objectives in writing and keep your own list of critical systems with restoration order.

6. Business associates must verify annually

You will need written confirmation from each business associate that technical safeguards are deployed. Vendors that can’t produce one are a finding waiting to happen. PXCMail issues an annual safeguards letter.

What to do this quarter

1. Enforce MFA and device passcodes on email.
2. Put enforcement in front of email: required TLS, encrypted fallback, detection of PHI before sending.
3. Collect vendor evidence: BAA, pentest letter, recovery objectives, annual verification.
4. Update your risk analysis with the above; date it. 45 CFR 164.316 requires you to keep that documentation for six years.

If the rule is finalized it may change in detail; the direction is clear. HIPAA and the BAA, in plain English →

---

Was this useful? Tell us at [email protected]. Related: checklists · regulations in plain English.

Sources

• HHS, HIPAA Security Rule to Strengthen the Cybersecurity of ePHI, notice of proposed rulemaking, January 6, 2025 — proposes required encryption, MFA, asset inventories, annual testing and 72-hour restoration; proposed, not final.
• 45 CFR 164.312, Technical safeguards — the current access control, audit, integrity and transmission security standards the proposal would tighten.
• 45 CFR 164.308, Administrative safeguards, (a)(1) and (b) — requires the risk analysis, contingency planning and business associate contracts.
• 45 CFR 164.316, Policies and procedures and documentation requirements — requires written policies and six-year retention of Security Rule documentation.