A working checklist of the current Security Rule (45 CFR §§164.308–164.316) combined with the cybersecurity changes HHS proposed in its 2025 Notice of Proposed Rulemaking. Check items off as you confirm them; your progress saves in this browser. Use the filter to audit against today's binding rule, preview the proposed rule, or see both together.
Today, every Security Rule implementation specification is tagged Required or Addressable, addressable doesn't mean optional, it means you must implement it, an equivalent alternative, or document why neither is reasonable for your environment. The NPRM would eliminate that distinction and make nearly everything mandatory, while adding a set of wholly new technical and oversight requirements.
Binding today under 45 CFR §§164.308–164.316. No documented-alternative option; these must be implemented as specified.
Binding today, but with flexibility: implement as specified, implement a reasonable equivalent, or document why neither is appropriate for your environment.
Not yet law. Either elevates an existing addressable item to mandatory, or introduces a wholly new requirement (e.g., penetration testing, asset inventory).
This checklist compiles the current HIPAA Security Rule (45 CFR Part 164, Subpart C, §§164.302–164.318) and the proposed changes in HHS's "HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information" (90 FR 898, January 6, 2025, RIN 0945-AA22), for general compliance-learning purposes. Items badged "NPRM" are proposed and not currently binding, the comment period closed March 7, 2025, and as of this checklist's compile date HHS has not published a final rule; proposed text, frequencies, and deadlines can change before finalization. This is not legal advice. Brandon Goulter is not an attorney, and using this checklist creates no professional advisory relationship. Verify current requirements against primary sources (45 CFR Part 164 and the Federal Register) and confirm your own program's compliance with a licensed attorney before relying on this checklist. Checked items are stored only in your browser's local storage, nothing is transmitted or saved to any server.