Regulatory Update · 2 min read

HHS Proposes Mandatory MFA and Encryption Under an Updated HIPAA Security Rule

The January 2025 NPRM would convert several 'addressable' safeguards into flatly required ones. It is proposed, not final — but the direction is clear.

By SecuryxAI Research Team

August 23, 2026

Regulatory

In January 2025, HHS's Office for Civil Rights published a Notice of Proposed Rulemaking that would meaningfully tighten the HIPAA Security Rule — most notably by converting several currently "addressable" safeguards, including multi-factor authentication and encryption of ePHI at rest and in transit, into requirements with no flexibility clause.

Status check

This is a proposed rule. It is not yet in force, and the rulemaking process (comment period, potential revision, final publication) can change the specifics before anything becomes binding. Track the rule's status directly with HHS rather than treating this article as confirmation it's already required.

Why it matters even before finalization

Regulators' proposed rules are a reliable signal of where enforcement expectations are heading, and OCR's own enforcement actions already lean on "addressable" safeguards more heavily than the word "addressable" might suggest. Organizations that treat MFA and encryption as already-required — rather than waiting for a final rule — are simply ahead of where the rule is clearly going.