HHS Proposes Mandatory MFA and Encryption Under an Updated HIPAA Security Rule
The January 2025 NPRM would convert several 'addressable' safeguards into flatly required ones. It is proposed, not final — but the direction is clear.
October 21, 2026
v1
2 min
HHS Proposes Mandatory MFA and Encryption Under an Updated HIPAA Security Rule
In January 2025, HHS's Office for Civil Rights published a Notice of Proposed Rulemaking that would meaningfully tighten the HIPAA Security Rule — most notably by converting several currently "addressable" safeguards, including multi-factor authentication and encryption of ePHI at rest and in transit, into requirements with no flexibility clause.
Why it matters even before finalization
Regulators' proposed rules are a reliable signal of where enforcement expectations are heading, and OCR's own enforcement actions already lean on "addressable" safeguards more heavily than the word "addressable" might suggest. Organizations that treat MFA and encryption as already-required — rather than waiting for a final rule — are simply ahead of where the rule is clearly going.
Explore HIPAA
Hub overview →
Related Executive Guides
What to confirm before — and after — signing a Business Associate Agreement with a vendor that touches protected health information.
The Privacy Rule, Security Rule, and Breach Notification Rule explained — safeguard categories, Business Associate Agreements, and the proposed Security Rule update's current status.
What the CRA actually requires, who it applies to, and the concrete deadlines security, compliance, and product leaders need on their calendar.