The proposed overhaul (NPRM Dec 2024, final rule expected ~2026) ends the "addressable" loophole and makes a long list of safeguards mandatory. Every small practice has to re-baseline. Here's the short version.
Check your readiness →These are the headline shifts most likely to affect a 1–50 person practice. Ward maps each one to a live readiness item.
ePHI must be encrypted at rest and in transit — full-disk encryption on every laptop and phone, TLS and encrypted email for data in motion. Narrow, documented exceptions only.
Multi-factor authentication becomes mandatory for access to systems holding patient data — the EHR, email, remote and cloud access. One of the biggest new lifts for small clinics.
The old "required vs. addressable" distinction is gone. Safeguards you may have skipped — audit logging, automatic logoff, integrity controls — become required.
Vulnerability scans at least every six months and a penetration test at least annually, with findings tracked and fixed.
A written inventory of everything that touches ePHI, plus a map of how data flows — mandatory, not optional.
A signed BAA is no longer enough. You must obtain verification that vendors actually have the safeguards in place.
Regular, separately-stored, tested backups with defined recovery times — your best defense against ransomware.
Tighter coordination and faster notification between business associates and covered entities. Know your clock before it starts.
Answer Ward's questions and the readiness meter shows exactly which new mandatory items you've met — and what to do about the rest.
Check my 2026 readiness