The biggest HIPAA rewrite in more than a decade was supposed to land this year. It did not, and that has left a lot of practices in a holding pattern.
Here is the short version: the Department of Health and Human Services proposed a sweeping update to the HIPAA Security Rule in January 2025. It drew more than 4,000 public comments. HHS has since moved it to its long-term agenda, with July 2027 now listed as the anticipated date for final action — pushed back roughly a year from the original expectation.
If you read that as “we have until 2027,” read it again. The delay moved the new rule. It did not touch the one you are already bound by.
That gap between what is coming and what is already required is where most of the confusion sits, and it is worth getting straight before you evaluate any IT partner.
What “HIPAA compliant IT services” actually means
Start with the thing nobody selling to you wants to say plainly: there is no such thing as HIPAA-certified software, and no vendor can make you compliant on their own.
HIPAA does not certify products. No government body issues a seal for a firewall, a backup platform, or a helpdesk. Any vendor claiming their tool is “HIPAA certified” is describing a marketing badge, not a regulatory status.
What actually exists is narrower and more useful:
- Technology configured to support your compliance obligations — access controls, audit logging, encryption, backups that meet the standard
- A Business Associate Agreement (BAA) — the contract that makes your IT provider legally accountable for protected health information they can access
- Documented practice — evidence that the safeguards were not just purchased but implemented, tested, and reviewed
Compliance is something your organization holds. Good IT services make holding it realistic instead of theoretical. That distinction matters when a vendor tells you a purchase will “make you HIPAA compliant.”
What the Security Rule requires of you right now
The original Security Rule took effect in 2003 and was substantially updated in 2013. It remains in force today, unchanged by the delay. It is built on three categories of safeguards, and every one of them has an IT dimension.
Administrative safeguards. A security management process, workforce training, assigned security responsibility, and a documented risk analysis. The risk analysis is the piece most often missing, and it is the piece enforcement actions most often cite.
Physical safeguards. Facility access controls, workstation security, and device and media handling — including what happens to a laptop when someone leaves.
Technical safeguards. Access controls, audit controls, integrity controls, and transmission security. In practice: who can reach what, whether you can prove who reached it, and whether data is protected in transit.
Documentation, retained for at least six years. Policies, procedures, and the records that show they were followed.
Notice what is not on that list: a product. The rule describes outcomes and evidence, which is why “we bought the secure version” has never been a defense.
What the 2027 update would change
The January 2025 proposal is the most significant revision to the Security Rule in more than a decade. It is not final, and it may change before it is. But the direction is clear enough to plan against:
- Removing the “addressable” category. Today, some specifications are required and others are addressable — meaning you can document a reasonable alternative. The proposal eliminates that distinction, making the list mandatory.
- Asset inventory and network mapping. A comprehensive record of technology assets and how data moves between them.
- Multi-factor authentication. Proposed as a requirement rather than a recommendation.
- Expanded encryption. Broader coverage for data at rest and in transit.
- More prescriptive testing. Annual penetration tests, vulnerability scans on a six-month cycle, and annual compliance audits.
- Network segmentation and anti-malware protection as named technical controls.
- Dedicated backup and recovery for electronic protected health information.
- Tighter business associate oversight, with shorter verification timelines.
Two honest caveats. First, this is a proposal — the comment volume was substantial, and the final rule may differ from what was published. Second, HHS has estimated the cost of the update in the billions annually across the industry, which is part of why the timeline moved.
Why the delay is not a reason to wait
Look at that list again and notice something: multi-factor authentication, encryption, asset inventory, backups, and a current risk analysis are already how a competently run environment operates. Most of the proposal formalizes practice that security-minded organizations adopted years ago.
So the practical read is not “we have until 2027.” It is:
- The safeguards you owe today are unchanged, and the risk analysis requirement is already the most commonly cited gap.
- Most of what the update would mandate is worth doing on its own merits, independent of any rule.
- Organizations that build toward it now spread the work across eighteen months instead of compressing it into a deadline.
We would give you the same advice with no rulemaking underway at all. That is usually the sign that the advice is about your organization rather than the calendar.
What to look for in an IT partner
If you are evaluating managed IT services against HIPAA obligations, these are the questions that separate a real partner from a vendor:
Will you sign a BAA, and what does it actually cover? A Business Associate Agreement is not optional for a provider who can access protected health information. Read the scope. Signing one is the floor, not the differentiator.
Can you produce a current risk analysis, and when was it last updated? Not a checklist — an analysis, specific to your environment, with findings and a remediation plan.
Where does our data live, and who can reach it? You should be able to get a clear answer about systems, locations, and access, and see the evidence.
How do you handle offboarding? Departing staff and retired hardware are among the most common sources of avoidable exposure.
What happens in the first hour of an incident? Ask for the actual sequence. Calm, specific answers here tell you more than any certification logo.
Will you show me the audit trail? If your provider cannot demonstrate who accessed what and when, you cannot demonstrate it either.
The DMV picture
Protected health information reaches further than most organizations expect, and the DC, Maryland, and Virginia market is a good illustration.
Medical and dental practices are the obvious case. But veterinary practices handle client and payment data with many of the same security expectations, even where HIPAA itself does not apply. Legal firms routinely hold health records in personal injury, disability, employment, and estate matters — often becoming business associates without ever framing it that way. Nonprofits running health, housing, or social service programs frequently touch PHI through the services they deliver. And government contractors in the health space usually face HIPAA obligations layered on top of federal contract requirements, which is where compliance programs tend to collide.
If your organization sits in more than one of these categories, overlapping frameworks are the norm rather than the exception. Our IT compliance guide for DC-area businesses covers how HIPAA, CMMC, NIST, and SOC 2 relate to each other, and where the requirements genuinely overlap.
How Envision approaches it
We are an Alexandria-based managed service provider, and we have supported healthcare organizations, legal firms, nonprofits, and government contractors across the DC/DMV region for more than two decades. Our model is built on three pillars, and HIPAA work touches all three.
Support. A managed helpdesk that handles access requests, onboarding, and offboarding consistently — so the administrative safeguards hold up when staff change.
Security. Cybersecurity services covering access control, encryption, monitoring, and audit logging, plus backup and disaster recovery built to protect health data specifically rather than generically.
Strategy. Compliance as a service and virtual CIO support, so the risk analysis gets refreshed on a schedule instead of when someone asks for it.
We work in both fully managed and co-managed arrangements. If you have internal IT staff, we support them rather than replace them — which is often the right fit for practices with one technical person carrying everything.
Common questions
Is there such a thing as HIPAA-certified IT?
No. HIPAA has no certification program for products or vendors. What exists is technology configured to support your obligations, a signed BAA, and documented evidence that safeguards are working.
Does the delay to 2027 change what we have to do now?
No. The delay applies to the proposed update. The existing Security Rule, in force since 2003 and updated in 2013, still applies in full.
We are a small practice. Does HIPAA still apply?
Yes. The Security Rule does not exempt organizations by size. Smaller covered entities have the same obligations with fewer people to meet them, which is a common reason to bring in outside support.
What is a BAA and do we need one with our IT provider?
A Business Associate Agreement is a contract making a vendor legally accountable for protected health information they can access. If your IT provider can reach systems containing PHI, you need one.
How often should we redo our risk analysis?
The rule requires it to be current rather than setting a fixed interval, and the proposed update would make it annual. Annual is a sensible standard now, with an additional review after any significant change to your systems.
Are we responsible if our IT vendor causes a breach?
Generally yes — a covered entity retains responsibility for protected health information. A BAA allocates accountability, but it does not remove your obligation to exercise reasonable oversight.
Does HIPAA apply to veterinary practices?
Not directly, since animal health records are outside its scope. But veterinary practices hold client and payment data that carries comparable security expectations, and many choose to work to a similar standard.
Where to start
If you are not sure where you stand, the honest first step is usually the least dramatic one: find out whether your risk analysis is current, and whether you have a signed BAA with every vendor that can reach patient data. Those two answers tell you most of what you need to know.
If you would like help getting there, see what managed IT would cost for your organization, or get in touch and we will walk through where your environment actually stands.
Share this post
