The HIPAA Security Rule Final Rule: $9 Billion Price Tag, 100+ Hospital Coalition Opposition, and What Actually Happens Next

The proposed HIPAA Security Rule overhaul is officially the most contested healthcare regulation of 2026. On one side: OCR, citing record-breaking breach volumes and inadequate industry security practices. On the other: a coalition of more than 100 hospital systems and provider associations arguing the proposal is unworkable, unaffordable, and politically misaligned with the current administration's priorities.

Here is the full picture — the proposal, the opposition, the political dynamics, and what every covered entity and business associate should actually be doing right now.

The proposal in brief

OCR published its Notice of Proposed Rulemaking on December 27, 2024, proposing the most sweeping update to the HIPAA Security Rule since the original rule took effect in 2005. The core proposals:

Mandatory encryption of ePHI at rest and in transit — eliminating the addressable specification flexibility that currently allows organizations to document alternatives. Required multi-factor authentication for all ePHI system access. Annual penetration testing. Current asset inventories and network maps as required documentation. 72-hour system restoration objectives following security incidents. Annual internal compliance audits.

If the rule is finalized as proposed, it would mean a radical shift in how the Security Rule is applied — moving away from a flexible approach to account for the various types of regulated entities to a more rigid approach with some prescriptive, strict security requirements that could be difficult to fulfill.

The $9 billion price tag

The cost estimate embedded in OCR's own regulatory impact analysis is striking.

OCR itself estimated that in just the first year, compliance across all covered entities and business associates would cost $9 billion.

Industry groups argue this figure is actually an underestimate. Their position: OCR's cost modeling does not adequately account for the infrastructure investment required by small practices, rural hospitals, and federally qualified health centers that currently lack the IT foundations on which the new requirements would need to be built. You cannot implement mandatory MFA across all ePHI systems if those systems do not currently support MFA — and many legacy healthcare systems do not.

The opposition

A coalition of more than 100 hospital systems and provider associations called for HHS to withdraw the proposed updates to the HIPAA Security Rule, which they said runs counter to President Trump's robust deregulatory agenda.

CHIME, the College of Healthcare Information Management Executives, has been among the most vocal opponents. The organization submitted public comments, co-led a stakeholder letter to HHS and the White House requesting rescission, and argues the administration's cost estimates dramatically understate the real burden, particularly for under-resourced providers.

The political argument being made by opponents is pointed: the proposed rule was published in the final days of the Biden administration, and the Trump administration has a documented deregulatory agenda. Opponents are arguing that finalizing a $9 billion compliance mandate contradicts the administration's stated priorities.

OCR's position

OCR has not flinched publicly. Director Paula Stannard has continued to defend the need for stronger security requirements — though she has also acknowledged the industry feedback.

Even if the proposed rule does not make it to a final rule, Stannard said there have already been benefits from the proposed rule. The proposal to modify the Security Rule helped put a spotlight on information security in the healthcare system and drew attention to the need for better compliance and to take cybersecurity seriously.

This statement is significant. It suggests OCR views the NPRM as having achieved part of its goal regardless of whether it becomes a final rule — by raising the visibility of security requirements and signaling to regulated entities that the current flexible framework will be enforced more rigorously.

The three possible outcomes

Outcome 1 — Finalized as proposed (or close to it)

The rule's finalization remains on the Department of Health and Human Services Office for Civil Rights' regulatory agenda for May 2026. If OCR publishes a final rule, regulated entities would have 240 days to comply — meaning mandatory compliance could begin in early 2027.

Outcome 2 — Finalized in scaled-back form

The most politically viable path may be a final rule that preserves the core requirements — encryption, MFA, asset inventories — while removing or softening the most burdensome provisions like annual penetration testing and 72-hour restoration objectives. This would allow OCR to claim a win while responding to industry concerns.

Outcome 3 — Withdrawn or indefinitely delayed

There is a caveat. The HIPAA update was proposed by OCR under the Biden administration, and the new Trump administration may choose to do nothing with the update. If the administration decides the political cost of finalizing a $9 billion mandate outweighs the cybersecurity benefits, the rule could be withdrawn or placed on indefinite hold — as happened to a previous HIPAA Privacy Rule update proposed under the first Trump term.

What you should actually do right now

Here is the practical reality that cuts through the regulatory uncertainty: whether the NPRM is finalized, revised, or rescinded, OCR is actively enforcing the rules that exist today — and the bar it is applying is whether your organization has a functioning, continuous risk management program.

The proposed rule's requirements — encryption, MFA, asset inventories, penetration testing — are not new concepts invented for this NPRM. They are security best practices that NIST, HHS cybersecurity guidance, and OCR enforcement expectations have been pointing toward for years. The question the final rule answers is whether they become explicit mandatory minimums or remain implicit expectations enforced under the existing flexible framework.

Either way, organizations that implement them are in a stronger position — for regulatory compliance, for cybersecurity resilience, and for OCR investigations triggered by breaches.

On encryption: If your ePHI is not encrypted at rest and in transit, begin the implementation process now. The investment is justified regardless of the final rule outcome.

On MFA: Audit every system that accesses ePHI for MFA capability. Where it is supported, enable it. Where it is not, evaluate whether the system needs replacement or supplemental controls.

On asset inventories: You cannot protect ePHI you do not know you have. Building a current, accurate inventory of all systems, applications, devices, and data flows touching ePHI is foundational — required under the current rule's risk analysis provisions regardless of the NPRM outcome.

On penetration testing: If your organization has never conducted a penetration test, engage a qualified security firm. The findings from a first test are typically significant and worth knowing regardless of regulatory requirements.