The U.S. Office of Management and Budget has pushed the final HIPAA Security Rule update from a proposed May 2026 release to a July 2027 final action date. If your organization felt rushed by the original timeline, you now have roughly an additional year before the rule becomes final. (Source: Hipaajournal)

That extra runway matters operationally. The proposed changes are extensive—encryption, mandatory multifactor authentication, network segmentation, anti-malware, annual penetration tests, and vulnerability scans every six months, among others. Implementing all of that takes budget, staffing, and planning that many healthcare organizations, particularly small and rural providers, could not realistically stand up on the original schedule.

Here is the important caveat: the delay changes the compliance deadline, not the threat. Attackers targeting healthcare are not waiting for a final rule. The extension gives you time to plan, but it does not lower your current exposure to ransomware, credential theft, or data breaches that the update was written to address.

It is also worth understanding what the delay does not guarantee. The timeframes government agencies publish for new rules are not legally binding. OCR could press ahead and issue a final rule before the July 2027 date, or push it back further. Building your plans around the assumption of a firm 2027 deadline carries risk if that date moves up.

The ePHI of an estimated 192.7 million Americans was stolen in the ALPHV/BlackCat attack on Change Healthcare—an intrusion that succeeded partly because multifactor authentication was not enabled.

That single incident illustrates why this delay is consequential. The controls the proposed rule would mandate—MFA and network segmentation chief among them—are the exact safeguards whose absence enabled attacks like the one on Change Healthcare. Waiting on the regulation to make those changes leaves the same gaps open. The following sections examine the threat landscape driving the rule and what you can act on during the extended window.

Why Healthcare Remains a High-Value Target for ALPHV and BlackCat

The ALPHV/BlackCat group's attack on Change Healthcare shows why they keep coming back to the sector: one intrusion into a company that touches one in every three patient records yielded the ePHI of an estimated 192.7 million Americans. Healthcare aggregates enormous volumes of high-value data—clinical records, insurance details, payment information—in environments where downtime directly affects patient care. That combination gives the attackers pressure to extract a ransom payment.

The initial access method in the Change Healthcare case is instructive. The attackers reached the network through a Citrix remote access portal using stolen credentials, and multifactor authentication was not enabled on that portal. A single set of valid credentials was enough to get inside a system serving hospitals, physicians, pharmacies, and laboratories nationwide.

That is the recurring pattern with ALPHV-style intrusions: rather than exploiting an exotic vulnerability, they use legitimate credentials to log into remote access infrastructure. For your organization, it means an exposed remote portal without MFA is a direct route to the ePHI behind it, and the login looks like normal authenticated traffic rather than an obvious break-in.

Double Extortion: Encryption Plus Theft

ALPHV/BlackCat operations combine two forms of pressure. The group encrypts systems to halt operations, and it also steals data before deploying the encryptor. In the Change Healthcare incident, the ePHI was exfiltrated as part of the attack, which means a victim faces both an outage and the exposure of stolen records regardless of whether they restore from backup.

This is why backup recovery alone does not resolve the situation. Even an organization that restores encrypted systems from clean copies still has data in the attackers' hands, and that data can be published or sold. The proposed HIPAA Security Rule update's requirements for network segmentation and dedicated backup controls address different halves of this problem—segmentation limits how far the encryption and theft spread, backups address the availability loss.

What the Attack Chain Looks Like Inside Healthcare Networks

The observable sequence in the Change Healthcare breach maps to a familiar order of operations for this class of ransomware group:

• Initial access through a remote access portal using valid stolen credentials, with no MFA to block reuse.
• Movement across the network from the entry point toward systems holding billing, payment, and clinical data—the intrusion reached infrastructure relied on for billing and payment processing across the country.
• Data theft at scale, with the ePHI of an estimated 192.7 million people removed from the environment.
• Encryption of production systems, producing an outage that lasted weeks and disruption that continued far longer for downstream providers.

The outage caused by the attack lasted for weeks, while the disruption for providers continued for much longer. The ePHI of an estimated 192.7 million Americans was stolen in the attack.

The gap between the technical event and the business damage is what stands out. The company's clients had severe cash flow problems, care delivery was affected, and some providers were forced to temporarily close—consequences that flowed from a clearinghouse outage rather than a direct compromise of those providers.

That interdependence is the point relevant to the Security Rule update. The proposed shorter timelines for business associates and verification of their technical safeguards exist because a single vendor's missing control—MFA on a remote portal—can affect a large share of the industry's records at once. When you depend on a clearinghouse or third-party processor, its weakest access control becomes part of your exposure.

The absence of MFA on the compromised portal is the single detail OCR points to, and it is one of the mandatory requirements in the proposed rule. An intrusion of this scale traced back to a control that stops credential reuse is why the update treats MFA and segmentation as mandatory rather than optional.

Compliance Delay as an Operational Risk Window

The one-year delay to July 2027 creates a practical problem: with no imminent deadline, the encryption, authentication, and network segmentation work outlined in the proposed rule slides down the priority list. If you push those projects into next year's budget cycle, you accept the risk profile that exists today for another twelve months or longer.

That risk profile has not improved. The threats that prompted the rulemaking in the first place—hacking incidents and ransomware against healthcare that have climbed steadily over the past decade—continue during the window. The regulation is delayed; the attackers are not.

Consider what a ransomware incident actually costs a mid-sized hospital during this period, separate from any ransom demand:

• Patient care disruption — when clinical and billing systems go offline, procedures get rescheduled, cash flow stalls, and in the worst cases facilities close temporarily until systems recover.
• Breach notification liability — under HIPAA, you must notify affected individuals, HHS, and in large breaches the media. Those obligations exist now, under the current Security Rule, regardless of the delayed update.
• OCR enforcement — the same investigations, complaints, and audits that surfaced the deficiencies behind the proposed rule remain active. A breach caused by a missing safeguard the update would have required does not become excusable because the update is not yet final.
• Reputational damage — patients and referring providers weigh whether their data is safe with you, and that judgment outlasts the recovery period.

Here is the trap in the enforcement math. OCR investigates breaches under the rule that is in force at the time of the incident. If you defer multifactor authentication or network segmentation because those items are "not required until 2027," and an intrusion happens in the interim, you are still expected to have conducted an adequate risk analysis and addressed identified risks under the existing Security Rule. The delay pushes the new prescriptive requirements; it does not lower the current standard of care.

The financial framing from HHS underscores why deferral is tempting and why it is a gamble. The agency itself calculated the compliance burden as significant:

The HHS calculated that the proposed changes will have a one-year industry cost of $9 billion, with annual industry costs of $6 billion a year for years two through five.

Those numbers explain the pressure to wait. But the spending you defer is largely the same spending that reduces the probability and blast radius of an incident. Encryption limits what stolen data is usable. Segmentation limits how far an intruder moves once inside. Anti-malware and authentication controls raise the cost of the initial foothold. Postponing them keeps your exposure at its current level while the calendar buys you nothing on the threat side.

For small and rural providers operating on thin margins, the calculation is sharper. You may not have the capital to absorb both a compliance sprint and an incident recovery. Treating the delay as breathing room to plan and phase the work is defensible. Treating it as permission to stop is how you arrive at July 2027 with the same gaps and a breach on your record in between.

The extra year changes the deadline, not the underlying risk. Budget and staffing decisions made during this window determine what your organization looks like when either the rule finalizes or an incident arrives—whichever comes first.

Immediate Detection and Response Actions for Healthcare IT Teams

The single most important action is to confirm multifactor authentication is enabled and enforced on every remote access point—VPN concentrators, Citrix and other virtual desktop gateways, and any administrative portal reachable from the internet. The Change Healthcare intrusion started with stolen credentials on a remote portal that had no MFA in front of it, and that pattern repeats across healthcare breaches. Enforce MFA on all administrative accounts, and monitor for repeated MFA prompts or push-notification fatigue, which indicate an attacker holding valid credentials and trying to get through.

Identify

Build the technology asset inventory and ePHI data-flow map that the proposed rule will require anyway. You cannot detect intrusion on systems you do not know exist, and shadow remote-access tools are a common blind spot.

Prioritize inventorying every account with domain administrator, backup administrator, or clearinghouse-facing privileges. These are the accounts ransomware operators hunt for once inside.

Protect and Detect

Watch these log sources for the behaviors that precede encryption in a healthcare network:

• Endpoint telemetry — credential dumping (LSASS memory access), disabling of antivirus or endpoint agents, and unsigned binaries running from temp directories.
• Network traffic — lateral movement over RDP and SMB between clinical, billing, and administrative segments that normally do not talk to each other.
• Email gateways — phishing and business-email-compromise attempts, the initial access route these actors use most often.
• Authentication logs — logins from unusual geographies, impossible-travel events, and successful access after a burst of failures.

The behavior to catch early is deletion of Volume Shadow Copies and backup snapshots, which ransomware operators do to prevent local recovery. In environments Capstone manages, N-able Cove maintains offsite backup copies that stay outside the reach of an attacker deleting shadow copies on the production network. Also watch for large outbound transfers to cloud storage or file-sharing services, which signal data theft ahead of encryption.

Respond

Test your incident response plan against a clearinghouse or billing-system outage specifically, not a generic scenario.

Validate that network segmentation actually holds by attempting to reach ePHI stores from a clinical workstation—if that path is open, segmentation exists on a diagram but not in practice. Adlumin monitors authentication patterns across managed environments and flags the lateral login anomalies that show an attacker moving from an initial foothold toward those ePHI systems.

Recover

Do a real restore test. Pull a backup and rebuild a system end to end, timing how long it takes and confirming the data is intact and free of malware. Many organizations discover during an incident that their backups were incomplete or themselves encrypted.

The ePHI of an estimated 192.7 million Americans was stolen in a single clearinghouse intrusion that began with stolen credentials and no MFA.

Over the next twelve months, run a vulnerability scan cadence that matches the proposed rule's every-six-months requirement, patch internet-facing remote access appliances on a fixed schedule, and train staff on the phishing and social engineering lures that healthcare workers see. Threat-hunt now for existing compromise rather than assuming you are clean—dwell time in healthcare intrusions is often long, and the credentials taken in a quiet breach today become the entry point for encryption later.

Why the Deadline Extension Should Not Delay Your Security Investments

The postponement of the final rule to July 2027 changes your compliance timeline. It does not change the threat activity that prompted the rulemaking in the first place. The same ransomware operators that hit Change Healthcare continue to target the sector, and they do not adjust their schedule to match federal rulemaking dates.

That gap is the core tension. The regulation is on pause; the attacks are not. If you read the extension as permission to defer encryption, authentication, and segmentation projects, you carry today's exposure forward for another year or more while the cost of a breach continues to climb.

HHS itself put a number on the effort involved, estimating a one-year industry cost of $9 billion to implement the proposed changes, followed by $6 billion annually for years two through five. Work at that scale cannot be assembled in the final weeks before a deadline. Treating the delay as build time rather than idle time is what separates organizations that meet the eventual deadline from those that scramble.

The most useful thing you can do with the additional runway is run a threat assessment focused specifically on ransomware resilience—how an intruder with valid credentials would move through your environment and what would still function if your primary systems went dark. Pair that with a real test of your backup and recovery process and a review of whether your incident response playbooks reflect your current systems and staff.

Use the extra year to strengthen your defenses. The delayed deadline is a planning opportunity, not a reason to stand down.