Is the proposed HIPAA Security Rule already law?

No final modernization rule was established by the sources checked. HHS says the existing Security Rule continues while the proposal proceeds; the proposal was announced in December 2024 and published in January 2025. HHS regulatory initiatives.

The OIRA agenda entry places the initiative among long-term actions and lists a tentative July 2027 final action, with no legal deadline shown. That agenda entry is a planning signal, not a promised publication date or an enforceable compliance deadline. Official agenda entry.

What to do now: keep a current risk analysis, safeguard ownership and evidence program against the applicable existing rule. Use a separate column for potential future requirements rather than blending them into a current attestation. Have clinical operations review any change that could interrupt patient care. Current HHS rule summary.

Ask a provider: which deliverables address present duties, which are optional preparation, and how will the scope change if the final text differs? Obtain a change-control mechanism rather than assuming every proposed requirement will survive unchanged.