Question · HIPAA Security Rule
Does the proposed HIPAA Security Rule require encryption and MFA for AI systems?
The Security Rule requires administrative, physical and technical safeguards for ePHI, built on a documented risk analysis.
01 / The answer
The short answer
It would, but it is not in force. The January 6, 2025 proposed rule would require encryption of all ePHI at rest and in transit, with limited exceptions, and multi-factor authentication, and would end the distinction between required and addressable safeguards, so these controls would reach any AI system that holds or transmits ePHI. It would also add network segmentation and a technology asset inventory. No final rule had been published as of October 2026, and HHS estimates final action in July 2027. Under the current rule, encryption is still an addressable specification.
02 / The rule
What HIPAA Security Rule requires
The Security Rule requires administrative, physical and technical safeguards for ePHI, built on a documented risk analysis. A January 2025 proposed overhaul would make most safeguards mandatory and expects AI software that touches ePHI to appear in a required technology asset inventory, but HHS now lists it as a long-term action with final action estimated for July 2027.
- 01Conduct and update an accurate risk analysis covering ePHI in AI systems, including training data.
- 02Implement risk management measures, access controls, audit controls, integrity and transmission security safeguards.
- 03Obtain business associate contracts requiring AI vendors to safeguard ePHI and report incidents.
- 04Repeat risk analysis when adopting or changing technology such as new AI tools.
03 / Records
Records to keep
- 01Current risk analysis that names AI systems and their ePHI
- 02Risk management plan with dated remediation actions
- 03Technology asset inventory including AI software
- 04Business associate contracts and vendor security reviews
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
Office of Information and Regulatory Affairs (reginfo.gov)
RELATED
Related: HIPAA Security Rule: the full guide · Is an ambient AI scribe a HIPAA business associate, and what does the 2025 Security Rule NPRM change?