Speaking at the NIST HIPAA Safeguarding Health Information Conference, HHS Office for Civil Rights (OCR) Director Paula Stannard outlined where federal enforcement is headed.
Her key message to healthcare organizations was clear: regulatory enforcement is sharpening around core technical safeguards, enterprise-wide risk analysis, and the risks of Artificial Intelligence (AI). NIST is the National Institute of Standards and Technology.
Interestingly, Director Stannard did not mention the HIPAA Privacy Rule. Although the conference focused on cybersecurity and HIPAA Security Rule requirements, OCR has also recently signaled that Privacy Rule changes are coming soon.
Although final regulations and timelines continue to evolve, OCR’s current enforcement posture is straightforward. In her remarks last week, Director Stannard outlined priorities for HIPAA Security Rule compliance.
The Death of “Addressable” Safeguards: Why Flexibility Is Ending
One central theme of Director Stannard’s presentation was preparing for the HIPAA Security Rule update. Under the traditional 2003 Security Rule framework, “implementation specifications” from the Code of Federal Regulations were categorized as either “required” or “addressable.”
“Required” has always meant mandatory. But “addressable” has never meant optional. Many organizations have misunderstood the standards, and now the flexibility is disappearing.
Historically, an “addressable” specification required an organization to assess whether a control was reasonable and appropriate. If not, the organization could document the rationale and implement an equivalent alternative measure. In practice, however, OCR investigators routinely find that covered entities and business associates have treated “addressable” as synonymous with “optional.”
Key Takeaways:
- “Addressable” Is Being Eliminated: The proposed Security Rule modifications eliminate the distinction between addressable and required specifications. Safeguards previously considered flexible—such as Multi-Factor Authentication (MFA) and encryption—will become mandatory standards.
- Encryption Is No Longer Debatable: Director Stannard emphasized that although encryption was classified as addressable in 2003, advances in technology, affordability, and the immense volume of cyber threats make encryption reasonable and appropriate in almost all instances today. If your organization does not currently encrypt electronic Protected Health Information (ePHI) both at rest and in transit, OCR considers that a vulnerability that organizations should correct.
- Written Documentation Is Mandatory: Under the proposed Security Rule update, organizations must document everything: policies, procedures, risk assessments, and compliance actions. Skipping a safeguard and documenting the reason will no longer suffice.
Risk Analysis is Still OCR’s #1 Enforcement Priority
Director Stannard reiterated that an enterprise-wide Security Risk Analysis under 45 CFR § 164.308(a)(1)(ii)(A) remains the single most critical requirement of the HIPAA Security Rule – and yet it is the most common failure identified in breach investigations. When a large breach occurs (affecting 500 or more individuals), OCR must investigate, and auditing the organization’s underlying risk analysis is routine. Incomplete, outdated, or superficial risk analyses fail to identify where ePHI resides across the ecosystem, leaving systems exposed to predictable exploitation.
Enterprise-Wide Security Risk Analysis (SRA)
Identifies Threats & Vulnerabilities
▼
Active Risk Management & Mitigation
Drives Compliance & Safeguards
▼
Documented Security Posture (NIST SP 800-30)
Expanded Expectations for Risk Analysis:
- Documented Asset Inventories & Network Maps: A compliant risk analysis can no longer be a generic checklist. Regulated entities must keep a comprehensive written technology asset inventory (covering hardware, software, and endpoints that touch ePHI) and an updated network map showing data movement.
- Enforcement Has Shifted to Risk Management: Conducting a risk assessment and shelving the document yields little protection. OCR is evaluating whether entities actively execute risk management plans to remediate the specific threat-vulnerability pairs uncovered during analysis.
Artificial Intelligence: BAA Rules Apply to Generative Tools
IBM and the Ponemon Institute’s most recent Cost of a Data Breach Report 2026 (the IBM Report) emphasizes that AI is greatly complicating data security risks from two directions: AI is being used as a tool by hackers to increase their chance of success in attacks from the outside; and AI-enabled environments inside of organizations need to be secured because they can be vulnerable.
As healthcare providers, billing companies, and IT vendors adopt a variety of AI tools, Director Stannard offered guidance regarding AI integration under HIPAA:
AI Compliance Element
Regulatory Mandate
Operational Requirement
Business Associate Status
Mandatory BAA
Any third-party AI platform, vendor, or cloud model that receives, processes, or transmits ePHI is legally a HIPAA Business Associate. A signed BAA is required. AI Risk Analysis
Required Evaluation
Incorporate all AI systems and algorithms into your formal Risk Analysis to identify risks associated with data ingestion, cloud storage, vendor access, and potential data leakage. Risk Management & Controls
Active Mitigation
Implement specific technical controls governing how workforce members interact with AI tools to prevent unauthorized ePHI disclosures into public or unvetted AI models.
The High Cost of Inaction
Director Stannard directly addressed industry concerns about the operational costs and administrative burdens of tighter Security Rule standards. Upgrading infrastructure requires financial and human capital, but doing nothing in today’s threat landscape costs far more.
Healthcare remains a primary target for nation-state cyber actors and aggressive ransomware cartels. A single cyber incident can produce catastrophic business disruption, reputational loss, extortion demands, civil class-action lawsuits, and heavy monetary penalties from federal regulators.
The IBM Report underscores how expensive data breaches have become. The current global average cost of a data breach is $4.99 million, up 12% from last year.
Cost Comparison: Proactive Compliance vs Data Breach
Proactive Compliance
- Proactive Security Compliance│$$ (Manageable, Planned Investment)
Inaction leading to Data Breach
- System Remediation & Downtime│$$$$
- Loss of Reputation │$$$$
- Ransom / Extortion Costs│$$$$$ (Unpredictable, costly)
- Investigative Costs, Legal Costs, Breach Notification Costs │$$$$$ (Variable yet costly)
- OCR Civil Monetary Penalties│$$$$$$$ (Variable, depending on OCR’s findings)
- Class-Action Lawsuits│$$$$$$$$$$$$ (Unpredictable, extremely expensive and lengthy process)
Total Cost of Inaction: $$$$$$$$$$$$$$$$$$$$$$
Action Plan For Improved Security Rule Compliance
Whether your organization is a covered entity or a business associate, take these steps to align with OCR’s enforcement focus:
- Perform a Complete Risk Analysis, including a Security Risk Assessment: Update your Risk Analysis now. Ensure it accounts for all ePHI repositories, remote access channels, and newly introduced cloud or software tools. Implement a Risk Management Plan from the Risk Analysis results.
- Audit Multi-Factor Authentication & Encryption: Eliminate unencrypted ePHI at rest and in transit. Enforce MFA across all clinical portals, EHRs, VPNs, and administrative workstations.
- Inventory Technology Assets & Map Data Flows: Build a formal written asset inventory and network map documenting how ePHI moves through your internal systems and third-party vendor applications.
- Audit Third-Party AI & Vendor BAAs: Identify every software application or AI tool utilized by your workforce. Verify that you have an executed Business Associate Agreement for every vendor that handles or processes ePHI.
- Document Every Policy and Action: Maintain complete written evidence of all security evaluations, patches, vulnerability scans, and policy updates to demonstrate compliance during an OCR review.
By following these baseline technical controls, healthcare leaders can:
- Ward off enforcement actions;
- Lower the costs of a data breach;
- Build a resilient defense against cyberattacks; and
- Prepare for next year’s Security Rule updates.
