Free tool · Updated April 2026
2026 HIPAA Security Rule readiness framework.
OCR expects to finalize the 2026 Security Rule update this year. The NPRM eliminates “addressable” safeguards — encryption, MFA, penetration testing, and asset inventories become mandatory for every covered entity regardless of size. This framework maps 24 technical controls across 8security domains to both the current Security Rule and the NPRM’s enhanced requirements. Independent practices have limited runway.
24
Controls
Mapped to current Security Rule and 2026 NPRM provisions
8
Domains
Encryption, network, access, endpoint, monitoring, testing, vendors, governance
Weighted
Scoring
Critical controls weighted 3× — gaps where they matter most surface first
100%
Free
No login, no credit card, no trial expiration
The 2026 Security Rule NPRM changes the compliance baseline for every independent practice.
Controls previously classified as “addressable” — encryption, MFA, audit logging — become mandatory with no size exemption. This framework maps each control to both the current rule and the NPRM provision so your practice can prepare before enforcement, not after. Read the full 2026 rule breakdown →
2026 Security Rule readiness
Weighted exposure score
Critical controls weighted 3×, high 2×, standard 1×. 54 exposure points remaining.
Encryption & Data Protection
How patient data is protected at rest, in transit, and in backup.
Network Security
Perimeter defenses, segmentation, and traffic control.
Identity & Access Control
Who can reach ePHI, how identity is verified, and how access ends.
Device & Endpoint Security
Mobile devices, workstations, and session management.
Monitoring & Threat Detection
Log visibility, malware defense, and patch management.
Vulnerability & Penetration Testing
Proactive identification of exploitable gaps.
Vendor & Physical Security
Third-party risk management and physical safeguards.
Governance & Resilience
Asset inventory, policy management, continuity, and audit.
How to use this framework
Three ways to get value.
Self-audit
Work through each domain with your IT contact or office manager. Check the controls you can confirm are in place. The weighted exposure score shows where your highest-risk gaps are — not just how many boxes are unchecked.
Expand the details
Click any control to see four layers: why it matters, how Patient Protect handles it, the real breach that resulted from this gap, and what “confirmed” actually means beyond checking a box. Each control includes the current Security Rule citation and the NPRM reference.
Prioritize by weight
Critical controls (encryption, MFA, logging, vendor validation) are weighted 3× in the exposure score. Start there — those are what OCR examines first and attackers exploit most.
Why infrastructure matters
Compliance paperwork does not stop ransomware. Infrastructure does.
Most HIPAA compliance vendors focus on policies — documents that describe what should happen. The problem is that a policy does not encrypt a backup, enforce MFA, or segment a network. When the Office for Civil Rights investigates a breach, the first thing they examine is technical evidence: were safeguards in place, were they configured correctly, and were they monitored.
The 2026 NPRM makes this concrete. Controls that were previously “addressable” — meaning a practice could document why it chose not to implement them — become mandatory. Encryption at rest, MFA, penetration testing, technology asset inventories, 72-hour system restoration: these are no longer optional regardless of practice size, revenue, or patient volume.
This framework covers the 24 controls that separate a practice with a defensible infrastructure from one that is running on hope. Each control maps to a specific Security Rule provision and the corresponding NPRM enhancement, with real breach examples showing what happens when the control is missing.
Last updated: April 2026. Controls mapped to HHS NPRM “HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information” (89 FR 980, Jan 6, 2025). This framework will be updated when the final rule is published.
2026 rule deep dive
2026 HIPAA Security Rule
The full breakdown of the NPRM’s six mandates — what changes, what it means for independent practices, and how Patient Protect is already built for it.
Read the Rule AnalysisRelated tool
HIPAA Compliance Roadmap
This framework covers technical infrastructure. The Compliance Roadmap covers the full 17-step operational program — entity classification, risk assessment, policy management, vendor oversight, and breach response.
See the Full RoadmapGet a full picture
Unified Risk Assessment
This framework shows infrastructure gaps. The Unified Risk Assessment scores your overall compliance readiness, entity classification, and ePHI data flow in one comprehensive evaluation.
Take the Free AssessmentReady to close the gaps — not just document them?
The framework shows where your infrastructure is exposed. Patient Protect automates the controls — encryption, access management, monitoring, vendor tracking — so your practice meets the 2026 requirements without a security team.