HIPAA Security Rule Changes: A Preparation Guide for Long Beach Medical and Dental Offices

For more than twenty years, the HIPAA Security Rule has guided how healthcare practices protect electronic patient information. During that time, the threats have changed completely. Practices that once worried about a lost filing cabinet now face ransomware crews, stolen logins, cloud misconfigurations, and phishing messages written by artificial intelligence. The rule itself, however, has barely changed since 2013.

That gap is what federal regulators want to close. In late 2024, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights proposed the first major overhaul of the Security Rule in a generation. The proposal would turn many “recommended” safeguards into firm requirements and add specific technical expectations that small offices have never been formally held to.

This guide explains the proposed changes in plain language, what they would mean for medical and dental offices, and what you can do now. Many of the steps are smart whether or not the final rule looks exactly like the proposal. A note on timing: regulatory details can shift, so confirm the current status of the rule with HHS and your legal counsel before you finalize any compliance plan.

Where the Security Rule Stands Today

The current Security Rule requires covered entities and business associates to protect electronic protected health information (ePHI) through administrative, physical, and technical safeguards. Its flexible, scalable design was intentional, because it needs to work for a solo dentist and a hospital system alike.

That flexibility created a problem. The rule divides its specifications into two groups:

• Required: Controls every organization must implement.
• Addressable: Controls an organization must implement or document why an alternative is reasonable.

In practice, many small offices treated “addressable” as “optional.” Encryption, for example, was often skipped without a documented analysis. Regulators have repeatedly found that practices lacked a thorough risk analysis, which remains one of the most common causes of enforcement actions.

The proposed rule responds to this history. It aims to remove ambiguity, require written proof, and set a higher baseline for cybersecurity across the healthcare sector.

What Has Been Proposed

The HHS proposal, published for public comment in early 2025, would make several significant changes. Because the rule had not been finalized at the time of this writing, treat the list below as the direction of travel, not a final checklist.

• No more “addressable” category. Nearly all specifications would become required, with only narrow exceptions.
• Written documentation for everything. Policies, procedures, plans, and analyses would need to be in writing and kept current.
• Technology asset inventory and network map. You would need to know every device and system that touches ePHI and how data flows between them, reviewed at least every twelve months.
• A more rigorous risk analysis. The analysis would need to be detailed, written, and reviewed at least annually or after major changes.
• Mandatory multi-factor authentication. Access to systems that hold ePHI would require MFA, with limited exceptions.
• Required encryption. ePHI would need to be encrypted both at rest and in transit, again with limited exceptions.
• Network segmentation. Systems with ePHI would need to be separated from other parts of the network.
• Vulnerability scanning and penetration testing. Scans at least every six months and penetration tests at least every twelve months.
• Defined patching timelines. Critical vulnerabilities would need to be addressed within about fifteen days, and high-risk ones within about thirty.
• Faster recovery. Organizations would need to restore critical systems and data within seventy-two hours of a loss.
• Tested incident response. Written response plans would need regular testing.
• Annual compliance audits. You would need to verify at least once a year that you meet each requirement.
• Stronger business associate oversight. Vendors would need to verify their technical safeguards annually and notify you within twenty-four hours of activating their contingency plans.
• Faster access changes. Covered entities would need to notify relevant parties within twenty-four hours when a workforce member’s access changes or ends.

The proposal also contemplated a transition period after the final rule takes effect. Even so, preparing early is far easier than scrambling when a deadline arrives.

Why This Matters for Long Beach Practices

Medical and dental offices are attractive targets because patient records contain everything a criminal needs for identity theft, insurance fraud, and extortion. At the same time, practices tend to operate with lean teams and limited IT budgets.

Long Beach offices face a familiar mix of pressures:

• Small teams wearing many hats. The office manager often doubles as the IT contact.
• Shared workstations and front desk traffic. Screens, printers, and sign-in tablets create physical and technical exposure.
• Referrals and outside providers. Records move constantly between primary care, specialists, labs, imaging centers, and insurers.
• Telehealth and patient portals. Convenience features add new systems that must be secured.
• Older equipment. Imaging machines, sensors, and legacy practice software often run outdated operating systems.
• California privacy rules. State laws, including the Confidentiality of Medical Information Act, can add obligations beyond HIPAA.

Understanding the healthcare security challenges that medical practices face today puts the proposed requirements in context. Many of them simply formalize what good security already looks like. Practices that fall behind often have patient trust technology gaps that patients never see until something goes wrong.

Start With a Real Risk Analysis

Everything in the Security Rule builds on the risk analysis. It is the single most cited failure in HIPAA enforcement, and the proposed rule would make it even more demanding.

A strong risk analysis answers four questions:

• Where does ePHI live, travel, and get stored?
• What threats and weaknesses could expose it?
• How likely is each risk, and how damaging would it be?
• What controls reduce each risk, and who owns them?

A checklist is not a risk analysis. A real one documents your systems, evaluates actual vulnerabilities, ranks risks, and produces a plan with deadlines. It also needs to be updated when something changes, such as a new EHR, a new location, or a new cloud service.

Working with specialists who provide HIPAA compliance support can turn this exercise from a dreaded annual chore into a clear roadmap. Many practices also find that reviewing common HIPAA compliance gaps is a useful way to spot weak points before an auditor does.

Build Your Asset Inventory and Network Map

The proposal would require a written inventory of every technology asset that creates, receives, maintains, or transmits ePHI, plus a map showing how that information flows. This sounds simple. In reality, many offices discover devices nobody remembered.

A complete inventory for a medical or dental office usually includes:

• Workstations, laptops, and tablets used at the front desk, in exam rooms, and in operatories
• Servers and cloud-hosted systems for the EHR or practice management software
• Imaging equipment, including digital X-ray sensors, panoramic units, intraoral cameras, and scanners
• Network devices such as firewalls, switches, routers, and wireless access points
• Medical and diagnostic devices that connect to the network
• Mobile phones and personal devices used for work
• Printers, copiers, and fax services that store images of documents
• Telehealth platforms and patient portals
• Backup systems and any offsite storage
• Phone systems and voicemail, which may contain patient details

For each asset, record the owner, location, software version, and the type of data it touches. Then draw how data moves: from patient intake to the EHR, from the EHR to the billing service, from the practice to the lab, and from the office to the cloud.

Once you can see the map, gaps become obvious. You may find an unsupported device on the same network as your records, or a vendor connection nobody has reviewed in years. Replacing old gear is easier when purchasing follows a plan, and IT procurement guidance helps you choose hardware that will stay supported. Retiring unsupported equipment also means dealing with outdated operating system risks, which are especially common in dental imaging environments.

Multi-Factor Authentication Everywhere It Counts

Stolen credentials are behind a large share of healthcare breaches. That is why the proposal would make MFA a requirement instead of a suggestion.

Plan to protect these access points first:

• EHR and practice management logins
• Email accounts
• Remote access and VPN connections
• Cloud storage and patient portal administration
• Administrator accounts on servers, firewalls, and workstations
• Billing and clearinghouse platforms

Many practices still depend on shared logins at the front desk or in treatment rooms. Shared accounts make it impossible to know who viewed which record, which creates problems for both security and audit trails. Give each person a unique account, and remove access the same day someone leaves.

If you need a primer on why this control matters so much, learning how MFA account takeover protection works shows why it stops so many attacks. Practices with staff working from home or traveling between locations should also consider remote staff access controls that verify both the person and the device.

The proposed twenty-four-hour notification rule for access changes also means you need a reliable offboarding process. When someone leaves, HR, the office manager, and IT must work from the same checklist so accounts are disabled quickly and completely.

Encrypt Patient Data at Rest and in Transit

Encryption turns readable records into scrambled data that is useless to anyone without the key. Under the current rule, encryption is addressable. Under the proposal, it would be required in most cases.

Focus on these areas:

• Laptops, tablets, and desktops: Turn on full-disk encryption.
• Servers and databases: Encrypt stored records, including those used by imaging and practice software.
• Mobile devices: Require device encryption, screen locks, and remote wipe capability.
• Email and file transfers: Use secure methods when sending records to patients, labs, and other providers.
• Backups: Encrypt both local and offsite copies, and protect keys separately.
• Wireless networks: Use modern encryption and keep guest access fully separate.
• Portable media: Avoid USB drives, or encrypt any that are truly necessary.

Encryption is not a cure-all. A logged-in user on an unlocked workstation can still view everything. But it removes the worst-case scenario, because a stolen laptop or backup drive becomes a replaced device instead of a reportable breach. To decide where stronger protection belongs, review encryption in hybrid environments that mix on-site equipment with cloud services.

Segment Your Network

Network segmentation means dividing your network into zones, so a problem in one area cannot easily spread to another. The proposal would require this for systems that hold ePHI.

A practical layout for a medical or dental office separates:

• Systems that store or process patient records
• Front desk and administrative computers
• Imaging devices and clinical equipment
• Guest and patient Wi-Fi
• Security cameras, thermostats, and other smart devices
• Staff personal phones and tablets
• Phone and communications systems

The most common mistake is putting everything on one flat network. When the waiting room Wi-Fi shares a path with the server that holds records, one infected visitor device can become a very bad day.

Professional network segmentation support designs these zones, monitors the traffic between them, and keeps firewall rules from drifting over time. Pairing segmentation with a zero trust security model means every user and device must prove itself before reaching sensitive records.

Scanning, Testing, and Patching on a Schedule

The proposal would turn good habits into required routines:

• Vulnerability scans at least every six months
• Penetration tests at least every twelve months
• Patching of critical and high-risk flaws within defined timeframes
• Removal of unneeded software and closing of unused network ports
• Anti-malware protection on all systems that touch ePHI
• Secure configuration standards for servers, workstations, and network gear

For a small office, this schedule is hard to maintain without help. Patches arrive constantly, and many clinical applications are fragile. The solution is a documented process: identify what needs updating, test it, schedule it outside patient hours, and record the result.

Ongoing cybersecurity protection services handle scanning, endpoint monitoring, and threat response around the clock, which is nearly impossible to replicate internally. Practices should also close endpoint security gaps, since laptops, tablets, and phones are common entry points for attackers.

Prepare for the Seventy-Two-Hour Recovery Standard

One of the most talked-about proposals is the requirement to restore critical systems and data within seventy-two hours. For a medical or dental office, that is a business survival issue. If your scheduling system, EHR, or imaging archive is down for a week, patients cannot be seen and revenue stops.

Meeting a seventy-two-hour target requires more than having backups. You need:

• Defined priorities: Know which systems come back first, such as the EHR, scheduling, phones, and imaging.
• Reliable copies: Keep multiple backups, including one that attackers cannot alter or delete.
• Tested restores: Practice bringing systems back and time how long it takes.
• Documented procedures: Write down steps, contacts, and decision authority.
• Downtime workarounds: Prepare paper forms and manual processes for patient care during an outage.
• Communication plans: Decide how you will reach staff and patients if email or phones are down.

Dependable backup and recovery solutions form the foundation of this capability. A practical 72 hour recovery plan shows how to organize the first critical days after an attack. Broader business continuity planning ties security and operations together so patient care can continue while systems are restored.

Cloud-hosted practice systems can also shorten recovery dramatically. If you are considering a move, secure cloud migration planning helps you build in encryption, access controls, and logging from the beginning.

Strengthen Business Associate Oversight

Medical and dental practices rely on many outside companies: EHR vendors, billing services, answering services, transcription providers, IT firms, cloud hosts, shredding companies, and more. Under HIPAA, any vendor that handles ePHI on your behalf is a business associate, and you remain responsible for choosing them carefully.

The proposal would increase expectations in several ways:

• Business associates would need to verify their technical safeguards at least annually and provide written confirmation.
• They would need to notify you within twenty-four hours of activating their contingency plans.
• Covered entities would be expected to keep business associate agreements current and documented.

Build a simple vendor management routine now:

• Keep an up-to-date list of every vendor that touches patient data.
• Confirm a signed business associate agreement is on file for each.
• Request security documentation and audit reports each year.
• Ask how and when they will notify you of a breach or outage.
• Remove access for vendors you no longer use.

Practices with many overlapping vendors often struggle with this, and understanding vendor sprawl risks shows how scattered contracts create hidden exposure. Staff-adopted tools add another layer, so learn about unapproved app risks before a well-meaning employee pastes patient notes into an unvetted app. Keeping approved tools patched and visible is easier with productivity application management that standardizes what your team uses every day.

Watch Out for AI Tools and Patient Data

AI scribes, chatbots, and summarization tools are arriving fast in healthcare. They promise real time savings, but they also create new pathways for ePHI to leave your environment. Before any AI tool touches patient data, confirm that the vendor will sign a business associate agreement, does not train its models on your data, and meets your security standards.

The topic deserves its own policy. Review the AI in healthcare benefits and roadblocks so you can adopt useful tools without creating compliance problems. The same rules about risk analysis, documentation, and vendor oversight apply to every new technology you introduce.

Train Every Person on Your Team

The proposed rule would reinforce the long-standing requirement to train all workforce members, and training often decides whether an attack succeeds. A receptionist who spots a fake insurance email can prevent a breach that no firewall would have stopped.

Effective training for medical and dental teams includes:

• Short, regular lessons instead of one long annual session
• Simulated phishing messages that look like real insurance, lab, and patient emails
• Clear rules for sharing records by email, text, or fax
• Guidance on handling patient information at the front desk and in open areas
• A no-blame process for reporting mistakes and suspicious messages
• Role-specific content for clinicians, billing staff, and managers

Modern staff cyber training programs keep lessons practical and memorable, which helps behavior change last. Document attendance and content, because the proposal emphasizes written proof.

Get Ready for Annual Compliance Audits

Under the proposal, you would need to verify at least once a year that you meet every requirement. Even if the final rule changes the details, regulators and insurers already expect organized evidence.

Keep a compliance folder that includes:

• Your latest risk analysis and remediation plan
• The asset inventory and network map
• Policies and procedures with review dates
• Training records and phishing test results
• Backup and restore test logs
• Vulnerability scan and penetration test reports
• Business associate agreements and vendor reviews
• Incident response plans and tabletop exercise notes
• Access reviews and offboarding records

Practices that treat documentation as an everyday habit find audits far less stressful. Understanding why stricter compliance audits are becoming the norm helps you set a steady rhythm instead of a yearly panic.

What a Breach Really Costs a Small Practice

Penalties for HIPAA violations can be significant, but regulatory fines are only part of the picture. A breach can lead to patient notification costs, credit monitoring, forensic investigations, legal fees, lost appointments, insurance consequences, and a damaged reputation in a community where word travels quickly.

Reviewing the cost of data breach for small organizations often changes how owners think about prevention budgets. Cyber insurance can help, but it is not automatic. Policies now ask detailed questions about MFA, backups, and training, and inaccurate answers can jeopardize a claim. Learn about cyber insurance requirements before your next renewal so your coverage matches your actual practices.

Medical Office Priorities

Medical practices should pay special attention to:

• EHR security: Review user permissions, audit logs, and vendor security commitments.
• Patient portals: Confirm strong login protection and monitor for suspicious activity.
• Telehealth platforms: Use approved, secure tools with signed business associate agreements.
• Lab and imaging connections: Secure interfaces and review who can access them.
• Exam room devices: Lock screens automatically and prevent shared logins.
• Phone and fax systems: Protect voicemail, call recordings, and digital fax services that contain patient information.
• Referral workflows: Use secure channels instead of regular email when sharing records.

Secure voice and messaging matter in clinical settings, and modern secure unified communications can protect calls, texts, and virtual visits under consistent access controls.

Dental Office Priorities

Dental practices have their own risks:

• Imaging systems: Digital sensors, panoramic units, and cone beam scanners often run older software and connect directly to the network.
• Practice management software: Many platforms are installed locally and need careful patching and backup.
• Multiple operatories: Each room adds workstations that need access control and automatic logoff.
• Insurance and billing portals: Credentials for these sites are frequent phishing targets.
• Multi-location groups: Different offices may use different equipment and inconsistent settings.
• Intraoral cameras and scanners: These devices create files that must be stored and transferred securely.

Because dental offices run on tight schedules, downtime hurts immediately. A seventy-two-hour recovery goal can feel generous until you realize how many patients are rescheduled each day the schedule is unavailable.

A 90-Day Preparation Plan

You do not need to do everything at once. Use this timeline to build momentum.

Days 1 to 30: Discover and document

• Complete or refresh your risk analysis.
• Build an inventory of devices, software, and vendors that touch patient data.
• Draw a basic map of how ePHI moves through your office.
• Turn on MFA for email, remote access, and administrator accounts.
• Confirm that business associate agreements are signed and current.

Days 31 to 60: Close the biggest gaps

• Enable encryption on laptops, mobile devices, and backups.
• Separate guest Wi-Fi and clinical devices from administrative systems.
• Eliminate shared accounts and set up a same-day offboarding process.
• Schedule vulnerability scans and review patching practices.
• Run a test restore of your most important system and record the time.

Days 61 to 90: Prove and sustain

• Hold staff training and document attendance.
• Write or update your incident response plan, and run a tabletop exercise.
• Review vendor security documentation and tighten access.
• Create a compliance calendar for recurring tasks.
• Assemble your audit evidence folder.

Long-term planning matters as much as quick fixes. Ongoing strategic IT guidance helps you connect compliance work to equipment refreshes, new locations, and budget cycles.

Common Mistakes to Avoid

Many practices repeat the same errors:

• Treating “addressable” as “optional.” The proposal would end that interpretation.
• Using a template risk analysis. A generic checklist rarely reflects your real environment.
• Skipping documentation. If it is not written down, an auditor may treat it as not done.
• Ignoring old equipment. Unsupported imaging and clinical devices are common weak points.
• Relying on backups that were never tested. An untested backup is only a hope.
• Sharing logins. It breaks accountability and weakens every other control.
• Forgetting vendors. Your responsibility continues when data leaves your office.
• Waiting for the final rule. Most proposed controls are already best practice.

Why a Local Partner Makes Preparation Easier

Clinicians and office managers did not enter healthcare to become compliance experts. Patient care fills every hour, yet the proposed rule would demand more documentation, more testing, and more proof. A trusted technology partner can carry much of that load.

CMIT Solutions of Long Beach works with local organizations to assess where they stand, prioritize the most important fixes, and keep evidence organized for audits and insurers. A dependable managed IT services approach brings patching, monitoring, backup oversight, and reporting together under one team that learns your environment. When a workstation locks up in the middle of a patient visit, responsive help desk support gets your team moving again quickly. If you want a Long Beach IT partner that understands the pace of medical and dental practices, an early conversation saves both time and money.

Strong healthcare technology protects people as well as systems, and learning how healthcare IT protection supports both patients and physicians helps you see the bigger picture. Practices that fall behind should also consider why providers must upgrade technology for patient data before an incident forces the issue.

When evaluating any provider, look for:

• Experience with HIPAA and healthcare environments
• Around-the-clock monitoring and fast response
• Clear reporting that practice leaders can understand
• Help preparing documentation and audit evidence
• A proactive approach instead of waiting for things to break

Conclusion: Prepare Now, Not After the Deadline

The proposed HIPAA Security Rule changes signal a clear direction. Regulators expect healthcare practices to protect patient data with specific, documented, and tested safeguards, not vague good intentions. For Long Beach medical and dental offices, the most useful response is steady progress: understand your risks, know your systems, protect logins, encrypt data, segment your network, test your backups, train your team, and hold your vendors accountable.

Practices that start early will spread the work and cost over time, while those that wait may face a rush when requirements become official. CMIT Solutions of Long Beach can review your current environment, identify the gaps that matter most, and help you build a practical readiness plan. Take the first step today and Schedule a consultation to start preparing your practice.