Providers Evaluate Security as Updated HIPAA Compliance Looms

A number of the conditions would overtax already-burdened IT staffs, including a mandatory compliance deadline that would be a “shock to our system,” says CHIME Director of Federal Affairs Chelsea Arnone.

“We strongly support improving cybersecurity across healthcare, but this proposal is overly prescriptive, requires a lot of documentation and is technically misaligned with how healthcare systems operate,” Arnone adds.

Before the end of 2025, CHIME organized a joint letter with more than 100 hospital systems, healthcare organizations and associations asking HHS to withdraw its proposed update and to collaborate with providers to develop a more practical, risk-based cybersecurity framework.

It’s unclear what HHS will do. According to the agency’s latest unified agenda, it anticipates releasing a final rule in May 2026, but that date is not binding, Arnone says.  

How Kern Medical Strengthened Its Cybersecurity From Scratch

When Witmer joined Kern Medical, his immediate priorities were to upgrade outdated data center and networking equipment, and to replace an inadequate tape backup system and an insufficient network-attached storage replication system. As part of a broad modernization effort, the changes included a new electronic health records system and financial applications.

That year, Witmer deployed new Cisco servers and networking equipment, storage from Pure Storage and a new data backup and recovery solution from Rubrik, which enables immutable backups that cannot be changed or rewritten, a critical capability that protects against ransomware attacks. 

To strengthen security further, Witmer addressed excessive user permissions that could allow attackers to spread ransomware throughout the network if credentials are compromised. He implemented role-based access control by adopting Active Directory on-premises, Entra ID on Microsoft Azure and a network access control solution.

He has also segmented the network to reduce the attack surface and adopted Microsoft’s Entra MFA, Microsoft Defender endpoint security and BitLocker encryption. Increased security staffing means support from a virtual CISO and an in-house security analyst team for daily operations.

Moving forward, Witmer has put together an artificial intelligence governance committee to develop security, privacy and usage policies on generative AI tools. He also plans to outsource 24/7 security monitoring because the hospital’s cyber insurance company has signaled that it will be a requirement in the future.

Overall, much of the proposed HIPAA security guidance that includes MFA, data backups and network segmentation mirrors requirements by Kern Medical’s insurance company, Witmer says.

“What I see on the list of proposed requirements for the HIPAA Security Rule, we already have in place,” he says. “We’re already exceeding their minimum requirements.”

San Juan Regional Medical Center’s Rapid Security Transformation

In Farmington, N.M., San Juan Regional Medical Center has beefed up its cyberdefenses so much in the past year that CIO John Gaede believes the hospital could implement most if not all of the proposed HIPAA technical controls within the required six months.

“We’re hardening this place. We’re on the road to every one of these items already,” Gaede says.

When he joined the hospital in early 2024, Gaede inherited a technology environment that was “broken at every level,” from infrastructure to security. He decided to bring outsourced IT operations back in house and prioritize security.

This security-first approach was shaped by his previous experience as CIO of Sky Lakes Medical Center in Oregon, where a 2020 ransomware attack caused a 23-day outage that took the hospital seven months to fully recover from.

READ MORE: How can healthcare organizations navigate security changes linked to HIPAA updates?

Gaede recruited CISO Micheal Perryman, his former security manager who guided Sky Lakes’ recovery process, and together, they developed a comprehensive security strategy for San Juan Regional Medical Center. With strong leadership support, they invested in a five-year, $6.5 million Cisco Enterprise Agreement in 2025 to modernize and secure network infrastructure.

The hospital replaced all end-of-life network switches and firewalls and turned to Cisco’s security portfolio for MFA, monitoring, network access and endpoint device protection. There’s also an extended detection and response service that works as the hospital’s 24/7 security operations center (SOC), monitoring threats across the entire IT environment.

“We’re a rural, not-for-profit hospital, and now we have this level of tools to help us be successful,” Gaede says.

The investment proved its worth in October 2025, when a targeted distributed denial of service attack hit the medical center. Its new internal security team coordinated with the Cisco Talos Intelligence team, implementing DDoS mitigation tools within two hours. Core systems continued operating, and patient care wasn’t interrupted. “We were able to prevent the organization from going offline,” he says.

Next up, in 2026, Gaede says the hospital will roll out Cohesity’s immutable data backup solution to further bolster security and resiliency.

NIST Cybersecurity Framework Enables HIPAA Readiness

As a major academic health system, the University of Oklahoma’s OU Health may have more resources than a community hospital, but it’s an even bigger target for cyberthreats.

With more than 1,300 physicians and 11,000 employees, OU Health continuously bolsters its security to counter the increased risk. CISO Monte Coulter has more than quadrupled the IT security staff, from six to 26 people, since joining three years ago.

The larger staff can split into four focus areas: identity and access management; governance, risk and compliance; cybersecurity operations; and engineering, which implements security tools such as the security information and event management software used in the SOC.

The health system has long adopted security tools required by the proposed HIPAA guidance, including Rubrik's backup and recovery solution as well as MFA, identity governance and access management solutions. Automating accounts provisioning with appropriate access rights has eased workflows. “Before, everything was manual, which was error-prone,” Coulter says.

Next, Coulter wants to improve authentication by requiring MFA for every login or authentication event, using new context-aware capabilities. If users work consistently from trusted devices and locations, they may not be prompted repeatedly to authenticate. But login attempts from new locations or devices will require authentication, he says: “It’s smart, behavioral, contextual MFA.”

In light of the proposed HIPAA security measures, OU Health is ready. “There are a couple of things we need to address, but I feel like we’re fairly well set up for any changes,” he says.

The organization relies on the National Institute of Standards and Technology Cybersecurity Framework, which provides a solid foundation, Coulter says. “If you follow a good cybersecurity framework and develop a program around general security, any regulation that comes out, you’re going to be OK with,” he says.