HIPAA Compliance Services

The HIPAA is a U.S. federal law enacted in 1996 to protect the privacy and security of individuals’ health information. It establishes national standards for how ePHI may be used, disclosed, and protected by healthcare organizations and 
their partners.

1. The Privacy Rule governing how PHI can be used and disclosed, and patients’ rights to their own information.
2. The Security Rule mandating administrative, physical, and technical safeguards for ePHI.
3. The Breach Notification Rule requiring covered entities to notify affected individuals, HHS, and in some cases the media when a breach occurs.
4. The Enforcement Rule establishing the penalties and investigation procedures for HIPAA violations.

U.S. Department of Health and Human Services (HHS) Summary of the HIPAA Rules

The HIPAA Security Rule establishes national standards for protecting ePHI. 
It requires covered entities and their business associates to implement administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of ePHI.

The Security Rule was last significantly updated in 2013. The HHS has now proposed the most consequential overhaul in over a decade, with proposed changes that would make vulnerability scanning and penetration testing explicit, mandatory requirements.

U.S. Department of Health and Human Services (HHS) Security Rule Guidance

On January 6, 2025, the HHS OCR published a Notice of Proposed Rulemaking proposing the most significant changes to the Security Rule since 2013:

• Eliminating the distinction between “required” and “addressable” specifications, making all safeguards mandatory.
• Requiring vulnerability scanning at least every six months.
• Requiring annual penetration testing.
• Mandating multi-factor authentication and encryption for ePHI.
• Requiring a written technology asset inventory and network map.
• Establishing a 72-hour system restoration requirement following 
a security incident.

The rule is targeted for finalization in May 2026, with a 240-day compliance window.

HHS OCR NPRM Fact Sheet

Under the current HIPAA Security Rule, vulnerability scanning falls under addressable implementation specifications, meaning organizations have flexibility in whether and how they implement it.

However, the proposed 2025 Security Rule updates would change this significantly by requiring vulnerability scanning at least every six months as a mandatory requirement for all covered entities and business associates, regardless of size. Organizations that begin establishing consistent scanning programs now will be better positioned when the final rule takes effect.

Under the current rule, many organizations treat penetration testing as optional. However, the proposed HIPAA Security Rule updates would make annual penetration testing an explicit, mandatory requirement for all covered entities and business associates, to be conducted by qualified personnel with knowledge of generally accepted cybersecurity principles.

A HIPAA risk assessment is a required evaluation of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. The proposed Security Rule updates add more specific requirements, including a written analysis tied to a technology asset inventory, documentation of identified threats and vulnerabilities, and assessment of the risk level for each. VikingCloud’s risk assessment services are structured around these requirements.

A HIPAA gap assessment evaluates how well an organization’s current security safeguards and practices align with HIPAA Security Rule requirements, both existing and proposed. It identifies specific areas of non-compliance or weakness and produces a prioritized action plan for remediation. VikingCloud conducts gap assessments benchmarked against both current Security Rule standards and proposed updates.

HIPAA violations carry civil monetary penalties ranging from $137 to $68,928 per violation (current OCR penalty tiers, adjusted annually for inflation), with an annual cap of $2.067 million per violation category. Willful neglect that is not corrected carries the highest per-violation penalties. In addition to civil penalties, knowing violations of HIPAA can result in criminal charges. A significant data breach can also trigger HHS investigation, mandatory corrective action plans, and reputational damage that far exceeds the direct regulatory cost.

HHS OCR Enforcement — Resolution Agreements and Civil Money Penalties

VikingCloud delivers HIPAA compliance services across the full spectrum of what the Security Rule requires. We provide advisory and assessment services (risk assessment, gap assessment, data privacy mapping, and ongoing advisory) through our Compliance & Risk Services group, and technical security services (vulnerability scanning and penetration testing) through our cybersecurity practice. All workstreams are managed through the Asgard Platform®, giving your team a single hub for compliance documentation, task management, and reporting.