HIPAA patch management: are patching deadlines coming?

HIPAA does not set a patching deadline today, but HHS has proposed a patch management standard, six-month vulnerability scans and annual penetration tests. Here is what business associates can put in place before a final rule.

Sean Crowley

President & Co-Founder

October 30, 2026 · 5 min read

Key takeaways

The current HIPAA Security Rule sets no fixed patching deadline; the obligation sits in risk management under 45 CFR 164.308(a)(1)(ii)(B).
HHS's proposed rule, published January 6, 2025, lists a new patch management standard at proposed section 164.308(a)(4).
The proposal would require vulnerability scanning at least every six months and penetration testing at least once every 12 months.
The federal regulatory agenda targets final action for July 2027, with compliance proposed 180 days after a final rule's effective date.
CIS Safeguards 7.3 and 7.4 set a monthly or faster automated patching cadence that a firm can adopt now.

A law firm defending a hospital, an accounting firm closing a medical group's books and a nonprofit running a health program all patch the same laptops and servers as any other office. When those systems hold electronic protected health information (ePHI), the Office for Civil Rights (OCR) can ask how quickly known flaws were fixed. Today the HIPAA Security Rule leaves that speed to the firm. HHS's proposed update would add a HIPAA patch management standard of its own and narrow that discretion.

Does HIPAA require patches within a set number of days today?

No. The current Security Rule does not name a patching deadline. The obligation sits inside risk management: 45 CFR 164.308(a)(1)(ii)(B) requires security measures "sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level." An unpatched system with a publicly known flaw is exactly the kind of vulnerability a risk analysis should find and a risk management plan should address.

The rule's flexibility is deliberate. Section 164.306(b)(2) tells a covered entity or business associate to weigh its size and capabilities, its technical infrastructure, the cost of security measures and "the probability and criticality of potential risks" when choosing safeguards. Section 164.308(a)(5)(ii)(B) adds an addressable specification for procedures to guard against, detect and report malicious software. Addressable means the firm must assess the specification and either implement it or document a reasonable alternative. The result is no day count in the rule, and an expectation that the firm can explain the timeline it chose.

What would the proposed HIPAA rule change about patch management?

It would make patching a standard of its own and put fixed intervals around vulnerability testing. HHS published the proposed rule in the Federal Register on January 6, 2025 (90 FR 898). Its table of contents lists a new "Standard: Patch management" at proposed section 164.308(a)(4), among the administrative safeguards. The HHS fact sheet summarizes related changes that would set the pace of vulnerability work. The proposal would:

Require vulnerability scanning at least every six months.
Require penetration testing at least once every 12 months.
Remove the distinction between required and addressable implementation specifications, with limited exceptions, so most safeguards would stop being a documented judgment call.
Require a compliance audit at least once every 12 months.

The fact sheet does not summarize the patch management standard itself. A firm planning around it should read the proposed regulatory text and expect the final version to differ, since HHS received public comments through March 7, 2025 and can revise any detail.

When would stricter patching expectations take effect?

Not before a final rule, and that date is a target. The federal regulatory agenda entry for RIN 0945-AA22 lists the rulemaking among long-term actions, with final action targeted for July 2027. HHS proposed that a final rule take effect 60 days after publication, with compliance due 180 days after that. On that schedule a firm would have about eight months from publication to meet the new standard. Until then, HHS states that the current Security Rule remains in effect. For the full status, see where the HIPAA Security Rule update stands.

What patching timeline can a firm defend now?

One the firm chose on purpose, wrote down and can show it met. NIST treats patching as preventive maintenance: SP 800-40 Rev. 4 defines enterprise patch management as identifying, prioritizing, acquiring, installing and verifying patches, updates and upgrades across the organization. CIS Control 7 offers a concrete cadence a small firm can adopt without inventing one:

Safeguard 7.1: a documented vulnerability management process, reviewed annually or after significant changes.
Safeguard 7.2: a risk-based remediation process with monthly, or more frequent, reviews.
Safeguards 7.3 and 7.4: automated operating system and application patching on a monthly, or more frequent, basis.

All four sit in CIS Implementation Group 1, the baseline CIS says every enterprise should start with. A written policy built on them, with faster handling for internet-facing systems and for flaws already being exploited, gives a firm a timeline it can explain to OCR or a covered entity client today. When the final rule arrives, the firm adjusts the numbers in a policy that already exists.

What evidence will a covered entity client or OCR ask to see?

Proof that patches went in on the schedule your policy promised, plus a record of the exceptions. The current rule already supports this. Section 164.316(b) requires Security Rule documentation to be kept for six years, and section 164.308(a)(8) requires periodic evaluation, including in response to environmental or operational changes. Useful records include:

Monthly patch compliance reports for workstations, servers and network devices.
Vulnerability scan results with the date each finding was closed.
An exception log for systems that cannot be patched on schedule, with the compensating control and the person who approved it.
The risk analysis entry that explains why your timeframes are reasonable.

OCR has made the risk analysis the center of its enforcement. In February 2026 it announced the 11th enforcement action under its Risk Analysis Initiative. A patching record that matches the risk analysis is one of the simplest ways to show the analysis drives real decisions. Read more on why OCR keeps enforcing the HIPAA risk analysis.

What should a business associate do this quarter?

Set the timeline, automate it and start keeping proof. Five steps put a firm on solid ground under the current rule and ready for the proposal:

Write a patch policy with risk-based timeframes and an exception process, and reference it in your risk management plan.
Turn on automated operating system and application updates for every device that touches ePHI, including remote laptops.
Schedule external and internal vulnerability scans, with a six-month cycle as the floor.
List the systems you cannot patch on schedule, such as legacy practice software, and document the compensating control for each.
Review your business associate agreements for patching or security reporting terms your covered entity clients already require.

This article summarizes the current HIPAA Security Rule and HHS's published proposal. It is not legal advice, and whether your firm is a business associate depends on your client relationships and agreements.

How does s90 help?

s90 runs automated patching, vulnerability scanning and exception tracking for firms that handle PHI for clients, and keeps the monthly records a risk analysis depends on. If you would like a second look at your patching timeline before the final rule arrives, we are happy to talk.

Applies to

Compliance

HIPAA CIS Controls NIST CSF 2.0

Regulation reference

45 CFR 164.308(a)(1)(ii)(A) and (B)
Covered entities and business associates must conduct an accurate and thorough assessment of the potential risks and vulnerabilities to ePHI, and implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.
www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C
45 CFR 164.306(b)(2) and 164.308(a)(5)(ii)(B)
Section 164.306(b)(2) requires a covered entity or business associate choosing security measures to consider its size, complexity and capabilities, its technical infrastructure, hardware and software security capabilities, the costs of security measures, and the probability and criticality of potential risks to ePHI. Section 164.308(a)(5)(ii)(B) is an addressable specification calling for procedures for guarding against, detecting and reporting malicious software. Neither sets a fixed patching deadline.
www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C
45 CFR 164.306(d)(3) and 164.312(a)(2)(iv)
For an addressable specification such as encryption and decryption, the entity must assess whether it is reasonable and appropriate in its environment, then implement it or document why it is not and implement an equivalent alternative measure if reasonable and appropriate.
www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C
90 FR 898 (January 6, 2025), RIN 0945-AA22
Proposed rule (not final) that would remove the required/addressable distinction, require an asset inventory and network map, encryption, MFA, 72-hour restoration procedures, annual compliance audits, vulnerability scanning every six months, annual penetration testing, annual business associate verification, and 24-hour notice of contingency plan activation by business associates.
www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information
HHS OCR, HIPAA Security Rule Notice of Proposed Rulemaking fact sheet (December 27, 2024)
Summarizes the proposed changes, including a written technology asset inventory and a network map of ePHI movement updated at least every 12 months and after relevant changes, risk analyses that review the inventory and map, vulnerability scanning at least every six months, penetration testing at least every 12 months, and annual compliance audits. These are proposals, not current requirements.
www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet/index.html
Unified Agenda of Federal Regulatory and Deregulatory Actions, RIN 0945-AA22
Lists the NPRM at 90 FR 898 (January 6, 2025) and final action for July 2027, in the Long-Term Actions stage. Agenda dates are targets, not deadlines.
www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0945-AA22
NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology (April 2022)
Guidance, not a regulation. Defines enterprise patch management as identifying, prioritizing, acquiring, installing and verifying patches, updates and upgrades throughout an organization, frames patching as preventive maintenance and a cost of doing business, and recommends an enterprise strategy to simplify and operationalize patching.
csrc.nist.gov/pubs/sp/800/40/r4/final
CIS Critical Security Controls v8.1, Control 7 (Safeguards 7.1 to 7.7)
Safeguards 7.1 to 7.4 (IG1, IG2, IG3) require a documented vulnerability management process reviewed annually or after significant changes, a risk-based remediation process with monthly or more frequent reviews, and automated operating system and application patching on a monthly or more frequent basis. Safeguards 7.5 to 7.7 (IG2, IG3) add quarterly authenticated and unauthenticated internal scans, monthly external scans, and monthly remediation of detected vulnerabilities.
cas.docs.cisecurity.org/en/latest/source/Controls7/
CIS Critical Security Controls v8.1, Implementation Group 1 (IG1)
Defines IG1 as a foundational set of 56 safeguards (essential cyber hygiene) for enterprises with limited IT and security expertise. CIS states that IG1 represents a minimum standard of information security and that every enterprise should begin with IG1.
www.cisecurity.org/controls/implementation-groups/ig1
45 CFR 164.316(b)
Security Rule policies, procedures and required records must be in writing, retained for 6 years from the date of creation or the date last in effect, whichever is later, and reviewed periodically and updated in response to environmental or operational changes.
www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C
45 CFR 164.308(a)(8)
Requires a periodic technical and nontechnical evaluation, based initially on the Security Rule standards and later in response to environmental or operational changes affecting the security of ePHI, that establishes how well the entity's security policies and procedures meet the rule.
www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C
HHS OCR press release, OCR Settles HIPAA Security Rule Investigation (February 19, 2026)
OCR announced a $103,000 settlement with a treatment center that failed to conduct an accurate and thorough risk analysis, described as the 11th enforcement action under OCR's Risk Analysis Initiative.
www.hhs.gov/press-room/ocr-settles-hipaa-security-rule-investigation-twrtc.html

Related insights

All insights

Six identical closed Dell laptops stacked neatly on a pale wood table.

CIS Controls

How to Write an AI Acceptable Use Policy Your Tools Can Enforce

An AI acceptable use policy that nothing enforces documents a control that does not exist. Here is how to write each rule against a CIS safeguard you can configure, so the policy produces its own evidence.

October 30, 20266 min read

A staff member works at a computer behind the reception counter of a small community services office.

Non-ProfitCIS Controls

How to Use AI for Donor Communications Without Breaking Privacy Promises

Your privacy policy and donation pages already promise donors how their data is handled. Here is how to use AI for donor letters and appeals without sending donor records somewhere those promises do not cover.

October 30, 20265 min read

A person in a work jacket leans over printed drawings at a plan table in a job site trailer, a building under construction outside.

AECCIS Controls

How to Use AI Proposal Writing Without Leaking Pricing or Past Bids

AI proposal writing saves AEC teams real time, and pricing and past bids are the files a firm can least afford to lose. Here is how to separate narrative from numbers, pick an approved tool and enforce the rule with controls.