--- title: What HHS OCR Proposed Security Rule AI Provisions Will Cost Healthcare CFOs description: HHS OCR's proposed HIPAA Security Rule update will impact healthcare CFOs, introducing compliance costs for AI systems handling ePHI. Prepare now. image: https://blog.fivenines.com/hubfs/blog/taya-migration/65-hipaa-security-rule-ai-cost-cfo.docx.png --- [Skip to the main content.](https://blog.fivenines.com/what-hhs-ocr-proposed-security-rule-ai-provisions-will-cost-healthcare-cfos#main-content) 1-855-817-5959    [help@fivenines.com](mailto:help@fivenines.com) [![FN\_Reverse\_Logo](https://blog.fivenines.com/hs-fs/hubfs/FN_Reverse_Logo.png?width=3022&height=849&name=FN_Reverse_Logo.png "FN_Reverse_Logo")](https://fivenines.com/) [![FiveNinesPrimaryLogo](https://blog.fivenines.com/hs-fs/hubfs/FiveNinesPrimaryLogo.png?width=3022&height=849&name=FiveNinesPrimaryLogo.png "FiveNinesPrimaryLogo")](https://fivenines.com/) - [Solutions](https://fivenines.com/solutions/) - [Managed IT Services](https://fivenines.com/solutions/managed-it-services/) - [Cybersecurity Services](https://fivenines.com/solutions/cybersecurity/) - [Cloud & Productivity](https://fivenines.com/solutions/cloud-productivity/) - [Projects & Enhancements](https://fivenines.com/solutions/it-projects/) - [Placement Services](https://fivenines.com/solutions/onsite-it/) - Industries - [Finance & Banking](https://fivenines.com/industries/banking/) - [Healthcare](https://fivenines.com/industries/healthcare/) - [Legal](https://fivenines.com/industries/legal/) - [Nonprofit](https://fivenines.com/industries/non-profit/) - [Manufacturing & Logistics](https://fivenines.com/industries/manufacturing-logistics/) - [Small & Mid-Sized Businesses](https://fivenines.com/industries/smb/) - [Insights](https://fivenines.com/resources/) - [Resource Library](https://fivenines.com/resources/) - [Blog](https://blog.fivenines.com) - [About](https://fivenines.com/about/) - [About Five Nines](https://fivenines.com/about/) - [Leadership Team](https://fivenines.com/our-team/) - [Community Impact](https://fivenines.com/community/) - [Partnerships](https://fivenines.com/partnerships/) - [Careers](https://fivenines.com/careers/) - [Company News](https://fivenines.com/news/) Let's Talk Get Support Toggle Menu Toggle Menu Let's Talk Get Support - [Solutions](https://fivenines.com/solutions/) - [Managed IT Services](https://fivenines.com/solutions/managed-it-services/) - [Cybersecurity Services](https://fivenines.com/solutions/cybersecurity/) - [Cloud & Productivity](https://fivenines.com/solutions/cloud-productivity/) - [Projects & Enhancements](https://fivenines.com/solutions/it-projects/) - [Placement Services](https://fivenines.com/solutions/onsite-it/) - Industries - [Finance & Banking](https://fivenines.com/industries/banking/) - [Healthcare](https://fivenines.com/industries/healthcare/) - [Legal](https://fivenines.com/industries/legal/) - [Nonprofit](https://fivenines.com/industries/non-profit/) - [Manufacturing & Logistics](https://fivenines.com/industries/manufacturing-logistics/) - [Small & Mid-Sized Businesses](https://fivenines.com/industries/smb/) - [Insights](https://fivenines.com/resources/) - [Resource Library](https://fivenines.com/resources/) - [Blog](https://blog.fivenines.com) - [About](https://fivenines.com/about/) - [About Five Nines](https://fivenines.com/about/) - [Leadership Team](https://fivenines.com/our-team/) - [Community Impact](https://fivenines.com/community/) - [Partnerships](https://fivenines.com/partnerships/) - [Careers](https://fivenines.com/careers/) - [Company News](https://fivenines.com/news/) # What HHS OCR Proposed Security Rule AI Provisions Will Cost Healthcare CFOs [Five Nines Executive Team](https://blog.fivenines.com/author/five-nines-executive-team) : Nov 12, 2026, 6:00:00 AM 2 min read [Healthcare](https://blog.fivenines.com/topic/healthcare) [Strategic Planning](https://blog.fivenines.com/topic/strategic-planning) [Tech Operations Insights](https://blog.fivenines.com/topic/tech-operations-insights) [AI](https://blog.fivenines.com/topic/ai) ![What HHS OCR Proposed Security Rule AI Provisions Will Cost Healthcare CFOs](https://blog.fivenines.com/hubfs/blog/taya-migration/65-hipaa-security-rule-ai-cost-cfo.docx.png) *TL;DR* - HHS OCR proposed a HIPAA Security Rule update in December 2024 that addresses AI systems handling ePHI more explicitly. The proposed update expands risk analysis requirements, technical safeguards, and audit logging for AI deployments. Final rule publication is expected through 2025-2026. - Compliance cost increment for community hospitals at moderate AI footprint is modest but real: mid five figures annually for the additional documentation, testing, and infrastructure beyond baseline HIPAA Security Rule compliance. - The CFO question is not whether the proposed rule will affect cost. It will. The question is how to plan for the cost increment and when to invest preemptively. ## What the Proposed HIPAA Security Rule Update Means for AI Compliance Costs A community hospital CFO operating HIPAA Security Rule compliance has watched OCR signal AI-specific provisions through 2024 communications. The December 2024 proposed rule made the direction explicit. The CFO needs to plan for the cost increment. What follows is the plain-English version.   ## What the Proposed Update Actually Addresses on AI The proposed update addresses AI in three specific ways. 1. Risk analysis expansion. The annual HIPAA risk analysis (45 CFR 164.308(a)(1)(ii)(A)) must address AI systems handling ePHI. The expansion captures AI-specific threats: model behavior, data flows to and from AI systems, vendor AI relationships. 2. Technical safeguards. The Security Rule's technical safeguards (access control, audit controls, integrity, transmission security) apply to AI infrastructure handling ePHI. The proposed update sharpens documentation expectations. 3. Audit logging. AI access to ePHI is captured in audit logs. Logs are retained, reviewed, and produced on examiner request.   ## The Cost Increment the Proposed Update Produces The cost increment for compliance with the proposed update breaks into the following. - Risk analysis update cost. Annual update of the HIPAA risk analysis to address AI substantively. Increment over baseline: low to mid five figures annually. - Technical safeguard infrastructure. Audit logging for AI access, access control extensions, and integrity controls for AI systems. Increment: low five figures annually plus modest capital. - Documentation discipline. AI-specific elements in the Security Rule documentation. Modest dollar; meaningful time. - Vendor management coordination. Vendor AI BAA review updated for proposed rule provisions. Modest increment. Total annual cost increment over baseline HIPAA Security Rule compliance: mid five figures at community hospital scale.   ## What the CFO Controls in Cost Planning The CFO controls four things in cost planning. The first is the timing. Preemptive investment ahead of final rule publication produces smoother transition than reactive compliance. The second is the scope. The CFO defines which AI systems are in scope for the additional Security Rule treatment. The third is the vendor coordination. AI vendor agreements may need updates to support the proposed rule's expectations. The fourth is the budget integration. The cost increment integrates with broader HIPAA compliance budget, not as a separate line.   ## Three Things to Work Through Before the Final Rule Takes Effect A community hospital CFO should work through three things on proposed rule planning. The first is a current-state assessment of HIPAA Security Rule compliance against the proposed update. The second is a phased investment plan to address gaps before final rule effective date. The third is vendor coordination on BAA updates.   ## Plan for the Proposed Rule's AI Provisions Before the Final Rule Sets the Deadline A community hospital CFO planning for the HIPAA Security Rule AI update is planning modest cost increment that produces material compliance posture improvement. If your hospital has not assessed Security Rule readiness against the proposed update in the last twelve months, that is the conversation worth having with your Tech-Operations partner before the final rule's effective date. Five Nines Technology Group is a Tech-Operations partner for community hospitals, clinics, and health systems. Translating regulatory frameworks into operating discipline at community hospital scale is where our team focuses. ## Frequently asked questions When does the proposed rule take effect? Final rule publication is expected through 2025-2026 with phased compliance dates following. Should the hospital wait for the final rule? Preemptive investment is generally preferable. Many proposed provisions reflect existing OCR expectations. Can the hospital phase the investment? Yes. The proposed compliance dates allow phased implementation. How does this interact with Section 1557? Both apply to AI in healthcare. Section 1557 addresses nondiscrimination; HIPAA addresses ePHI protection. Concurrent compliance is required. What is the most common HIPAA Security Rule AI gap? Audit logging for AI access to ePHI. Hospitals operate AI without comprehensive audit log coverage. ## Related Blog Posts ## Let's get in touch   [**(402) 817-2630**](tel:402-817-2630) [help@fivenines.com](mailto:help@fivenines.com) [Lincoln, NE](https://fivenines.com/contact/lincoln) [Omaha, NE](https://fivenines.com/contact/omaha) [Kearney, NE](https://fivenines.com/contact/kearney) [Central City, NE](https://fivenines.com/contact/central-city) [St. Louis, MO](https://fivenines.com/st-louis) ![cyberverify-1](https://blog.fivenines.com/hs-fs/hubfs/cyberverify-1.png?width=110&height=110&name=cyberverify-1.png)![aicpa](https://blog.fivenines.com/hs-fs/hubfs/aicpa.png?width=110&height=110&name=aicpa.png) ### Are we a good fit? [![Schedule Consultation](https://no-cache.hubspot.com/cta/default/1857420/interactive-196258273705.png)](https://blog.fivenines.com/hs/cta/wi/redirect?encryptedPayload=AVxigLK%2BaOH7DijXHWgk%2Fwk6LC7oZRVH9eO%2BuPy6kOkQgYVuZ0ctvpy%2BMpw1JqVkn3S%2F%2Fxo2PntIdA4k7KGIjjb4jY0AxSpszWKF4q%2FydIs0cBvjkn7XfEc5Rz3vRfE4aDnw8R68Dw66zgv7S26P78cGKvTerBero1FvWq4wEz%2Fji8BjdmnCTRAiEe%2B2iTKxd2dwU1jHpA%3D%3D&webInteractiveContentId=196258273705&portalId=1857420)   - [Privacy Policy](https://fivenines.com/privacy-policy/) - [HTML Sitemap](https://fivenines.com/html-sitemap/) © 2026 Five Nines Technology Group | 5617 Thompson Creek Blvd Lincoln, NE 68516 [Facebook](https://www.facebook.com/gonines)[Linkedin](https://www.linkedin.com/company/five-nines-technology-group/) [Blog](https://blog.gonines.com/?__hstc=143714730.45718742b0726c421d8592d7ea71f58b.1757514685996.1758029308186.1758134756251.4&__hssc=143714730.31.1758134756251&__hsfp=1745665186)   [Client Support](https://fivenines.com/client-login/) Return to top ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Final rule publication is expected through 2025-2026 with phased compliance dates following." }, "name" : "When does the proposed rule take effect?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Preemptive investment is generally preferable. Many proposed provisions reflect existing OCR expectations." }, "name" : "Should the hospital wait for the final rule?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. The proposed compliance dates allow phased implementation." }, "name" : "Can the hospital phase the investment?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Both apply to AI in healthcare. Section 1557 addresses nondiscrimination; HIPAA addresses ePHI protection. Concurrent compliance is required." }, "name" : "How does this interact with Section 1557?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Audit logging for AI access to ePHI. Hospitals operate AI without comprehensive audit log coverage." }, "name" : "What is the most common HIPAA Security Rule AI gap?" } ] } ```