Short answer: the HIPAA Security Rule does not name a patching deadline. It requires an accurate risk analysis, risk management that reduces risks to a reasonable and appropriate level, periodic evaluation and audit controls. For hospital servers, a documented and evidenced patch process is one of the clearest ways to meet those duties. That includes isolated clinical systems.
Security Rule safeguards that relate to patching
The HHS summary of the Security Rule describes several requirements that a patch program supports. In plain terms:
| Safeguard | What HHS describes | How patching supports it |
|---|---|---|
| Security management process | Assess risks and vulnerabilities to ePHI, then reduce them to a reasonable and appropriate level | Missing patches are known vulnerabilities; patching reduces them |
| Evaluation | Periodic technical and non-technical assessment of how well policies meet the rule | Compliance reports show whether the patch policy works in practice |
| Audit controls | Mechanisms to record and examine activity in systems that contain or use ePHI | Records of what was installed where, and when |
| Integrity | Policies and procedures so ePHI is not improperly altered or destroyed | Closing flaws that attackers use to tamper with data |
HHS also says regulated entities must regularly reevaluate potential risks to ePHI. Some implementation specifications are “addressable,” but HHS is clear that addressable does not mean optional. You must decide whether each one is reasonable and appropriate, and document the decision.
In practice, patching connects these safeguards. Your risk analysis names the vulnerabilities. Your patch process reduces them. Your records show that the process ran, and your evaluation checks whether it worked.
A proposed update to watch
On December 27, 2024, the HHS Office for Civil Rights issued a Notice of Proposed Rulemaking to strengthen the Security Rule. The HHS fact sheet lists proposals including:
- A technology asset inventory and network map, reviewed at least every 12 months.
- A more specific written risk analysis, including identified vulnerabilities.
- Vulnerability scanning at least every six months and penetration testing at least every 12 months.
- Specific compliance time periods for many existing requirements.
These are proposals, not final rules. Check HHS for the current status before you change policy.
Why hospital servers are hard to patch
- Uptime. EHR, imaging and lab systems support patient care around the clock.
- Vendor constraints. Clinical application vendors may certify only specific OS patch levels.
- Mixed estates. Windows Server, Linux and sometimes AIX run side by side.
- Isolated networks. Clinical systems are often segmented or fully air-gapped.
Air-gapped clinical systems still need a cadence
Isolation reduces exposure, but it does not remove the duty to manage risk. Manual transfers by USB drive are slow and hard to verify. They also leave little audit trail.
A better pattern is to bring verified updates to the servers, not the servers to the internet. Collect updates on the connected side and verify each one. Move them through one controlled path, then deploy in approved windows. Record every step as it happens.
How JetPatch supports HIPAA patching for servers
JetPatch is installed software that runs in your own data center or private cloud. It does not send telemetry outside your network, so patch data stays with you.
- Know your vulnerabilities. The Patches Catalog shows missing updates across servers, filtered by severity and CVE. Qualys, Tenable and Rapid7 findings can drive priorities.
- Protect uptime. Maintenance windows, Predictive Patching and staged rollouts reduce surprises on clinical systems.
- Respect vendor limits. Patch Compliance Rules block specific patches on specific servers, such as kernel updates on a certified system.
- Roll back safely. Rollback is supported for Linux and Unix patches that JetPatch installs.
- Prove it. Compliance reports export to CSV and PDF, including for HIPAA audits.
For Windows Server, JetPatch works with your existing WSUS or replaces it with the JetPatch repository. For air-gapped clinical servers, Offline Windows Patching delivers digital-fingerprint verified updates with zero new internet exposure. It records the approval trail, installation record and post-install verification.
Linux and Windows servers in isolated segments are covered by the same architecture. See air-gapped patch management and Linux patch management.
A practical patch policy for hospital servers
HHS leaves timeframes to your risk analysis. A clear written policy makes your choices easy to defend. Consider including:
- Scope. Every server that stores or processes ePHI, including isolated clinical systems.
- Risk tiers. Shorter timeframes for internet-facing and high-risk servers, longer for low-risk ones.
- Testing. A test group that receives patches before production clinical systems.
- Maintenance windows. Agreed windows with clinical leaders for each system.
- Exceptions. A documented process when a vendor has not certified a patch, with compensating controls.
- Evidence. Reports kept for each cycle, ready for internal audit and OCR inquiries.
Review the policy as part of your periodic evaluation. Update it when your systems or risks change.
Frequently asked questions
Does HIPAA require patching within a set number of days?
The current Security Rule, as HHS summarizes it, does not set a patch deadline. It requires risk analysis and risk management. Your own policy should define timeframes based on risk.
Are air-gapped servers exempt from HIPAA safeguards?
No. If a system creates, receives, maintains or transmits ePHI, the Security Rule applies. Isolation is a control you can document in your risk analysis, not an exemption.
What should a HIPAA patch report show?
It should show which servers were missing which updates, who approved the change, what was installed and when, and how exceptions were handled.
Is the proposed Security Rule update final?
HHS published it as a proposed rule in December 2024. Check the HHS website for its current status.
Want audit-ready patching for clinical servers, including isolated ones? Request an evaluation and test JetPatch in your own environment.
