26 years of change. The rule you are under did not move.

Last week we put our son in the car for Baylor. The week before that, we marked 26 years.

People asked us about empty nests. We do not like that phrase. It is a new season. Same house. Same company. Same work.

Those two episodes were personal on purpose. This one is what those 26 years looked like from the compliance chair.

The landscape moved. The current rule did not.

In 2003 the HIPAA Security Rule gave the industry its first real baseline for ePHI. In 2013 the Omnibus Rule put business associates on the hook and made the BAA a requirement, not a courtesy. Then ransomware became a business model. Then AI walked into the same networks. Then, on January 6, 2025, HHS proposed the first serious rewrite of the Security Rule since 2013.

That proposal is still a proposal. HHS moved the final-action target from May 2026 to July 2027 and parked RIN 0945-AA22 on the long-term list. That is a planning date. It is not a statute. It can move again.

The current Security Rule did not get a year off. Neither did OCR. Neither did the people who already want to see your proof.

What 26 years actually taught us

The names on the rules changed. The questions did not.

You still need a current inventory of every system and vendor that touches ePHI.

You still need MFA on the platforms that hold that data, not just a policy that says you will.

You still need a backup and incident-response plan you have tested, with the date written down.

You still need signed BAAs and a last-reviewed date on each vendor.

Those are the same items auditors already ask for. The proposed rule would only make the questions louder.

You also cannot sit a compliance officer behind every employee. Policies and training are not enough. You can write the speed limit on a sign. That does not mean anyone follows it. You need people who already have the hat on when they make the hundred small decisions that never reach your desk.

Last week we called that the grocery cart test. Are you going to put it back, or leave it on the curb because you think that is someone else's job? That is one of our interview questions. Make good decisions when nobody is watching.

Name the lanes. Then stop hovering.

Twenty-six years at home taught us the same thing Traction did. Dawn is the integrator. Rob is the visionary. Once we said that out loud, the business got clearer.

Fall is when companies try to hover. One person on every Slack thread. One person who just knows where the evidence is. That is not a program. That is a bottleneck.

Leadership is not making every decision. It is getting people to the top of the mountain who already know the next right one. Hire the right people and you can give them guardrails instead of a binder. Blame the process first. If it keeps happening, then it is a people conversation.

We prepared our son for the road. We did not try to prepare the road for him. Your fall program needs the same move.

What we want you to do this week

If your program still depends on one person hovering over every decision, you do not have a fall plan.

Pick one:

1. Name the owner of the thing that always comes back to you.

2. Set one weekly check-in, then stop living in the inbox.

3. Ask your team, What's your solution? and wait.

If you want a second set of eyes on which of those is your real gap, book 30 minutes with us. No deck. A punch list you can use this quarter.

Listen to the two podcast episodes that started this!

Here's to the next season.
Rob and Dawn