Original Security Rule (2003): Administrative, physical, and technical safeguards - HITECH Act (2009): Breach notification requirements, increased penalties - Omnibus Rule (2013): Business associate liability, enhanced enforcement - 2023 NPRM: Proposed updates including specific security testing req