2026 HIPAA Security Rule Updates: What Covered Entities Need to Know

Healthcare organizations entered 2026 expecting the most significant Health Insurance Portability and Accountability Act (HIPAA) Security Rule updates in two decades. Instead, the year brought further delay.

The new rule, once targeted for May 2026, has slipped to at least July 2027, leaving covered entities and business associates to plan around a proposal that is likely, but not certain, to become law.

Amid the confusion compliance officers want to know what is the HIPAA Security Rule and what, if anything, changed in 2026? Looking ahead, they also want to know what to expect when a modernized Security Rule is implemented and, given what we know, what would a HIPAA Security Rule compliance checklist look like for today and tomorrow.

Why HHS Wants to Modernize the Security Rule

The HIPAA Security Rule was first published in 2003 and last substantively updated in 2013, long before cloud computing, mobile access, and industrialized ransomware reshaped the healthcare IT threat landscape.

As the International Association of Privacy Professional’s (IAPP) coverage of the proposal observed, the rule is widely viewed as outdated, and its treatment of encryption as “addressable” means some organizations have decided to treat a basic but vital control as optional—to their peril.

The threat data explains the urgency. In proposing the update, the U.S. Department of Health and Human Services (HHS) reported that large breaches rose 102% and the number of individuals affected rose more than 1,000% between 2018 and 2023, driven largely by hacking and ransomware. The 2024 Change Healthcare attack alone affected roughly 190 million people.

Attacks did not ease in 2025. Breaches reported to the Office for Civil Rights (OCR) that year affected more than 35 million individuals, with most attributed to hacking or IT incidents, including incidents at Yale New Haven Health, Episource, and Blue Shield of California. As of the most recent reporting in 2026 the OCR had reported 19 million individuals affected by June, putting the year on pace for 38 million.

What Is the HIPAA Security Rule? Current Requirements

The HIPAA Privacy Rule governs who may use and disclose protected health information (PHI). The Security Rule, by contrast, governs how electronic PHI (ePHI) must be protected. It applies to covered entities and their business associates. (For a deeper comparison, see our guide to the HIPAA Privacy Rule vs. Security Rule.)

Organizations must ensure the confidentiality, integrity, and availability of ePHI through three categories of safeguards:

1. Administrative Safeguards: Form the foundation of the program and include:
   • An accurate, thorough risk analysis and an ongoing risk management plan
   • A designated security official
   • Workforce security, access management, and security awareness training
   • Security incident procedures and contingency planning, including data backup and disaster recovery
   • Periodic evaluations and business associate agreements
2. Physical Safeguards: Protect facilities and hardware through facility access controls; workstation use and security policies; and device and media controls for disposal, reuse, and backup.
3. Technical Safeguards: Protect ePHI within systems through access controls such as unique user IDs, emergency access, and automatic logoff, along with audit controls, integrity controls, person or entity authentication, and transmission security.

Today, many implementation specifications, including encryption, are “addressable.” That does not make them optional, yet many organizations have chosen to use that term as a loophole to avoid incurring costs associated with security controls. However, organizations are still responsible for implementing controls such as authentication, encryption, and access control, or document why an equivalent alternative is reasonable and appropriate.

What Actually Changed in 2026

HHS published its notice of proposed rulemaking (NPRM) on January 6, 2025, and closed comments on March 7, 2025. The regulatory agenda then set a May 2026 target for the final rule. That date passed without action, and the agenda now lists final action for July 2027.

HHS has not said whether it will finalize the rule as proposed, revise it, or withdraw it, though industry pushback over cost has been significant.

Other HIPAA developments did land in 2026. Full compliance with the rule aligning 42 CFR Part 2 substance use disorder records with HIPAA was due February 16, 2026. A final Privacy Rule update is expected before year-end. On October 1, 2026, the Senate unanimously passed the Health Care Cybersecurity and Resiliency Act, which now moves to the House. So while the Security Rule itself did not change in 2026, expectations and questions persist.

What the Modernized Rule Is Expected to Require

If finalized as proposed, the rule would add specific, prescriptive requirements, including:

• Eliminating “Addressable” Specifications: Making nearly all controls mandatory, with limited exceptions.
• Encryption of ePHI: Requiring patient health data be encrypted at rest and in transit.
• Multi-Factor Authentication (MFA): Making MFA mandatory for access to ePHI.
• Technology Asset Inventory and Network Map: Requiring annual documentation of health tech assets and review of ePHI flows.
• Written Restoration Procedures: To ensure recovery of critical systems and data within 72 hours
• Vulnerability Scanning and Penetration Testing: Required every six months 12 months, respectively.
• Annual Compliance Audits: Ensuring security controls and programs are current and effective.
• Stronger Business Associate Oversight: Including annual written verification of safeguards to better protect information supply chains.

HHS estimated first-year compliance costs at roughly $9 billion across the industry, a key reason many commenters asked for changes or longer implementation periods. Most requirements would apply 180 days after the final rule takes effect.

Enforcement Priorities: Risk Analysis and Ransomware

While rulemaking stalled, enforcement did not. OCR launched its Risk Analysis Initiative in late 2024 to target the most commonly cited Security Rule failure: an inaccurate or incomplete risk analysis.

In June 2026, OCR announced a $450,000 settlement with the Spencer Gifts employee health plans, its 20th ransomware enforcement action and 14th Risk Analysis Initiative action.

The lesson is that health plans, small practices, and business associates are not exempt, and that a documented, current, organization-wide risk analysis is the single most important control you can show a regulator.

HIPAA Security Rule Compliance Checklist

Given what the HIPAA Security Rule currently requires, and what is expected in the coming year, you can use a simple HIPAA Security Rule compliance checklist to evaluate readiness for today, and to prepare for its modernization tomorrow. Smart organizations recognize that threat actors continue to target healthcare organizations, and that acting now can strengthen security and reduce the risk of a data breach.

Current requirements

• Complete an accurate, enterprise-wide risk analysis within the past 12 months, covering every system that touches ePHI.
• Maintain a risk management plan with owners and deadlines for each identified risk.
• Designate a security official and documented security policies and procedures.
• Deliver security awareness training, including phishing, to the full workforce.
• Implement access controls, unique user IDs, automatic logoff, and audit logging.
• Document decisions for each addressable specification.
• Test contingency, backup, and incident response plans.
• Execute business associate agreements with every vendor handling ePHI.

Proposed rule readiness

• Encrypt ePHI at rest and in transit.
• Enforce MFA for all ePHI access.
• Build a technology asset inventory and network map of ePHI flows.
• Create a written plan for restoration of critical systems within 72 hours.
• Schedule semiannual vulnerability scans and annual penetration tests.
• Plan an annual compliance audit and written verification from business associates.

Build a Proven HIPAA Compliance Strategy With IS Partners

Whether the final rule arrives in 2027 or later, regulators already expect strong risk analysis, ransomware resilience, and business associate oversight.

IS Partners has more than 20 years of experience helping covered entities and business associates navigate complex HIPAA requirements, with certified, U.S.-based auditors delivering risk assessments, compliance audits, business associate reviews, and ongoing program support.

Need expert support building a HIPAA compliance strategy that holds up today and tomorrow? Schedule a free 30-minute consultation with an IS Partners compliance expert.