Published Nov 10, 2026

Is the HIPAA Security Rule update final? Where it stands, and what to do now

No. The HIPAA Security Rule update is still a proposal, now projected for July 2027. What it would change, and what outpatient practices should do now.

Dale Calvin

Founder & CEO

The short answer: No. The update to the HIPAA Security Rule that HHS proposed in January 2025 is still a proposal. The federal regulatory agenda now projects a final rule for July 2027, and until then the current Security Rule remains the law. Most of what the update would require is already expected today, through the risk analysis, so there's no reason to wait.

If you've read that the new HIPAA Security Rule takes effect in 2026, you're not alone. Several vendor pages still say so, including one of the top results for "does HIPAA require MFA." This guide covers where the rule actually stands as of November 2026, what it would change, and what a surgery center, office‑based lab or specialty practice should do now.

Where the rule stands

Proposed: HHS published the proposed rule on January 6, 2025. Comments closed March 7, 2025, with thousands filed.
Delayed: the Spring 2025 regulatory agenda targeted a final rule for May 2026. The current (2026) agenda moved it to "Long‑Term Actions," with final action projected for July 2027.
Not withdrawn: the American Hospital Association, MGMA and CHIME have asked HHS to withdraw or rework it, and law firms disagree on whether it will be finalized as written, revised or delayed further. As of November 2026, HHS hasn't announced any of these.
Still in force: HHS's own fact sheet says it plainly: "the current Security Rule remains in effect."

What the update would change

The proposal doesn't invent new security ideas. It takes practices that are already expected and makes them explicit, written and timed.

Control	Today	Under the proposed rule
"Addressable" specifications	Flexible, but not optional: you must document why and adopt an alternative	Almost all become required
Asset inventory and network map	Expected as part of a thorough risk analysis	Written, and updated at least every 12 months
Multi‑factor authentication	Required where your risk analysis shows it's needed, such as remote access	Required, with limited exceptions
Encryption at rest and in transit	Required wherever reasonable and appropriate; skipping it must be documented	Required, with limited exceptions
Vulnerability scanning	Part of managing risk; no set frequency	At least every 6 months
Penetration testing	Not named in the rule	At least every 12 months
Patching	Part of managing risk; no set deadline	Critical risks within 15 days, high risks within 30
Backup and recovery	Data backup and disaster recovery plans required	Restore critical systems within 72 hours
Access changes	Terminate access when staff leave	Notify within 24 hours when access changes or ends
Compliance audit	Periodic evaluation required	At least every 12 months
Vendors (business associates)	Business associate agreement required	Annual written verification of each vendor's safeguards

If the rule is finalized as proposed, most organizations would have 180 days after it takes effect to comply, and existing business associate agreements would get a longer transition.

What this isn't: other HIPAA changes with 2026 dates

Part of the confusion comes from separate HIPAA rules that do have 2026 dates:

Notice of Privacy Practices. Since February 16, 2026, covered entities' privacy notices have had to include information about substance use disorder records under the updated Part 2 rule. HHS publishes model notices.
Reproductive health privacy rule. A federal court in Texas vacated the 2024 reproductive health privacy rule nationwide in June 2025. The privacy notice changes for substance use disorder records stayed in place.
Privacy Rule proposals. HHS has other Privacy Rule changes on its agenda. None of them is the Security Rule update.

What OCR enforces today: the risk analysis

The requirement OCR enforces most often isn't new at all. Since late 2024, HHS's Office for Civil Rights has run a Risk Analysis Initiative, a series of enforcement actions against organizations that never did an accurate and thorough risk analysis. HHS counted 13 by April 2026, and settlements announced since then cite the same failure.

Outpatient organizations are part of it:

Syracuse ASC, a single‑site surgery center, settled for $250,000 in July 2025 after a ransomware attack affected about 25,000 people. OCR found it "never conducted an accurate and thorough risk analysis."
Lehigh Valley Health Network settled in October 2026 after ransomware entered through a physician group it had acquired. For MSOs and groups growing by acquisition, the lesson is direct: an acquired practice belongs in your risk analysis from day one.
A women's health group and an imaging provider are among the other recent settlements that cite the same failure.

The risk analysis is the foundation for almost everything in the table above. HHS's guidance says it must cover all electronic patient data the organization creates, receives, maintains or transmits, wherever it lives, and identify threats, vulnerabilities, current controls, likelihood, impact and the resulting risk level. The rule doesn't set a frequency, but HHS expects it to be reviewed regularly and updated after changes such as a security incident, a change in ownership, staff turnover or new technology.

What to do now: a 90‑day plan

Each step below is either expected under the current rule or would become an explicit requirement under the proposed one. Doing them now means you're covered either way.

Days 1–30: know what you have

Build an asset inventory and network map. Every device, system and cloud service that touches patient data, and how data moves between them. Include imaging equipment, scanners and anything an acquired practice brought with it.
Update your risk analysis using that inventory, and write the risk management plan that follows from it. Smaller organizations can use the free Security Risk Assessment Tool from HHS and ASTP.
Turn on multi‑factor authentication for email, remote access, the EHR and practice management system, and every administrator account.

Days 31–60: close the common gaps

Encrypt data at rest and in transit, including laptops, backups and email that carries patient information. Document any exception and what you do instead.
Test a restore. Pick a critical system, restore it from backup and time it against the proposed 72‑hour target. A backup you haven't restored isn't a recovery plan.
Set patching and scanning on a schedule: critical fixes within 15 days, high within 30, vulnerability scans at least every 6 months, and a penetration test once a year.

Days 61–90: people and vendors

Remove access within 24 hours when someone leaves or changes roles, and review who has administrator rights.
Ask each vendor that handles patient data for a written description of its safeguards, and add annual verification to business associate agreements as they renew.
Run a compliance review of your policies against what you actually do, and put the next one on the calendar for 12 months out.
Confirm your Notice of Privacy Practices includes the substance use disorder language required since February 2026.

Frequently asked questions

Is the HIPAA Security Rule update final?

No. As of November 2026 it is still a proposed rule, with a final rule projected for July 2027 in the federal regulatory agenda. The current Security Rule remains in effect.

What are the HIPAA Security Rule changes for 2026?

There are none in force. The proposed Security Rule changes were once targeted for May 2026, but that date has moved to July 2027. The HIPAA change with a 2026 date is the Notice of Privacy Practices update for substance use disorder records, effective February 16, 2026.

Does HIPAA require multi‑factor authentication?

Not by name under the current rule. HHS says the risk analysis determines the authentication you need, and that multi‑factor authentication "might be needed" for remote access and access to sensitive systems. The proposed rule would require it, with limited exceptions.

Does HIPAA require encryption at rest?

Under the current rule, encryption is "addressable," which HHS says "is not optional." You must encrypt wherever it's reasonable and appropriate, and document an alternative if it isn't. HHS describes not encrypting as an unusual exception. The proposed rule would require encryption at rest and in transit, with limited exceptions.

Does HIPAA require penetration testing?

Not under the current rule, though finding and fixing vulnerabilities is part of managing risk. The proposed rule would require a penetration test at least every 12 months and vulnerability scans at least every 6 months.

How often do you need a HIPAA risk analysis?

The rule doesn't set a frequency. HHS guidance says organizations may do it annually or as needed, and expects an update after events such as a security incident, a change in ownership, staff turnover or new technology. The proposed rule would require a review at least every 12 months.

What happens if OCR finds no risk analysis?

It's the most common finding in recent enforcement. Settlements under OCR's Risk Analysis Initiative have included payments and two‑ to three‑year corrective action plans that require a new risk analysis, a risk management plan, updated policies and training.

This article explains how the rule affects IT and operations. It isn't legal advice. If you'd like help with an asset inventory, a risk analysis or any of the steps above, tell us about your setup.

Sources