Short answer: no. As of October 2026, the HIPAA Security Rule updates HHS proposed in January 2025 are still a proposal, and the current rule is the one that applies. The federal regulatory agenda now targets July 2027 for a final rule, a year later than the May 2026 date it listed before.
Plenty of marketing email describes mandatory encryption, MFA and 72-hour recovery as if they were already law. They aren’t yet. Most of them are still worth doing, and the current rule already expects more than many practices realize.
Talk to an advisor
Ask about your own setup.
We ask what you’re trying to accomplish and tell you what we’d look at first. It costs nothing to talk, and no price comes up on this call.
Where the proposal stands
| When | What happened |
|---|---|
| Late December 2024 | HHS Office for Civil Rights (OCR) released the proposed rule |
| January 6, 2025 | Published in the Federal Register |
| March 7, 2025 | Comment period closed, with more than 4,700 comments |
| May 2026 | Earlier target for a final rule, which passed without one |
| July 2027 | Current target on the federal regulatory agenda, listed as a long-term action |
More than 100 hospital and provider groups have asked HHS to withdraw the proposal, citing cost and the burden on small and rural providers. The final rule could still be issued as written, narrowed, delayed again or withdrawn. If it is finalized as proposed, it would take effect 60 days after publication, with most requirements due 180 days after that, about 240 days in all.
What the proposal would change
According to HHS, the main changes would be:
- Nearly every “addressable” specification would become required, with limited exceptions.
- Electronic protected health information (ePHI) encrypted at rest and in transit.
- Multifactor authentication.
- A written inventory of technology assets and a map of how ePHI moves through your systems, reviewed at least every 12 months.
- Vulnerability scans at least every six months and a penetration test at least once a year.
- Written procedures to restore certain systems and data within 72 hours.
- Network segmentation.
- An annual compliance audit, plus yearly written verification from business associates that their safeguards are in place.
What applies to you today
The current Security Rule is fully in effect for every covered entity and business associate, whatever their size. It requires:
- 01An accurate and thorough risk analysis of the risks to ePHI, kept current.
- 02Administrative safeguards, including security training, access management, incident procedures and contingency planning.
- 03Physical safeguards for facilities, workstations and devices.
- 04Technical safeguards, including access controls, audit logs, integrity controls and transmission security.
- 05Business associate agreements with vendors that handle ePHI for you.
“Addressable” today means you implement the safeguard, implement a reasonable alternative, or document why neither fits your organization. In 2026 it is hard to document a good reason to skip encryption or MFA.
$450,000
Paid to HHS in June 2026 by an employer’s group health plan after ransomware exposed data on 10,023 people. Investigators found it had never done a HIPAA risk analysis. (HHS OCR)
That case was the 14th settlement in OCR’s Risk Analysis Initiative, an enforcement push aimed at organizations that skip the required risk analysis. Notice who paid: an employer’s health plan, which shows the rule reaches well beyond hospitals and clinics.
What we find at onboarding
Every new client goes through our 14-page compliance checklist, and Chad Odom, our owner, performs and signs the review. In healthcare practices and the business associates that serve them, the gaps fall into the same three groups the Security Rule uses:
- Administrative safeguards missing, meaning the written policies, training and procedures the rule expects.
- Physical safeguards missing for offices, workstations and devices.
- Technical safeguards in place but misconfigured.
The Microsoft 365 tenants we review often explain that third group. Most run on Microsoft’s defaults, with auditing off, no conditional access, and Intune licensed but never set up. Fixing those addresses MFA, audit logging and device control, which both the current rule and the proposal care about.
After onboarding, our healthcare clients get an annual risk assessment with a written report and a remediation plan. Our compliance services page covers the rest, and our guide to compliance for small businesses shows how HIPAA fits with other rules you may fall under.
A short list for the next 90 days
- Update your risk analysis if it is more than a year old or predates a new system, office or vendor. The free HHS and ONC Security Risk Assessment Tool is a reasonable starting point for a small practice.
- Turn on MFA everywhere ePHI can be reached, starting with email, the EHR and remote access.
- Encrypt laptops, phones and backups.
- List every device, application and vendor that touches ePHI.
- Test a restore and time it against 72 hours.
- Confirm you have a current business associate agreement with every vendor that handles ePHI.
The proposal may change again before it is final. A current risk analysis is required now, and it is where OCR keeps finding problems. A risk analysis more than a year old is the place to start. Book a 15-minute call and we’ll talk it through with you.
Related reading
Frequently asked questions
Is the new HIPAA Security Rule final?
No. As of October 2026, the update HHS proposed in January 2025 is still a proposal, and the federal regulatory agenda targets July 2027 for a final rule. It could still be finalized, narrowed, delayed again or withdrawn. If it’s finalized as proposed, most requirements would be due about 240 days after publication.
What is the HIPAA Security Rule?
The HIPAA Security Rule is the federal rule that sets standards for protecting electronic protected health information (ePHI). It applies to every covered entity and business associate, whatever their size, and requires a current risk analysis plus administrative, physical and technical safeguards. The update HHS proposed in January 2025 is not final, so the current rule is the one that applies.
Does HIPAA require MFA?
The current HIPAA Security Rule doesn’t name multifactor authentication, but it does require procedures to verify the identity of anyone signing in to systems with ePHI, and the proposed update would make MFA required. In practice, MFA is the expected way to meet that standard today, and it’s hard to document a good reason to skip it.
Does HIPAA require encryption?
Under the current HIPAA Security Rule, encryption of ePHI is addressable, which means you implement it, use a reasonable alternative, or document why neither fits. The proposed update would make encryption at rest and in transit required. Properly encrypted health information also generally doesn’t trigger breach notification if it’s lost, which makes encryption hard to skip.
What does the HIPAA Security Rule cover?
It covers ePHI that a covered entity or business associate creates, receives, maintains or transmits. It requires an accurate, current risk analysis; administrative safeguards such as training, access management, incident procedures and contingency planning; physical safeguards for facilities, workstations and devices; technical safeguards such as access controls, audit logs and transmission security; and business associate agreements with vendors that handle ePHI.
Sources
- HHS: HIPAA Security Rule NPRM fact sheet
- Federal Register: HIPAA Security Rule to Strengthen the Cybersecurity of ePHI (proposed rule), January 6, 2025
- HHS: Summary of the HIPAA Security Rule
- HHS OCR: Settles ransomware investigation with health plan, June 2026
- LeadingAge: No action expected on HIPAA cybersecurity rule in the coming year, July 2026
- Feldesman: OCR delays final action on proposed HIPAA Security Rule, August 2026
- Medcurity: HIPAA Security Rule 2026 status, June 2026
- Pact-One: Is the HIPAA Security Rule final in 2026?, September 2026
- HealthIT.gov: Security Risk Assessment Tool; HIPAA Journal: HIPAA Security Rule update postponed, July 2026; HIPAA Journal: HIPAA Security Rule update postponed, July 2026
Next step
Let us handle this for you.
We tell you which rules apply, put safeguards in place and hand you the policies.
- 15 minutes
Tell us which question brought you here and how your office runs.
We’ll tell you how it applies to you and what we’d look at first.
If we’re not the right fit, we’ll say so.
15 minutes
