Where does the HIPAA Security Rule update stand in 2026?

The proposed HIPAA Security Rule update has been on the calendar of every covered entity and business associate since early 2025. It has not arrived, and the federal regulatory agenda now pushes it into 2027. That delay changes the timing of the new requirements. It does not change what the current rule already requires, and the Office for Civil Rights (OCR) is enforcing the current rule now.

Will the HIPAA Security Rule changes take effect in 2026?

Not on the current schedule. The update is still a proposed rule. HHS published the notice of proposed rulemaking in the Federal Register on January 6, 2025 (90 FR 898). The federal regulatory agenda entry for the rulemaking, RIN 0945-AA22, lists final action for July 2027 and places it among "Long-Term Actions."

Agenda dates are targets. An earlier edition of the agenda listed May 2026, and that date passed without a final rule. A final rule could arrive sooner or later than July 2027, and its content could differ from the proposal. Any compliance deadline would run from whatever date HHS sets in the final rule.

What HIPAA Security Rule changes did HHS propose?

HHS proposed a more prescriptive Security Rule with fewer judgment calls. The HHS fact sheet lists the main changes. The proposal would:

• Remove the distinction between "required" and "addressable" implementation specifications, making nearly all of them required.
• Require a written technology asset inventory and a network map, reviewed at least every 12 months.
• Require a more specific written risk analysis covering threats, vulnerabilities and risk levels.
• Require encryption of electronic protected health information (ePHI) at rest and in transit, and multi-factor authentication, each with limited exceptions.
• Require written procedures to restore certain systems and data within 72 hours.
• Require a compliance audit at least once every 12 months, vulnerability scanning at least every six months, and penetration testing at least once every 12 months.
• Require business associates to verify their technical safeguards to covered entities at least once every 12 months, and to notify covered entities no later than 24 hours after activating a contingency plan.

Does this affect firms outside healthcare?

Yes, if they are business associates. Under 45 CFR 164.302, a covered entity or business associate "must comply with the applicable standards" of the Security Rule. A law firm handling medical records in litigation for a hospital client, an accounting firm with access to a medical practice's patient billing data, or a nonprofit running a health program for a covered entity can each be a business associate.

For those firms, the proposed annual verification would turn a contract term into a recurring deliverable. A covered entity client could expect a written analysis and certification each year that your technical safeguards are in place. Some clients may start asking for that evidence in security questionnaires before any final rule requires it.

What does the current Security Rule already require?

More than many firms have documented. Three requirements carry most of the weight today:

• Risk analysis and risk management. 45 CFR 164.308(a)(1)(ii)(A) requires "an accurate and thorough assessment of the potential risks and vulnerabilities" to ePHI. Paragraph (B) requires security measures "sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level."
• Addressable means decide and document. Encryption is listed as addressable in section 164.312(a)(2)(iv). Under section 164.306(d)(3), an entity must "assess whether each implementation specification is a reasonable and appropriate safeguard in its environment," then implement it or document why an equivalent alternative is reasonable. Addressable has never meant optional.
• Documentation. Section 164.316(b) requires written policies and records, kept "for 6 years from the date of its creation" or the date last in effect, whichever is later, and reviewed "periodically" and updated "in response to environmental or operational changes."

Why is the risk analysis OCR's focus right now?

Because OCR has built a dedicated enforcement program around it. On February 19, 2026, OCR announced a $103,000 settlement with a treatment center that had not conducted an "accurate and thorough risk analysis." OCR described it as the 11th enforcement action under its Risk Analysis Initiative.

The pattern matters for a business associate or a smaller covered entity. When OCR looks into a security incident, the risk analysis is one of the first documents that shows whether the organization understood its own risks. A missing, outdated or generic analysis can turn a security incident into a compliance finding.

What should you do before the final rule lands?

Close the gaps the current rule already creates, in an order that also prepares you for the proposal. Each item below is defensible under today's rule and maps to a proposed requirement:

• Update the risk analysis. Make it specific to your systems, dated, and signed off. If it predates a move to the cloud, a new practice management platform or a remote work policy, it is out of date.
• Build the asset inventory and network map. You cannot analyze risk to systems you have not listed. Include laptops, phones, cloud services and every vendor platform that stores or touches ePHI.
• Turn on MFA everywhere ePHI lives. Email, remote access, file storage and practice systems first.
• Close the encryption decision. Encrypt ePHI at rest and in transit, or document the reasoned alternative the current rule permits. Expect that alternative to disappear under a final rule.
• Test a restore. Time how long it takes to bring back your most critical system from backup. If the answer is longer than 72 hours, note it as a risk.
• Schedule scanning and testing. Set vulnerability scanning on a recurring schedule and plan a penetration test, so the cadence exists before it is required.
• Review business associate agreements. Confirm which clients treat you as a business associate, what each agreement requires, and how fast you must report an incident.
• Keep the evidence. Store each decision, test result and review with a date, under the six-year retention rule.

This article summarizes the current HIPAA Security Rule and HHS's published proposal. It is not legal advice, and whether your firm is a business associate depends on your client relationships and agreements.

How s90 helps

s90 is a compliance-focused managed IT provider in Los Angeles and Orange County. For firms that handle health information for clients, we build and maintain the asset inventory, network map, MFA and encryption controls, and backup testing that a current risk analysis depends on, and we keep the dated records your covered entity clients and OCR may ask to see. If you would like a second look at your risk analysis before the final rule arrives, we are glad to help.