If you have seen headlines saying new HIPAA security rules are “now in effect,” take a breath. As of late summer 2026, the big update to the HIPAA Security Rule is still a proposal. It has not been finalized, and the current rule still applies.
The proposal does tell you where regulators are heading, though, and almost everything in it is something a well-run practice should be doing anyway.
This is a plain-language overview, not legal advice.
The short version
- The update was proposed in December 2024 and has not been finalized.
- The federal regulatory agenda now lists July 2027 as the target for final action. That date could move again.
- The proposal would make safeguards like encryption and multi-factor authentication mandatory.
- The steps to take now are the same ones that protect you from ransomware.
Where things stand
- December 27, 2024. The HHS Office for Civil Rights (OCR) released the proposed rule. It was published in the Federal Register on January 6, 2025.
- March 7, 2025. The public comment period closed. OCR received more than 4,700 comments.
- May 2026. The original target for a final rule passed without one.
- July 2027. The current target date for final action.
Under the proposal, practices would have roughly eight months to comply after a final rule is published. The final version could change that, along with any of the details below.
What the proposal would require
These come from the HHS fact sheet on the proposed rule:
- No more “addressable” safeguards. Today some safeguards are labeled addressable, which gives practices flexibility in how they meet them. The proposal would make nearly all of them required, with limited exceptions.
- Encryption of electronic patient information, both stored and in transit.
- Multi-factor authentication.
- A technology asset inventory and network map showing where patient information lives and moves, updated at least every 12 months.
- A more detailed written risk analysis.
- Vulnerability scans at least every six months and penetration testing at least every 12 months.
- Network segmentation.
- 72-hour recovery. Written procedures to restore critical systems and data within 72 hours.
- A compliance audit at least once every 12 months.
- Business associate verification. Vendors would confirm in writing, at least once a year, that their technical safeguards are in place.
- Written documentation of all security policies, procedures, plans and analyses.
What applies right now
The current Security Rule is still the law. A risk analysis is already required today, and a missing or outdated one is among the problems OCR cites most often in enforcement actions.
One 2026 deadline did arrive. Practices that create or receive substance use disorder treatment records covered by 42 CFR Part 2 needed to update their Notice of Privacy Practices by February 16, 2026. If you are not sure whether that applies to you, ask whoever handles your compliance.
What to do while you wait
- Do or update your risk analysis, in writing. It is required now and it is the foundation for everything else.
- Turn on multi-factor authentication for email, remote access and your practice software wherever it is supported.
- Encrypt laptops, servers, portable drives and backups.
- Build your inventory. List every computer, server, imaging device and cloud service that touches patient information.
- Test a restore and time it. Could you be back up within 72 hours? Your backup and recovery plan should be able to answer that.
- Review your vendor list. Make sure there is a signed Business Associate Agreement for each one.
- Write it down. Policies that only exist in someone’s head do not count.
None of this is wasted effort if the final rule changes. These are the same steps that stop ransomware and shorten downtime, and they are the core of solid cybersecurity and HIPAA compliance work.
Want to know where your practice stands?
Xceltek and our sister company Cytek help practices with HIPAA risk assessments, Business Associate Agreements, staff training and audit prep.
Common questions
Is the new HIPAA Security Rule in effect?
No. As of late summer 2026 it is still a proposed rule. The current Security Rule remains in effect until a final rule is published and its compliance date arrives.
When will it be final?
The federal regulatory agenda lists July 2027 as the target for final action. Target dates are estimates and this one has already moved once.
Would it apply to small practices?
The proposal does not exempt small practices. It would apply to covered entities and business associates of every size.
