2026 HIPAA Security Rule Update: What to Know

HHS has proposed the biggest update to the HIPAA Security Rule since 2013, and while the final rule has been delayed to July 2027, the direction is already clear. If you run a medical or dental practice in Palm Beach, Broward, or Miami-Dade, the requirements coming your way go well beyond "have a firewall and call it a day." Here's what's actually in the proposed rule, and why waiting until 2027 to start is a mistake.

Multi-factor authentication becomes mandatory. Every system that touches patient data, your EHR, email, patient portal, billing software, would require MFA, with only narrow exceptions. If your staff is still logging in with just a password, this alone is a multi-week project once you factor in staff training and vendor coordination.

Encryption of ePHI at rest and in transit, with limited exceptions. That means patient data sitting on a server, a laptop, or a backup drive needs to be encrypted, not just data moving over the internet. A lot of older practice management systems and legacy backup setups were never built with this in mind.

A real technology asset inventory and network map. You would need to document every device and system that can access ePHI, and how patient data actually moves through your network, reviewed at least annually. Most small practices have never done this formally.

Vulnerability scans every six months, penetration testing annually, and a full security audit at least once a year. This is a meaningful jump from the current rule's vaguer "periodic" language, and it's not something your front desk can do between patients.

Network segmentation and a 72-hour data restoration requirement. Your guest Wi-Fi, your practice management system, and your medical devices should not all sit on the same flat network, and you need a tested plan to restore data within 72 hours of an incident.

Annual verification of your business associates' security measures. If your IT vendor, billing company, or answering service touches patient data, you're on the hook for confirming they're actually secure, not just trusting the contract you signed three years ago.

Why this matters even with the delay: OCR has already signaled these are "current cybersecurity best practices," which means they're increasingly the standard auditors and cyber insurance carriers expect right now, final rule or not. Practices that wait until the deadline is imminent typically end up paying rush pricing for the same work a phased rollout would have covered gradually.

Not sure where your practice stands against these requirements? Get a free HIPAA security gap assessment →