HIPAA Security Rule Changes 2026: None Are Final, and HHS Now Targets July 2027

As of November 2, 2026, the HIPAA Security Rule changes 2026 headlines promised are still only a proposal. The 2026 Unified Agenda moved final action on RIN 0945-AA22 from May 2026 to July 2027 and reclassified it as a long-term action. OIRA has no final version under review, so the 2013-era text at 45 CFR Part 164 Subpart C still governs.

Update status: postponed, not withdrawn

Yes, the HIPAA Security Rule update was postponed in the only sense an agenda can show. Spring 2025 listed it at the Final Rule Stage with final action in 05/2026. The 2026 edition, which Reginfo stores under pubId 202510, lists it under Long-Term Actions with final action in 07/2027 and answers “Included in the Regulatory Plan” with No. It was not withdrawn: the same entry keeps the title, RIN and NPRM citation, and regulations.gov shows the proposal with its withdrawn flag set to false.

Blue dots: NPRM date in that edition. Red dots: planned final action. Month-only agenda dates are drawn at mid-month. The edition lists NPRM 01/06/2025 once it was published. Source: Reginfo, Unified Agenda entries for RIN 0945-AA22.

The agenda dates carry no legal weight here: every entry states “Legal Deadline: None”, and Reginfo prints no release date for the 2026 edition. HHS could publish sooner than July 2027 or later, and it could rewrite the proposal in between. The two newest entries also carry a new field, “EO 14192 Designation: Regulatory”. Executive Order 14192, published February 6, 2025, a month after the NPRM, tells agencies to identify at least 10 existing regulations to repeal for each new one. These records cannot show whether it caused the delay, so we make no such claim.

Every dated step so far

A timing note for anyone planning around OIRA: the proposal spent 61 days in review. If a final rule took the same time and HHS held to the agenda, the rule would reach OIRA around May 2027. That is arithmetic on one prior review, not an HHS statement. Refresh the OIRA review list before relying on it, since a listing there is the earliest public sign of a final text.

Proposed changes vs the rule in force today

The middle column is law today. The right column is only proposed and could change. We matched every quotation against the saved eCFR text (current to 2026-10-29) and the regulatory text of the NPRM, and computed each Federal Register page from the document’s own page markers. Of the 19 items below, 11 name a control or deadline the current text does not, and 8 tighten an existing duty. Where a “New” row shows current text, that is the nearest existing provision.

Three counts show the scale of the rewrite. Today’s Subpart C uses the label “(Addressable)” 22 times and “(Required)” 19 times; the proposed text uses neither, which HHS explains at 90 FR 933. “12 months” appears 0 times in the current text and 28 times in the proposed text. “Written” goes from 3 uses to 77. Most of the added work is recurring evidence, which is the part clients will ask an outside provider to produce.

Exceptions exist and most summaries skip them. Encryption and MFA each exempt a technology asset that cannot support the control, if the regulated entity has a written migration plan; both also carve out certain FDA-authorized devices and emergencies, and require documented compensating controls (proposed 164.312(b)(3) to (4) and (f)(2)(iii) to (iv), 90 FR 1017 to 1019). The 72-hour text requires written procedures to restore within 72 hours, and it covers “critical” systems only. The rest follow the criticality analysis.

What HHS says it would cost

OCR estimates $9 billion in the first year and about $6 billion a year in years two to five, or $34 billion undiscounted over 2026 to 2030 and $6.8 billion annualized at a 2 percent discount rate (90 FR 993). Those 2026 start dates predate the slip. The first-year total of $9,314 million splits almost evenly: $4,655 million for regulated entities (90 FR 1000) and $4,659 million for group health plan sponsors (90 FR 1001). HHS puts the regulated-entity figure at about $1,235 a year per establishment (90 FR 1007).

Eight largest of the regulated-entity lines in HHS Table 6, first-year millions of dollars, with HHS’s assumed hours per respondent.

The hours are the number to challenge. Table 6 multiplies 1.5 hours by a $119.94 analyst rate for MFA, which is $180 per regulated entity; 3 hours for a penetration test, $360; and 4.5 hours for network segmentation, $540. HHS gives ranges: up to 1.75 hours for MFA, 4 to 5 for segmentation, and 2 to 10 for a penetration test, and it says many large entities already have MFA and most already segment to some degree (90 FR 998 to 999). These are industry averages. Compare them with your own quotes before you pass an HHS number to a client.

What this means for MSPs

An MSP that can reach a dental or medical client’s patient data is normally a business associate: 45 CFR 160.103 covers anyone who creates, receives, maintains or transmits PHI for a covered entity, and subcontractors of business associates too. HHS’s cloud guidance applies that even to a provider holding encrypted ePHI with no key. Liability is direct: section 160.402 lets HHS impose civil money penalties on a business associate, and section 164.410 gives you 60 calendar days at most to report a breach to the covered entity. OCR is enforcing today’s text in the meantime, as our ledger of OCR penalties and settlements shows: it logs a record 25 actions in 2025. Our healthcare breach scorecard counts 802 large breaches that year.

That last item lands on the MSP directly if the rule survives. Proposed 164.308(b)(2)(ii) requires a written analysis by a qualified person and a certification by someone with authority to act for you, every 12 months, and HHS models it at 2 hours per business associate across about 1,000,000 of them, $240 million in total (90 FR 996 and 998). The security-official delegation in proposed 164.308(b)(3) is a sales opening with a warning attached: a client may name you, and it remains liable anyway. The MFA line needs an application-by-application check: our review of 2,571 online services found 73.9% offer MFA at all, and a proposed exception for assets without it requires a written migration plan. Clients who are accountants, auto dealers or mortgage brokers are on a different clock under the FTC: see our page on the FTC Safeguards Rule breach notification duty.

Frequently asked questions

What are the HIPAA Security Rule changes for 2026?

As of November 2, 2026, none has taken effect. HHS proposed them on December 27, 2024, and the proposal was published on January 6, 2025 at 90 FR 898. The 2026 Unified Agenda lists final action for July 2027, so the current 45 CFR Part 164 Subpart C remains the enforceable text.

What is the HIPAA Security Rule update status?

Long-Term Actions, RIN 0945-AA22, with final action planned for 07/2027. OIRA’s November 1, 2026 list shows no review of a final version, and the Federal Register shows only the January 2025 proposal under that RIN.

Was the HIPAA Security Rule update postponed?

The planned date moved by 14 months. The Spring 2025 Unified Agenda listed final action for May 2026 at the Final Rule Stage; the 2026 edition lists July 2027 at the Long-Term Actions stage. Agenda dates are planning targets, and this one has no legal deadline: the entry states Legal Deadline: None.

What HIPAA Security Rule proposed changes matter most?

The proposal removes the addressable category, which covers 22 specifications today, and sets numeric duties: multi-factor authentication, encryption at rest and in transit, 72-hour restoration procedures, 24-hour contingency notice, backups no more than 48 hours old, 15-day critical patching, six-month scans and 12-month penetration tests and audits.

Is encryption required under HIPAA today?

Encryption is an addressable specification today under 45 CFR 164.312(a)(2)(iv) and 164.312(e)(2)(ii). Addressable is not optional: section 164.306(d)(3) requires an assessment, and if encryption is not reasonable, a documented reason and an equivalent alternative where reasonable. The proposal would make it mandatory, with listed exceptions.

When would the changes take effect if finalized in July 2027?

A final rule published in July 2027 would be effective 60 days later, with compliance required 180 days after that under the proposal: February 26, 2028 to March 27, 2028. Existing business associate contracts could run until August 30, 2028 to September 29, 2028 at the latest.

Methodology

References

1. HHS OCR, HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, 90 FR 898 (Jan. 6, 2025). Accessed November 2026.
2. Reginfo, Unified Agenda, RIN 0945-AA22, 2026 edition. Accessed November 2026.
3. Reginfo, Unified Agenda, RIN 0945-AA22, Spring 2025. Accessed November 2026.
4. Reginfo, Unified Agenda, RIN 0945-AA22, Fall 2024. Accessed November 2026.
5. Reginfo, Unified Agenda, RIN 0945-AA22, Spring 2024. Accessed November 2026.
6. Reginfo, Unified Agenda, RIN 0945-AA22, Fall 2023. Accessed November 2026.
7. Reginfo, EO 12866 review data files. Accessed November 2026.
8. eCFR, 45 CFR Part 164 Subpart C. Accessed November 2026.
9. eCFR, 45 CFR 160.103. Accessed November 2026.
10. eCFR, 45 CFR 160.402. Accessed November 2026.
11. eCFR, 45 CFR 164.410. Accessed November 2026.
12. Regulations.gov, document HHS-OCR-2024-0020-0001. Accessed November 2026.
13. HHS OCR, HIPAA Security Rule NPRM. Accessed November 2026.
14. HHS OCR, NPRM fact sheet. Accessed November 2026.
15. HHS OCR, Guidance on HIPAA and Cloud Computing. Accessed November 2026.
16. Executive Order 14192, 90 FR 9065. Accessed November 2026.