The deadline moved. The cyber threat did not.
Healthcare organizations expected a final HIPAA Security Rule Update during May 2026. Instead, the federal regulatory agenda now identifies July 2027 for possible final action.
The proposal also appears under “Long-Term Actions.” This suggests HHS does not expect to finalize it soon.
However, July 2027 is only a planning estimate. HHS could publish the rule earlier, delay it again, or revise major requirements.
For healthcare leaders, the message is clear: use the extra time, but do not pause security improvements.
The Short Version
Here is what healthcare organizations need to know:
- The proposed HIPAA Security Rule Update has moved from an expected May 2026 release to July 2027.
- The current HIPAA Security Rule remains fully effective and enforceable during the delay.
- HHS has not publicly explained why the proposal moved to the long-term regulatory agenda.
- The final rule may change because HHS received more than 4,000 public comments.
- Proposed measures include MFA, encryption, network mapping, penetration testing, and stronger business-associate oversight.
- Separate HIPAA Privacy Rule changes are still expected as early as August 2026.
The delay offers valuable preparation time. Still, it does not reduce current legal duties or cybersecurity risks.
What Actually Changed?
| Previous position | Current position |
| Final action was expected during May 2026. | The regulatory agenda now lists July 2027. |
| Healthcare organizations expected near-term implementation pressure. | Providers and business associates have more preparation time. |
| The proposal appeared closer to completion. | It now appears under Long-Term Actions. |
| Budgets required immediate regulatory planning. | Organizations can now prioritize changes more carefully. |
The new date is not legally binding.
Federal agencies regularly change regulatory agenda dates. Therefore, organizations should monitor official updates rather than treating July 2027 as guaranteed.
The existing rule continues unchanged until HHS publishes and implements a final version. Federal regulatory agenda
Why Did HHS Delay the HIPAA Security Rule Update?
HHS has not provided an official explanation.
However, several factors may have influenced the decision.
Thousands of Public Comments Need Review
The January 2025 proposal generated more than 4,000 public comments.
Some commenters supported stronger cybersecurity standards. Others questioned the proposal’s cost, scope, and implementation schedule.
Reviewing those comments and preparing defensible final requirements takes time.
Healthcare Organizations Raised Cost Concerns
Hospitals warned that extensive new technical and administrative duties could create significant financial pressure.
HHS estimated first-year industry costs near $9 billion.
Estimated annual costs could then reach approximately $6 billion during years two through five.
Smaller providers and rural healthcare organizations may face the greatest difficulty. Many operate with limited cybersecurity teams and restricted budgets.
The New Administration May Be Reassessing the Proposal
A new administration often reviews major regulations inherited from its predecessor.
HHS may be examining whether the proposed requirements match current policy priorities.
The agency could keep the proposal largely unchanged. Alternatively, it could narrow requirements or introduce greater flexibility.
Clark Hill notes that HHS has not confirmed any particular explanation. Therefore, predictions about the rule’s future remain speculative.
What the Proposed Rule Would Require
The HIPAA Security Rule first took effect in 2003. Its last major revision arrived through the 2013 HIPAA Omnibus Rule.
Healthcare technology has changed dramatically since then.
Cloud platforms, connected devices, remote access, mobile applications, and digital vendors now handle sensitive health information.
The proposed update attempts to address those changes through more specific requirements.
Multifactor Authentication
Regulated organizations would generally need MFA across systems containing electronic protected health information.
Limited exceptions could apply. However, organizations would need clear reasons and suitable alternative safeguards.
Stronger Encryption
The proposal would require encryption for ePHI at rest and during transmission, subject to limited exceptions.
This requirement could affect databases, laptops, email, cloud services, backups, and connected systems.
Asset Inventories and Network Maps
Organizations would need detailed inventories covering technology assets that handle ePHI.
They would also need network maps showing where that information enters, travels, remains, and leaves.
Regular Security Testing
Vulnerability scans would occur at least every six months.
Penetration testing would occur at least once every 12 months.
Organizations would also need processes for tracking and correcting discovered weaknesses.
Annual Risk Analysis and Compliance Audits
Security risk analysis would become more detailed and prescriptive.
Additionally, regulated entities would need annual reviews covering compliance with the Security Rule.
Incident Response and Recovery
Organizations would need written incident-response plans with regular testing.
Backup, restoration, disaster recovery, and network segmentation would also receive stronger attention.
Greater Business-Associate Accountability
Covered entities would need stronger assurance that business associates maintain required technical safeguards.
Vendors could also face shorter notification periods for certain security events.
Why the Proposal Created Pushback
Healthcare organizations generally agree that stronger cybersecurity is necessary.
The dispute concerns how quickly and uniformly HHS should require those improvements.
The proposed rule would remove much of the flexibility within the current Security Rule.
Many “addressable” controls would become mandatory, although limited exceptions could remain.
Hospitals argue that a single approach may not suit every organization.
A major health system and a small rural practice have very different budgets, staffing levels, and technology environments.
More than 100 healthcare organizations reportedly urged HHS to withdraw or reconsider the proposal.
Nevertheless, supporters argue that essential protections should no longer remain optional.
Fierce Healthcare reported that encryption, MFA, segmentation, and annual testing remain central to the proposal. Fierce Healthcare
Why Waiting Until 2027 Would Be a Mistake
The proposed final rule is delayed. The current Security Rule is not.
Covered entities and business associates must still protect the confidentiality, integrity, and availability of ePHI.
They must also conduct an accurate and thorough security risk analysis.
OCR can investigate breaches and impose corrective action under existing requirements.
Furthermore, attackers do not follow federal regulatory calendars.
Ransomware, phishing, stolen credentials, vendor incidents, and business email compromise remain active healthcare risks.
Many proposed measures already represent established security practice. These include MFA, encryption, backups, vulnerability management, and incident testing.
Implementing them can reduce operational risk before they become formal HIPAA requirements.
Change Healthcare Shows Why MFA Matters
The February 2024 Change Healthcare attack remains a defining event within this debate.
The incident disrupted healthcare payments, pharmacy services, and claims processing across the United States.
According to HIPAA Journal, the breach ultimately affected approximately 192.7 million people.
Attackers reportedly used stolen credentials to access a remote portal without multifactor authentication.
That single weakness contributed to disruption across a major healthcare payment network.
The case demonstrates why the proposed rule gives MFA and network controls greater attention.
The New Compliance Test: Can You Prove It?
Having a security policy is not the same as operating an effective security control.
A policy may state that MFA protects every account. However, legacy systems or administrator accounts may remain outside that protection.
An organization may conduct vulnerability scans. Yet, it may lack evidence showing that identified weaknesses were corrected.
An asset inventory may exist. Still, it could exclude cloud applications, departmental systems, or newly introduced AI tools.
This gap between policy and proof creates significant risk.
AARC-360 recommends using the delay to build stronger operational evidence.
That evidence may include:
- Current security risk assessments linked with specific systems, risks, owners, and corrective actions.
- Complete technology inventories covering devices, software, cloud platforms, integrations, and connected medical equipment.
- MFA and encryption reports demonstrating that safeguards operate across the organization.
- Vulnerability reports supported by remediation dates, risk decisions, and responsible personnel.
- Backup testing records showing that critical information and systems can be restored.
- Business-associate reviews covering security controls, subcontractors, and incident-notification procedures.
- Incident-response exercises showing lessons learned and resulting improvements.
Security controls reduce risk. Evidence demonstrates that those controls exist and operate consistently.
What About the HIPAA Privacy Rule?
While the Security Rule waits, another HIPAA change may arrive much sooner.
HHS currently lists August 2026 for final action on proposed Privacy Rule changes.
That proposal first appeared during January 2021.
Its goals include improving patient access to records and supporting better care coordination.
It may also strengthen information sharing with families and caregivers during certain situations.
Therefore, compliance teams should continue monitoring federal activity throughout 2026.
Alston & Bird notes that the Privacy Rule could create nearer-term obligations despite the Security Rule delay.
Five Smart Ways to Use the Extra Time
The delay gives healthcare organizations an opportunity to prepare without rushing.
1. Refresh the Security Risk Analysis
Review actual systems, workflows, vendors, devices, and information flows.
Avoid generic assessments that do not reflect the organization’s current technology environment.
2. Map Every Location Holding ePHI
Identify databases, cloud platforms, mobile devices, email systems, backups, and third-party applications.
Include AI tools that may create, receive, maintain, or transmit protected information.
3. Test Core Security Controls
Confirm that MFA, encryption, access controls, logging, backups, and endpoint protection work consistently.
Pay particular attention to privileged accounts, remote access, and legacy systems.
4. Review High-Risk Vendors
Check whether business associates can demonstrate effective safeguards.
Also, review their subcontractors, incident procedures, and contractual notification duties.
5. Create an Evidence Library
Organize assessment reports, access reviews, training records, incident exercises, and vulnerability remediation documents.
Producing evidence should become a routine process rather than an emergency task.
Questions Every Healthcare Leader Should Ask
Board members and executive teams do not need to become cybersecurity specialists.
However, they should expect clear answers to several questions:
- Do we know every system that handles electronic protected health information?
- Is MFA active across remote, privileged, administrative, and vendor access?
- Can we restore essential systems after a ransomware incident?
- Which serious vulnerabilities remain unresolved?
- Can key vendors prove that their security controls work?
- When did we last test the incident-response plan?
- What evidence could we provide during an OCR investigation?
These questions connect HIPAA compliance with patient safety and business continuity.
The Bottom Line
The HIPAA Security Rule Update has moved to July 2027, but that date remains uncertain.
HHS may revise the proposal, publish it earlier, or delay it again.
Healthcare organizations should avoid making the calendar their only motivation.
The current Security Rule still applies. Meanwhile, ransomware and data breaches continue creating operational, financial, and patient risks.
Use the additional time to strengthen foundational controls.
Start with risk analysis, asset visibility, MFA, encryption, backups, incident testing, and vendor oversight.
Then, collect evidence showing those measures operate effectively.
The final rule may arrive later than expected. The next cyberattack may not.
