2026 HIPAA Security Rule Update

The proposed 2026 HIPAA Security Rule update—still not finalized, with final action now targeted for July 2027—would mandate significant security enhancements including mandatory encryption of all ePHI, multi-factor authentication for all systems accessing patient data, 72-hour incident reporting, annual penetration testing, and stricter business associate oversight. These changes represent the most substantial update to HIPAA security requirements since the original rule and would eliminate the current "addressable" designation for many requirements, making them mandatory rather than optional. Healthcare organizations should begin preparing now by assessing encryption capabilities, implementing MFA, and updating incident response plans, as the compliance requirements could shift the landscape significantly once finalized.