What is the HIPAA Security Rule 2026 timeline?

The HHS Office for Civil Rights (OCR) is expected to push significant changes to the HIPAA Security Rule in 2026, with a final rule targeted for May 2026. The Notice of Proposed Rule Making (NPRM) was issued in December 2024, and the public comment period closed in March 2025. Since that time no changes to the original Rule have been made.

How should healthcare organizations prepare for HIPAA Security Rule 2026 risk management requirements?

Once the annual HIPAA Security Risk Analysis is completed, follow up on medium and high-risk areas right away. Create a checklist with the most critical risks or vulnerabilities, set target dates to address them, put necessary changes into motion, and revisit the risk level once security measures are implemented to confirm successful mitigation.

Where should Multi-Factor Authentication be implemented for HIPAA Security Rule 2026?

MFA should be implemented whenever possible to ensure only authorized personnel access ePHI. This includes remote access to EMR/PM or servers located in the organization, accessing emails from cell phones, and logging into cloud solutions from the business environment. MFA adds another critical security layer of protection required for HIPAA Security Rule 2026 compliance.

What should vulnerability scans cover for HIPAA Security Rule 2026 compliance?

Vulnerability scans for HIPAA Security Rule 2026 compliance should cover internal networks, external-facing applications, cloud services, and medical devices connected to the network. These security assessments identify weaknesses in networks, systems and medical devices to protect ePHI and ensure HIPAA compliance.

What cybersecurity threats does HIPAA Security Rule 2026 focus on?

HIPAA Security Rule 2026 preparation should focus efforts on Cybersecurity Awareness, mitigating hacking and ransomware attacks. These represent the most significant threats facing healthcare organizations and have dominated OCR enforcement actions in recent years. Organizations must implement both technical controls and staff training to address these threats.

What was included in the HIPAA Security Rule NPRM?

The Notice of Proposed Rule Making (NPRM) for the HIPAA Security Rule was issued in December 2024, proposing changes or amendments to the original HIPAA Security Rule. The public comment period closed in March 2025, allowing anyone to voice their concerns about the proposals. Healthcare organizations should prepare now for the final rule expected in May 2026.

Healthcare cyber attacks - HIPAA security and data protection

HIPAA Tip: HIPAA in 2026

February 17, 2026

As you may be aware, the Notice of Proposed Rule Making (NPRM) for the HIPAA Security Rule was issued in December 2024. Public comment period closed in March 2025, allowing anyone to voice their concerns on the proposals made to change or amend the original HIPAA Security Rule. Since that time to present we have seen no changes to the original Rule.

With a new year ahead of us the HHS Office for Civil Rights (OCR) is expected to push significant changes to the HIPAA Security Rule in 2026, with a final rule targeted for May 2026. Instead of denying changes are coming move your healthcare organization forward by enabling the following security measures:

Enhanced Risk Management: once the annual HIPAA Security Risk Analysis (SRA) is completed, follow up on the areas with medium and high risks right away. Create a checklist with the most critical risks or vulnerabilities, set target dates to address and put into motion necessary changes, and revisit the risk level once security measures are put into place (has this successfully mitigated the risk?).
Multifactor Authentication (MFA): whenever possible add another security layer of protection with MFA, ensuring only authorized personnel access ePHI. Use MFA on what? Remote access to the EMR/PM or servers located in the organization, accessing emails from cell phones, even logging into a cloud solution from the business environment.
Vulnerability Scans: security assessments that identify weaknesses in networks, systems and medical devices protect ePHI and ensure HIPAA compliance. Scans should cover internal networks, external-facing applications, cloud services and medical devices connected to the network.

Focus efforts on Cybersecurity Awareness, mitigating hacking and ransomware attacks.

Compliance Is Ongoing

HIPAA compliance isn’t a one-time checklist. It’s ongoing, programmatic in nature, and requires demonstrated reasonable diligence to stay in good standing with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). Anatomy IT can provide you peace of mind with our expert HIPAA compliance services. To learn more, contact us here.

About the Author: Dawn Meglino
HIPAA Compliance Specialist, CHPSE, CCSA, CCAP

Dawn Meglino is a certified HIPAA Compliance Specialist at Anatomy IT helping healthcare organizations navigate complex security and compliance requirements. She holds multiple cybersecurity and compliance certifications and regularly advises medical practices on breach prevention and HIPAA best practices.