Critical HIPAA Updates for 2026

What changes are coming to the HIPAA Security Rule in 2026?

The HIPAA Security Rule has remained largely unchanged since its introduction in 2003, with the last formal update occurring in 2013. HHS released a Notice of Proposed Rulemaking (NPRM) on December 27, 2024 that would significantly revise the Security Rule. The intent is to release a modernized version of the Security Rule that offers better protection for ePHI (electronic protected health information).

HHS plans to finalize the new Security Rule in May 2026. Required compliance dates will likely be set at that time.

These changes have significant implications for the policies, operations, and cybersecurity controls of covered entities. In a nutshell, the new Security Rule will revolutionize HIPAA cybersecurity requirements.

Here are the new requirements that HHS is expected to include in the rule.

1. Removal of “required” vs “addressable” distinctions.

The revised rule would eliminate the longstanding flexibility that allowed entities to treat certain safeguards as “addressable.” Nearly all implementation specifications would become mandatory, with only narrow exceptions remaining.

2. Mandatory written documentation

To improve auditability and enforcement, the revised rule would require entities to maintain comprehensive written documentation of the following information and processes.

• Policies and procedures relating to the HIPAA Security Rule
• Plans relating to the Security Rule
• Analyses and compliance activities

3. Technology asset inventory and network mapping

The revised rule would require organizations to:

• Maintain a technology asset inventory
• Create and update a network map showing how ePHI moves throughout the entity’s systems
• Update both the map and the inventory annually, or when system changes affect ePHI

4. Formal compliance audit every 12 months

The revised rule would require covered entities to conduct a formal compliance audit every twelve months. Business associates (BAs) would be required to share results with all their covered-entity clients. This new requirement will place HIPAA compliance under the microscope for every covered entity.

5. More stringent cybersecurity requirements

The revised rule would introduce tighter requirements for cybersecurity and information security.

• MFA (multifactor authentication) required for all system access, whether remote or onsite.
• Role-based access controls would be required.
• Automatic session timeouts would be required.
• Revocation of system access within one hour of workforce termination would be required.
• Encryption of ePHI in transit and at rest would be required rather than “addressable.”
• A 24-hour incident reporting timeline would now be required.
• A written incident response plan, along with annual incident response testing, would now be required.
• Covered entities would be required to demonstrate the capability to restore critical systems within 72 hours of an incident.
• NIST-aligned security practices would now be required.
• Vulnerability scans would be required every six months.
• Penetration testing would be required once a year.

6. Enhanced requirements to BAAs (business associate agreements)

The revised rule would require more specific language in BAAs (business associate agreements), eliminating the ability of covered entities to use certain types of blanket statements. BAAs would have to specify all of the new cybersecurity requirements, including MFA, data encryption, incident reporting timeline, vulnerability scanning requirements, penetration testing requirements, and so on.

7. Expanded and more detailed risk assessments

The revised rule would require risk assessments to be more detailed, thoroughly documented, conducted every 12 months, and designed to drive actionable security improvements. Aligning with the NIST Cybersecurity Framework may help covered entities achieve compliance more efficiently and consistently.