The HIPAA Security Rule overhaul: proposed in 2025, and where it stands now
By Sid Varma, Founder - AllyMatter.com
Published September 26, 2026
The short version
- The proposed overhaul of the HIPAA Security Rule, published in the Federal Register on January 6, 2025, has not been finalized, withdrawn or replaced. It is still a proposed rule.
- The 2026 Unified Agenda moved it to Long-Term Actions and lists final action for July 2027, a planning estimate, not a deadline. The previous agenda had said May 2026.
- The Security Rule in force is 45 CFR Part 164, Subpart C, last amended in 2013. Its required and addressable implementation specifications still apply as written.
- If a final rule follows the proposal, it would take effect 60 days after publication, with compliance due 180 days after that.
- Two related changes did take effect: the remaining HIPAA Notice of Privacy Practices changes and the 42 CFR Part 2 rule that aligns substance use disorder records with HIPAA, both with a compliance date of February 16, 2026. Most of the 2024 reproductive health privacy rule was vacated by a federal court on June 18, 2025.
If you have read that new HIPAA security requirements apply in 2026, check the status word. The rule that would add mandatory encryption, multi-factor authentication, yearly compliance audits and 72-hour restoration plans is a proposal. As of September 25, 2026, the Department of Health and Human Services (HHS) has not published a final version.
What regulated entities must meet today is the Security Rule as it has stood since 2013. This article sets out where the proposal stands, what it would change, what applies now, and the HIPAA changes that did take effect in 2025 and 2026.
Is the HIPAA Security Rule update final?
No. The HHS Office for Civil Rights (OCR) issued the notice of proposed rulemaking on December 27, 2024, and it was published in the Federal Register on January 6, 2025 (90 FR 898, RIN 0945-AA22). Comments were due "on or before March 7, 2025".
The public docket on Regulations.gov shows 4,680 posted comments.
We found no final rule, withdrawal or new proposal for RIN 0945-AA22 in the Federal Register as of September 25, 2026. The only later Federal Register document indexed to 45 CFR Part 164 concerns something else (a January 14, 2026 notice of Tribal consultation on a separate Privacy Rule proposal).
What did change is the timetable. In the Spring 2025 Unified Agenda, the rule sat at the "Final Rule Stage" with final action listed for May 2026. In the 2026 Unified Agenda, posted on reginfo.gov in July 2026 and introduced in the Federal Register on August 14, 2026, it moved to "Long-Term Actions" with final action listed for July 2027.
The Agenda defines long-term actions as items "for which the agency does not expect to have a regulatory action within the 12 months after publication". Agenda dates are estimates, and the rule has no legal deadline.
| Date | Event | Status |
|---|---|---|
| December 27, 2024 | OCR issues the proposed rule | Proposed |
| January 6, 2025 | Published in the Federal Register, 90 FR 898 | Proposed |
| March 7, 2025 | Comment period closes | Proposed |
| Spring 2025 Unified Agenda | Final Rule Stage, final action listed for May 2026 | Proposed |
| 2026 Unified Agenda (July 2026) | Long-Term Actions, final action listed for July 2027 | Proposed |
| September 25, 2026 | No final rule published | Proposed |
What would the proposed rule change?
It would rewrite most of Subpart C. HHS called it an update "for the first time since 2013". The main proposals, checked against the text of the proposed rule, are these.
| Proposal | What the proposed text says | Proposed section |
|---|---|---|
| End the addressable category | Every implementation specification would be required, some with their own narrow exceptions; HHS describes this as "removing the distinction between required and addressable" | 164.306 |
| Asset inventory and network map | A written technology asset inventory and network map, reviewed at least once every 12 months and after changes | 164.308(a)(1) |
| Encryption | Encrypt all ePHI "at rest and in transit, with limited exceptions" | 164.312(b) |
| Multi-factor authentication | MFA on relevant electronic information systems, with narrow documented exceptions | 164.312(f) |
| Vulnerability scans and penetration tests | Scans at least every six months; penetration testing at least once every 12 months by a qualified person | 164.312(h) |
| Patching | Critical risks patched within 15 calendar days and high risks within 30, where a patch is available | 164.308(a)(4) |
| Restoration | Written procedures to restore critical systems and data "within 72 hours of the loss" | 164.308(a)(13) |
| Compliance audit | An audit of compliance with every standard and implementation specification at least once every 12 months | 164.308(a)(14) |
| Business associate verification | Written verification from each business associate, at least once every 12 months, that it has deployed the technical safeguards | 164.308(b) |
| Contingency plan notice | Business associates report activation of their contingency plan within 24 hours | 164.314 |
| Access changes | Notice to other regulated entities within 24 hours when a workforce member's access changes or ends | 164.308(a)(9) |
The proposal also requires written policies and procedures that are reviewed and tested on a schedule, and it adds a longer transition period for updating existing business associate agreements. HHS estimated first-year costs of about $9 billion and about $6 billion a year in years two through five.
None of this is in force. A final rule could keep, change or drop any item, and HHS has said nothing official about which.
When would a final rule have to be met?
Not straight away. Under the proposal, a final rule would take effect 60 days after publication, and regulated entities would then have the standard 180-day compliance period in 45 CFR 160.105, a total the proposal itself puts at 240 days. If HHS published in July 2027, that would put compliance in early 2028.
That arithmetic assumes the final rule keeps the proposed timing, which it may not.
What does the Security Rule require today?
The rule in force is 45 CFR Part 164, Subpart C. According to the eCFR amendment history we checked on September 25, 2026, sections 164.302 to 164.318 have not been changed in substance since 2013: the Omnibus Rule (78 FR 5566, January 25, 2013) and, for 164.314, a June 7, 2013 technical correction (78 FR 34266). A 2020 eCFR entry for 164.314 is a formatting change only.
Under 164.306(d), implementation specifications are either "Required" or "Addressable". For an addressable one, an entity must assess whether it is reasonable and appropriate, then implement it, or document why not and implement "an equivalent alternative measure if reasonable and appropriate." Encryption is still addressable today, both for stored ePHI (164.312(a)(2)(iv)) and in transmission (164.312(e)(2)(ii)).
The risk analysis at 164.308(a)(1)(ii)(A) is required: "an accurate and thorough assessment of the potential risks and vulnerabilities" to ePHI. OCR continues to enforce it.
Its resolution agreement with OSF Healthcare System, signed July 1, 2026 and announced July 29, 2026,, after a ransomware attack, lists failure to conduct an accurate and thorough risk analysis first among the covered conduct. Documentation must be kept for six years under 164.316(b)(2).
What other HIPAA changes took effect in 2025 and 2026?
Two, and one that was undone.
Notice of Privacy Practices. The April 2024 reproductive health privacy rule (89 FR 32976) also changed the notice requirements in 164.520, partly to align with the revised 42 CFR Part 2. On June 18, 2025, the U.S. District Court for the Northern District of Texas vacated most of that rule in Purl v. HHS.
OCR says the court vacated only 164.520(b)(1)(ii)(F), (G) and (H) of the notice changes, and that "the remaining modifications to the NPP requirements are undisturbed and remain in effect", with compliance "required by February 16, 2026."
42 CFR Part 2. The February 2024 final rule aligning substance use disorder record confidentiality with HIPAA required compliance "by February 16, 2026", according to the HHS fact sheet updated January 30, 2026. It brings Part 2 penalties, breach notification and patient notice closer to the HIPAA Rules.
Reproductive health privacy protections. The rest of the 2024 rule, including the attestation requirement, was vacated nationwide by the same order. The eCFR still displays that text because no rule has removed it, so the text on eCFR is not a guide to what is enforceable here.
One more rulemaking is moving. A final Privacy Rule on coordinated care and individual engagement (RIN 0945-AA00, first proposed in January 2021) is under review at the Office of Information and Regulatory Affairs, received April 2, 2026. It is not published and has no effect yet.
What are others saying?
These are the pieces we found best argued. Each takes a position of its own, and none of them is the basis for a fact in this article; every fact rests on the sources listed below.
Brent Hoard and Emma Trivax of Troutman Pepper Locke read HIPAA's rulemaking history as a guide to what comes next. Their most likely outcome is a final rule in July 2027 "in materially revised form", and the next most likely a single combined release with the pending Privacy Rule changes. They consider it least likely that the rule is finalized exactly as proposed.
A coalition of provider groups and health systems, including CHIME, the American Medical Association and the AAMC, asked HHS to withdraw the proposal "without further consideration". They argue it would impose "substantial new financial burdens" and unreasonable timelines, and ask for cybersecurity standards developed with providers instead.
Dianne Bourque of Holland & Knight notes that while OCR presented the proposal as mostly adding detail to existing requirements, it marked significant changes and drew criticism from providers. How the administration will respond is unclear, she writes, and "it appears that we may have to wait another year to find out."
HIPAA Security Rule Amendments Now Projected for July 2027 (Holland & Knight, July 6, 2026) ↗
What we could not verify
Whether HHS intends to finalize the Security Rule largely as proposed, revise it, or withdraw it. No HHS statement on direction has been published since the 2026 Unified Agenda entry, and OCR's own proposed rule page was last reviewed on December 27, 2024.
The exact release date of the 2026 Unified Agenda on reginfo.gov. Law firm alerts dated July 6 and July 16, 2026 already cite it, and its Federal Register introduction is dated August 14, 2026.
How OCR is enforcing the Part 2 compliance date in practice. We confirmed the date from HHS, but not the details of any enforcement program announced around it.
Need a hand implementing it?
Find a consultant for HIPAA
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.
What people ask.
Is the new HIPAA Security Rule in effect?
No. It was proposed on January 6, 2025 and has not been finalized. The Security Rule in 45 CFR Part 164, Subpart C, as amended in 2013, is the rule in force.
Is encryption required under HIPAA today?
Under the current rule, encryption is an addressable implementation specification. An entity must implement it if reasonable and appropriate, or document why not and implement an equivalent alternative if reasonable and appropriate. The proposal would make it mandatory with limited exceptions.
When will the final Security Rule be published?
The 2026 Unified Agenda lists July 2027 for final action, as a long-term action. That is an agency estimate, not a deadline.
Did the Notice of Privacy Practices change?
Yes. The remaining changes to 164.520 from the 2024 rule, after the June 18, 2025 court order, had a compliance date of February 16, 2026, according to OCR.
Is the reproductive health privacy rule still in force?
Most of it is not. A federal court in Texas vacated it nationwide on June 18, 2025. Only the notice of privacy practices changes not struck by the court remain.
What each one is doing here.
Federal Register, HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, proposed rule, 90 FR 898, January 6, 2025Reginfo.gov, Unified Agenda entry for RIN 0945-AA22, 2026 editionReginfo.gov, Unified Agenda entry for RIN 0945-AA22, Spring 2025Federal Register, Introduction to the Unified Agenda of Federal Regulatory and Deregulatory Actions, 2026, August 14, 2026HHS OCR, HIPAA Security Rule NPRM pageRegulations.gov, docket HHS-OCR-2024-0020eCFR, 45 CFR Part 164, Subpart C, and its amendment historyHHS OCR, HIPAA and Reproductive Health page, content last reviewed June 27, 2025HHS, Fact Sheet 42 CFR Part 2 Final Rule, updated January 30, 2026HHS OCR, OSF Healthcare System Resolution Agreement and Corrective Action Plan, signed July 1, 2026, announced July 29, 2026Reginfo.gov, OIRA EO 12866 review, HIPAA Privacy Rule: Changes to Support Coordinated Care and Individual Engagement and Reduce Regulatory Burdens (RIN 0945-AA00)Federal Register, Tribal Consultation on Proposed Modifications to the HIPAA Privacy Rule, January 14, 2026
What has changed on this page.
Changes
Corrections
None so far.
Found something wrong? [email protected]. We check it against the source, fix it, and record it here with the date.