HIPAA

HIPAA's Privacy, Security and Breach Notification Rules (45 CFR Parts 160 and 164) set the federal floor for protecting health information in the United States.

The Security Rule requires covered entities and their business associates to protect electronic protected health information through administrative, physical and technical safeguards, starting with an accurate and thorough risk analysis.

The Privacy Rule governs uses and disclosures and individual rights; the Breach Notification Rule requires notice to individuals, HHS and sometimes the media after a breach of unsecured PHI.

HHS proposed a major Security Rule update on January 6, 2025 (comments closed March 7, 2025); the final rule has not been issued, the 2026 Unified Agenda lists it as a long-term action with final action in July 2027, and the current rule remains in force.

HIPAA is a documentation regulation. Organizations must keep written policies and procedures for every standard, retain them and related records for six years, document the risk analysis and risk management plan, sign business associate agreements, train the workforce and keep records, designate privacy and security officials, apply sanctions and record them, and keep incident and breach logs.

OCR settlements in 2025 and 2026 frequently cite failure to conduct an accurate and thorough risk analysis (45 CFR 164.308(a)(1)(ii)(A)).

Other recent changes: on June 18, 2025 a federal court in Texas (Purl v. HHS) vacated most of the 2024 reproductive health privacy rule; the remaining Notice of Privacy Practices changes and the 42 CFR Part 2 rule, which aligns substance use disorder records with HIPAA, both had a compliance date of February 16, 2026; and a final Privacy Rule on coordinated care and individual engagement (RIN 0945-AA00) has been under White House review since April 2, 2026.