New HIPAA Security Rule: 2026 Status, the 2027 Delay, and What Would Change
HIPAA Compliant Hosting · https://hipaacomplianthosting.com/blog/new-hipaa-security-rule
Last updated: October 20, 2026. This page tracks the rulemaking and is updated as the status changes.
The new HIPAA Security Rule is not final, and its target has slipped to July 2027. HHS proposed the first major Security Rule update since 2013 on January 6, 2025. The public comment period closed on March 7, 2025, with about 4,700 comments. HHS had aimed for a final rule around May 2026. That date has moved. The Office of Management and Budget (OMB) now lists July 2027 as the target. Until a final rule comes out, the current Security Rule still governs. Every change below is still just a proposal, and proposals can change. Here is where things stand, what would change, the clock that starts when it becomes final, and what to do with the extra time.
TL;DR: Quick answer
Status as of October 2026: proposed, not final. The current Security Rule (45 CFR Part 164, Subpart C) still applies, unchanged.
The final rule target moved from May 2026 to July 2027 on the OMB agenda. Dates like this shift often. Treat it as a target, not a promise.
A second track opened in Congress. S. 3315, the Health Care Cybersecurity and Resiliency Act, passed the Senate on September 30, 2026. It now waits in the House, held at the desk since October 5, and is not law. If enacted, it would order HHS to require MFA, encryption and security testing, which this proposal also contains.
The biggest change: the "addressable" label goes away. Encryption and multi-factor authentication (MFA) would become required, full stop.
Also proposed: written asset lists and network maps, network segmentation, yearly audits, yearly penetration tests, a 72-hour recovery deadline, and tighter checks on Business Associates.
Once a final rule comes out, you get about 240 days to comply. Every proposed control is already best practice today, so teams that build to the strong reading of the current rule have far less to retrofit.
Where the new HIPAA Security Rule stands right now
Milestone | Date | Status |
|---|---|---|
Proposed rule (NPRM) published in the Federal Register | January 6, 2025 | Done |
Public comment period closed (about 4,700 comments) | March 7, 2025 | Done |
Original final-rule signal | ~May 2026 | Missed |
Current OMB target for final action | July 2027 | Projected |
Compliance deadline after publication | ~240 days after the final rule | Estimated |
The current agenda files the rule under long-term actions. That section is for rules whose next step is expected more than 12 months after the agenda comes out. The delay is normal. Big HHS rules slip often. The comment pile was heavy, and the proposals reach deep into how healthcare systems run. But the delay changes nothing about today. OCR still enforces the current rule, and its risk-analysis push keeps producing settlements while everyone waits. The enforcement record is in our guide to HIPAA violation fines and penalties.
Congress has since opened a second track toward the same controls. On September 30, 2026, the Senate passed S. 3315, the Health Care Cybersecurity and Resiliency Act, by unanimous consent. The House received it on October 5, 2026, and it is held at the desk. It is not law: the House has not voted, and the President has not signed it. If enacted as passed, it would order HHS to require multifactor authentication, encryption of PHI, and monitoring that includes penetration testing. Those rules would take effect 36 months after enactment. Our guide to what S. 3315 would mean for HIPAA sets its text against this proposal control by control, and explains why the two tracks are separate.
What the new HIPAA Security Rule would change
Area | Today's rule | Proposed rule |
|---|---|---|
Encryption | "Addressable": use it or document an alternative (§ 164.312(a)(2)(iv), (e)(2)(ii)) | Required at rest and in transit, with narrow exceptions |
Multi-factor authentication | Not named; access control is the standard | Required for systems that touch ePHI |
"Addressable" label | Applies to many safeguards | Goes away; those safeguards become required |
Asset list and network map | Implied by the risk analysis | Written, explicit, and kept current |
Network segmentation | Not named | Required, to stop attackers from moving between systems |
Audits and testing | Periodic evaluation (§ 164.308(a)(8)) | Yearly compliance audits, yearly penetration tests, regular scans |
Incident recovery | Contingency plan standard (§ 164.308(a)(7)) | Restore key systems within 72 hours; written incident plans |
Business Associates | BAA under § 164.308(b) | Yearly checks that vendors' safeguards are real, plus new notice duties |
Proposed requirements are not law yet; the current Security Rule still applies. Read the pattern. The new HIPAA Security Rule mostly turns today's best practices into law. Nothing here is exotic. It is encryption, MFA, written lists, walls between systems, testing, and recovery discipline. That is why the advice below is boring on purpose.
The 240-day clock, and why the delay is not a break
When the new HIPAA Security Rule becomes final, the expected sequence is about 60 days until it takes effect, then about 180 days to comply. Call it 240 days total. That is a short runway if you need to retrofit encryption, roll out MFA, build asset lists, and redo vendor contracts. The July 2027 target buys planning time, not a pass. Two things stay true through the delay. The current rule is fully enforced right now. And encrypted data already earns the breach notification safe harbor today. The biggest proposed mandate pays off years before it becomes one.
What to do now, without betting on a date
Run the risk analysis first. It is required today under 45 CFR § 164.308(a)(1)(ii)(A). OCR also enforces it through its Risk Analysis Initiative, whose 14th action came in June 2026. And it doubles as your gap list for everything the proposal would require. A HIPAA website audit covers the web-facing slice.
Encrypt everything now. At rest and in transit. Treat "addressable" as required. For hosted patient data it effectively is, and the proposal would make it official.
Turn on MFA everywhere patient data can be reached: app logins, admin panels, server access. Our guide to HIPAA MFA requirements covers what applies now.
Write the list. Which systems hold ePHI, where they run, and how they connect. Put the website on that list. It is the system audits miss most.
Ask your vendors. The proposal adds yearly checks on Business Associates. So ask your host and every PHI-touching vendor how they meet today's safeguards, and what their answer to the proposed ones is.
Part of that list is infrastructure work, and a managed host can carry it. Our environments run on single-tenant AWS with encryption at rest and in transit, six-year audit logging, and tested encrypted backups today. We sign a BAA within 24 hours of signup, before patient data moves. It covers the servers and services we run.
Managed plans start at $229 per month, with 4 hours of migration and configuration included in the first month. Plans are monthly, with no long-term contract. The details are in managed HIPAA hosting. That is HIPAA compliant hosting that treats encryption as required now, as the proposal would. We sell these services, so weigh that as a disclosure. An environment built this way has less to retrofit when the final rule lands, in 2027 or later.
Frequently asked questions
Is the new HIPAA Security Rule final?
No. As of October 2026 it is still a proposed rule. The proposal published on January 6, 2025, comments closed March 7, 2025, and OMB now targets final action in July 2027. The current Security Rule applies unchanged until then.
When does the new HIPAA Security Rule take effect?
Unknown until a final rule comes out. The current target is final action around July 2027, followed by about 240 days to the compliance deadline. All of those dates can move.
What are the biggest changes in the new HIPAA Security Rule?
The "addressable" label goes away. Encryption at rest and in transit and MFA become required. Written asset lists, network segmentation, yearly audits and penetration tests, a 72-hour recovery deadline, and tighter vendor checks are added.
Does S. 3315 replace this rulemaking?
No. S. 3315 is a bill, not a rule. It passed the Senate on September 30, 2026, and now waits in the House. It is not law. If enacted, it would direct HHS to update the Security Rule with its own list of required practices and a 36-month start date. HHS's proposal is separate rulemaking under existing law. Neither text says how the two would merge.
Does the delay mean we can wait to upgrade?
Waiting is legal and unwise. The current rule is enforced now, OCR's risk-analysis push is active, and encrypted data already earns the breach notification safe harbor. Every proposed control is a best practice with benefits today.
Will the proposal change before it is final?
Possibly. HHS received about 4,700 public comments on it. Rules can be softened, phased, or dropped between proposal and final. That is why this page calls them proposals and tracks the status.
Recap: new HIPAA Security Rule
To recap, the new HIPAA Security Rule would be the first major update since 2013, and it is still a proposal. Final action is now projected for July 2027, more than a year later than first signaled. It would make encryption and MFA required and end the "addressable" label. It would also add asset lists, segmentation, yearly audits and tests, and a 72-hour recovery deadline. Expect about 240 days to comply once it is final. A separate bill, S. 3315, passed the Senate on September 30, 2026, and now waits in the House. It points at several of the same controls but is not law. Today's rule governs until then, and it is actively enforced. Build to the strong reading of today's rule and the new one becomes a much smaller lift. This page will be updated as the status changes.
This article is general information, not legal advice. Rulemaking status reflects the Federal Register and the 2026 Regulatory Plan and Unified Agenda on reginfo.gov, as read on October 20, 2026. It can change at any time. Proposed requirements are paraphrased from the NPRM and may differ in a final rule. The S. 3315 status reflects Congress.gov as read on October 20, 2026. Consult qualified counsel and base your safeguards on a documented risk analysis. We sell HIPAA compliant hosting. Reviewed October 2026.
Sources
Federal Register: HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (NPRM, Jan. 6, 2025)
45 CFR Part 164, Subpart C (current Security Rule): ecfr.gov
Unified Agenda entry for RIN 0945-AA22 (rule status and projected date): reginfo.gov
Regulations.gov: Docket HHS-OCR-2024-0020 (public comments on the NPRM)
Congress.gov: S. 3315, Health Care Cybersecurity and Resiliency Act (all actions)
HIPAA Journal: HIPAA Security Rule update postponed