If you build, buy, or run software that touches patient data, you’ve probably been waiting on the HIPAA Security Rule update. HHS proposed it in January 2025. It was the first real rewrite since 2013, and the last official estimate had it finalized by May 2026.
That date is gone. The 2026 Unified Agenda, the federal government’s schedule of planned rules, moved the update to its long-term list and now projects July 2027 for final action. HHS hasn’t said why. The proposal drew more than 4,000 public comments, and a lot of them were about cost.
It’s tempting to read that as another year off. We’d read it the other way.
This isn’t legal advice, and your compliance counsel should weigh in on what applies to you. But most of what’s in the proposal is technical work, and that’s the part worth starting now.
What the Proposal Would Require
The proposed rule is long, but the main changes are easy to list. Covered entities and business associates would have to:
- Use multi-factor authentication and encrypt patient data, with fewer exceptions than today
- Keep a written inventory of their technology assets and a map of their network
- Treat every safeguard as required, ending the split between “required” and “addressable”
- Review their risk analysis at least once every 12 months
- Run penetration tests every 12 months and vulnerability scans every six
- Have written procedures to restore key systems and data within 72 hours
- Get written confirmation from business associates, at least once a year, that their safeguards are in place
None of that is exotic. MFA, encryption, asset inventories, and tested backups are things a security team would ask for anyway. The proposal mostly takes what’s already considered good practice and makes it mandatory.
The Current Rule Is Still Being Enforced
The delay only applies to the new requirements. The existing Security Rule is still in force, and the Office for Civil Rights is still enforcing it.
In April 2026, OCR announced settlements with four organizations after separate ransomware attacks: a women’s health network, a medical imaging company, a benefits administrator, and a self-funded health plan. Together they affected more than 427,000 people and cost over $1 million in settlements, plus two years of OCR monitoring. All four had failed to do an accurate and thorough risk analysis, a requirement that has been in the rule for years.
Look at the dates, too. Those breaches happened in 2020 and 2021. The settlements came out in 2026. Enforcement runs years behind the incident, so the shortcuts you take this year are the ones that get reviewed later, possibly under whatever rule is in place by then.
Why Waiting Costs More
Retrofitting is harder than building it in. Adding MFA to a system that was designed around a single shared login, or encrypting data in a database that wasn’t set up for it, is real engineering work. It’s much cheaper to do when you’re already touching that code than as a rushed project with a compliance date attached.
Everyone will be rushing at once. When a final rule lands, there’s usually a compliance window, and every covered entity and business associate will be competing for the same consultants, auditors, and developers. Work that takes a quarter now can take two when the whole industry is doing it at the same time.
Your customers won’t wait for HHS. Hospitals and larger practices already send security questionnaires to their vendors, and those questionnaires ask about MFA, encryption, and recovery times. If you sell software into healthcare, you’re answering these questions today, rule or no rule.
The asset inventory is the hard part. Most organizations can’t produce a full list of the systems that touch patient data, and that’s the starting point for everything else. If the only person who knows where everything lives is one engineer, you have the problem we wrote about in what happens when the one developer who knows the system leaves.
Where to Start
You don’t need to implement the whole proposal this quarter. Pick the pieces that are hard to retrofit and useful no matter what the final rule says:
- Build the inventory. List every system, vendor, and integration that stores or moves patient data. Note who owns each one.
- Turn on MFA everywhere it’s missing. Admin consoles, cloud accounts, remote access, and anything else that can reach patient data.
- Check encryption at rest and in transit. Find the databases, backups, and file shares that aren’t covered.
- Test a restore. Pick one critical system and see how long it actually takes to bring it back. Compare that to 72 hours.
- Update your risk analysis. It’s the finding OCR keeps citing, and every other step feeds into it.
If you’re planning next year now, put this on the budget as its own line. We made the same point in what usually gets left out of a 2027 software budget: security work planned in advance costs less than security work done in a hurry.
The Bottom Line
July 2027 is an estimate, not a deadline, and the final rule could still change. But the core requirements line up with what auditors, insurers, and your own customers already expect. Treat the extra time as a head start, not a reprieve.
If you want help finding the gaps in your systems before a final rule does, here’s how we approach security work, and you can start a conversation with us.