Stay Ready for the Upcoming HIPAA Security Rule Updates

June 12, 2026

Stay Ready for the 2026 HIPAA Security Rule Updates — ✦ —

Update (July 2026): The proposed HIPAA Security Rule changes discussed below have been delayed. Federal regulators now list final action for 2027, and the requirements may change before finalization. Read our latest update:
HIPAA Security Rule Update Delayed to 2027: What Your Practice Should Actually Do Now.
The current HIPAA Security Rule remains fully in effect.

Healthcare organizations are facing increased pressure to strengthen cybersecurity as ransomware attacks, data breaches, and other cyber threats continue to target sensitive patient information. In response, the Department of Health and Human Services (HHS) has proposed major updates to the HIPAA Security Rule that could become effective in 2027. (The proposed changes to the HIPAA Security Rule are still under review and final action is now expected in 2027. Healthcare organizations can still benefit from preparing now, but the proposed requirements are not yet in effect.) If finalized, these changes would represent one of the most significant HIPAA security updates in more than two decades.

Mandatory Encryption Requirements

One of the biggest proposed changes is stronger encryption for electronic protected health information (ePHI). Organizations may be required to encrypt patient data both at rest and in transit to reduce the risk of unauthorized access. Healthcare providers, business associates, and related organizations should review their current encryption practices now to identify gaps before the new requirements take effect.

Multi-Factor Authentication and Risk Assessments

The proposed HIPAA Security Rule updates also place greater emphasis on multi-factor authentication (MFA) for systems that access ePHI. MFA helps reduce the risk of unauthorized logins, especially when passwords are compromised. In addition, annual risk assessments may become a key requirement, helping organizations identify vulnerabilities, document security risks, and develop plans to address them.

Penetration Testing and Incident Response Planning

Healthcare organizations may also need to complete regular penetration testing and vulnerability scanning to evaluate their security defenses. These tests help uncover weaknesses before attackers can exploit them. Stronger incident response planning is also expected, which means organizations should have clear procedures for detecting, responding to, and recovering from cybersecurity incidents.

Why Healthcare Organizations Should Prepare Now

Waiting until 2027 could create unnecessary compliance challenges. Implementing encryption, MFA, annual risk assessments, penetration testing, and incident response plans takes time, planning, and the right IT support. By preparing early, healthcare organizations can strengthen patient data protection, reduce cybersecurity risks, and improve readiness for upcoming HIPAA requirements.

The upcoming HIPAA Security Rule changes could bring major cybersecurity updates for healthcare organizations, including mandatory encryption, MFA, annual risk assessments, penetration testing, and stronger incident response requirements. Preparing now can help healthcare providers and business associates avoid last-minute compliance issues while building a safer environment for patient data.