The last time the HIPAA Security Rule got a meaningful update, most practices weren’t using cloud-based systems and Telehealth was still a novelty. That was 2013. Now, a proposed overhaul expected in May 2026 would eliminate the old “addressable” loophole entirely, require encryption and multi-factor authentication across the board, and force healthcare providers to conduct regular vulnerability assessments. If your practice handles patient data, these changes deserve your attention well before the final rule drops.
Key Highlights
A significant overhaul to the HIPAA Security Rule is anticipated in May 2026, bringing stricter security compliance measures for healthcare organizations across the board. This update is designed to modernize how patient data is protected against the threats that exist today. For practices in southeastern Pennsylvania and New Jersey, getting familiar with these new requirements now will make the transition far less painful.
Here are the key takeaways from the proposed rule:
- The distinction between “required” and “addressable” (meaning optional with the right documentation) safeguards is being eliminated. All technical safeguards become mandatory.
- Multi-factor authentication will be an explicit requirement for every system that touches electronic protected health information.
- Encryption of ePHI (patient data), both stored and in transit, becomes a non-negotiable standard.
- Regular vulnerability scanning will be required as part of ongoing cybersecurity compliance.
- A new 72-hour restoration requirement for critical systems following an incident will be enforced.
What’s Driving the Change
The current HIPAA Security Rule was written for a completely different environment. Cloud computing wasn’t standard practice, telehealth barely existed, and ransomware wasn’t showing up in inboxes daily. The Department of Health and Human Services (HHS) clearly sees that the digital landscape has moved on, and the proposed rule expected in May 2026 is a direct response. The goal is to bring security rules in line with how healthcare organizations use electronic health information systems right now.
This isn’t happening in a vacuum, either. The HHS Office for Civil Rights has already been telegraphing the direction through its recent enforcement actions, which consistently target the same weak points: incomplete risk assessments, poor access controls, and missing encryption. On top of that, an active OCR enforcement audit wave is targeting 50 covered entities and business associates right now. They aren’t waiting around for the final rule to start holding people accountable.
These 2026 HIPAA security rule updates essentially formalize what regulators have already been expecting, stripping out any remaining ambiguity for every covered entity and business associate. For small business owners and operations managers in the healthcare sector, the takeaway is straightforward: start preparing now.
Understanding the Elimination of ‘Addressable’ Safeguards
For years, the HIPAA Security Rule gave healthcare organizations some flexibility with certain security measures labeled as “addressable.” In practice, that meant you could skip a specific safeguard if you documented a valid reason and pointed to an alternative. That flexibility, however, is going away under the proposed changes.
The shift simplifies things: all administrative, physical, and technical safeguards become mandatory. There’s no more documenting your way around a safeguard that regulators now consider foundational. This move from addressable specifications to required status is one of the most significant HIPAA security rule changes in the rule’s entire history. And it applies to all businesses, from a small dental clinic in Bucks County to a large, national healthcare system.
Key areas that were commonly treated as “addressable” and will now be required include:
- Encryption: All ePHI, whether at rest on a server or in transit over a network, must be encrypted.
- Audit Controls: Mechanisms to record and examine activity in electronic information systems must be operational.
- Access Controls: Procedures to verify a person’s identity before granting access to ePHI become stricter.
New Technical Standards: HIPAA Encryption Mandate Explained
One of the most consequential 2026 HIPAA security rule updates is the explicit mandate for encryption of ePHI. Previously, encryption was an “addressable” technical control. The proposed rule requires encryption for all electronic protected health information. This applies to data whether it’s “at rest” (stored on servers, laptops, or backup drives) or “in transit” (being sent via email or moving across a network).
What Encryption Means for ePHI and Practice Networks
So what does mandatory encryption of ePHI look like on a day-to-day basis? It starts with knowing where your electronic protected health information lives. That means conducting a thorough security risk assessment to identify every device and system — from servers and workstations to laptops and mobile phones — that creates, receives, maintains, or transmits ePHI. Without that inventory, there’s simply no way to confirm everything is properly encrypted.
Building a network map is a critical part of this process, too. It shows how data flows through your electronic information systems and highlights places where data might be unencrypted. For instance, are you using a secure, encrypted email service for all patient communication? Are the laptops staff use encrypted? These are specific questions that need real answers before a compliance deadline arrives.
Ultimately, this requirement pushes you toward a more deliberate approach. Rather than reacting after a breach, you build security into the infrastructure itself. That includes evaluating your cloud services, like Microsoft 365, to confirm they’re configured for maximum protection of electronic protected health information. A trusted IT consulting partner can help you work through these technical requirements and find right-fit configurations.
HIPAA MFA Requirement: Multi-Factor Authentication as a Must
The proposed 2026 HIPAA security rule will also make multi-factor authentication a mandatory access control. The current rule requires you to verify a person’s identity, but it doesn’t explicitly require MFA. That changes under the update. Single-factor authentication — such as a password prompt — will no longer be sufficient for accessing systems that contain ePHI. MFA adds a necessary layer by requiring two or more verification factors, which dramatically reduces the risk of unauthorized access from stolen or compromised credentials.
Implementing MFA across your organization is one of the most effective steps you can take to strengthen your current security posture. It defends against common attacks like phishing that aim to steal login information.
Vulnerability Assessments
The upcoming HIPAA Security Rule changes are also expected to formalize the need for active security testing. While a risk assessment identifies theoretical vulnerabilities on paper, vulnerability assessments actively test your infrastructure the way a real attacker would.
A vulnerability scan is an automated process that searches your network and systems for known security weaknesses — things like unpatched software or misconfigured settings.
Preparing for Vulnerability Assessments
Think of vulnerability scanning as a regular checkup for your IT infrastructure. It finds problems before they’re exploited. We recommend to our clients that they integrate this process into their annual security risk assessment.
To get started, your security measures should include:
- Comprehensive Asset Inventory: You can’t scan what you don’t know you have. Maintain a complete list of all devices and software on your network.
- Regular Scanning Schedule: Establish a routine for scanning your systems, such as quarterly or after any significant change to your IT environment.
- Remediation Plan: Create a process for prioritizing and fixing the vulnerabilities discovered during scans.
New Recovery Standards: 72-Hour Restoration Requirement
Beyond prevention, the 2026 HIPAA security rule updates also focus heavily on resilience. A new 72-hour restoration requirement for critical systems is expected to be introduced. In the event of a cyberattack or other disaster, healthcare organizations must be able to restore access to ePHI and resume critical operations within that window. That’s a demanding standard, and it requires a well-tested incident response and disaster recovery plan — not a document that sits in a drawer collecting dust.
For health systems and smaller practices alike, this rule puts a spotlight on whether your backup and recovery setup works. Is your backup system tested regularly? Do you know which systems are critical for patient care and which can wait? Answering those questions honestly is the first step.
Conclusion
The upcoming 2026 HIPAA Security Rule overhaul will bring meaningful changes that healthcare practices need to start preparing for now. With all safeguards shifting to mandatory status, explicit new requirements for multi-factor authentication and encryption, and vulnerability assessments becoming standard, this represents a different chapter in HIPAA compliance altogether.
Understanding these proposed changes and their practical implications is how you avoid scrambling later. By taking concrete steps today — such as running a security risk assessment, building a network map, and deploying MFA — you put your practice in a much stronger position. If you want help figuring out where your practice stands, let’s talk about what your setup actually needs.
Frequently Asked Questions
Will there be new legal risks under the 2026 HIPAA Security Rule updates? Yes. With more specific and mandatory new requirements, legal exposure for non-compliance goes up. Eliminating the “addressable” category makes it simpler for the Department of Health and Human Services to flag violations. Recent enforcement actions already show regulators tightening oversight, and the final rule will only accelerate that trend.
How do the 2026 HIPAA Security Rule changes differ from previous years? This isn’t a minor tweak. The 2026 HIPAA security rule updates represent a fundamental shift in the expectation for healthcare providers to protect patient data. Previously optional security measures like encryption and MFA are now mandatory, and the flexibility around addressable safeguards disappears entirely. It’s the most significant overhaul since the rule was first introduced.
Is the Office for Civil Rights already auditing entities ahead of the 2026 rule changes? Yes. An active audit wave is currently targeting 50 health care entities and business associates to evaluate their current security posture. That tells you enforcement isn’t sitting idle while the proposed rule gets finalized. OCR is already holding organizations to standards that closely mirror what the new rule will require.
