HIPAA Security Rule Update: Status and What Practices Should Do

By Awais Afzal, Healthcare Operations & Data Analyst · Published February 23, 2026 · Updated October 14, 2026

The HIPAA Security Rule update is still a proposed rule, not final law. HHS published it on January 6, 2025, and the current rule stays in force. Practices should keep meeting today's risk analysis, access and vendor duties while watching for a final rule.

Many articles written in 2025 described the changes as “now required.” That was never accurate. This guide separates what is proposed from what is enforceable, gives the dates with sources, and turns the proposal into checks your billing team can run today. It is written for practice owners and billing managers.

Where the HIPAA Security Rule update stands today

The update is still a proposal. OCR issued the notice of proposed rulemaking on December 27, 2024, and it was published in the Federal Register on January 6, 2025 (Volume 90, pages 898 to 1022, RIN 0945-AA22). Comments closed on March 7, 2025. As of mid-October 2026, we found no final rule in the sources we checked, and HHS says that the current Security Rule remains in effect while rulemaking continues. See the Federal Register notice and the HHS fact sheet.

Timing is the part that keeps moving. The HHS regulatory initiatives page lists only the proposal. Law-firm and trade-press reports from July 2026 say the regulatory agenda now points to a final rule around July 2027, later than an earlier May 2026 target (HIPAA Journal, Alston and Bird). Those are secondary reports, so treat the date as a target and not a promise.

If a final rule is published, the proposal says it would take effect 60 days later, and regulated entities would have 180 days after that effective date to comply. That is roughly eight months from publication, and the final text could differ from the proposal. A separate transition period was proposed for updating business associate agreements (Federal Register text).

What the Security Rule already requires

The rule in force today already asks practices and their business associates to protect electronic protected health information (ePHI) through administrative, physical and technical safeguards. HHS’s summary of the Security Rule lists the core duties, and several of them touch billing directly.

• Risk analysis and risk management. An accurate and thorough assessment of risks to ePHI, followed by steps to reduce those risks to a reasonable and appropriate level.
• Access control and authentication. Only authorized people may reach ePHI, and the system must verify that a person is who they claim to be. Role limits should match each job.
• Audit controls. Systems must record and let you examine activity, which matters when you need to know who opened or changed a claim.
• Transmission security. Technical measures against unauthorized access to ePHI sent over a network, such as claim files going to a clearinghouse.
• Contingency planning. Backups, recovery and emergency operations, so billing can continue after an outage or attack.
• Business associate contracts. Written assurances before a vendor handles ePHI, with the vendor liable directly for Security Rule violations.
• Documentation. Required policies and records are kept for six years.

The current rule also separates “required” from “addressable” implementation specifications. For an addressable item, the entity decides whether it is reasonable and appropriate. If it is, the item must be implemented. If not, the entity documents why and adopts an equivalent measure where one is reasonable. That flexibility is one of the things the proposal would narrow.

What the proposed update would change

The proposal would turn much of today’s flexible, risk-based approach into specific mandatory controls. These items come from the HHS fact sheet; the final rule could add, drop or reword any of them.

Source: HHS OCR, HIPAA Security Rule NPRM fact sheet (December 2024) and Summary of the HIPAA Security Rule.

What it means for billing and the revenue cycle

A security incident is a billing problem first. If staff cannot open the practice management system, claims do not go out, remittances cannot be posted and follow-up stops. The proposal’s 72-hour restoration idea is, in practice, a question about how long your billing can stand still.

The billing data path is wide. Patient demographics, insurance details and diagnosis and procedure codes move between your EHR, your billing team, a clearinghouse and payer portals. Each hop is a place where access, encryption and logging matter. Our guides on how clearinghouses manage medical claims and HIPAA compliance in medical billing cover the workflow detail.

Where practices usually have gaps

• Shared logins on payer portals or billing software, so the audit trail cannot say who did what.
• Former staff, temps or remote billers whose access was never removed.
• Claim exports and remittance files saved on desktops, in email or on personal drives.
• A billing vendor with ePHI access but no current business associate agreement or security review on file.
• Backups that exist but have never been tested for restoring billing data.
• Front-desk habits that expose ePHI, such as voicemail and video-call practices. See our front-desk HIPAA guidelines and HIPAA-compliant voicemail guide.

What non-compliance can cost under today's penalty rules

HIPAA civil money penalties are tiered by the level of culpability, and the dollar amounts are adjusted for inflation each year. The older figure of “$1.5 million per violation” is not accurate as a general statement. The 2026 Federal Register inflation adjustment sets these amounts for 45 CFR 160.404 (Federal Register, January 28, 2026).

Source: HHS, Annual Civil Monetary Penalties Inflation Adjustment, 91 Fed. Reg. (January 28, 2026). Amounts apply to penalties assessed on or after that date for violations on or after November 2, 2015.

These are maximums set in rule, not what a typical practice pays, and they do not include breach notification costs, lost billing days or state law exposure. They do show why a documented risk analysis matters. In an April 25, 2025 settlement announcement, OCR described its Risk Analysis Initiative and said it found the organization “failed to conduct an accurate and thorough risk analysis” (HHS OCR press release).

A practical plan for billing operations before any final rule

Do the work that is required now and that would also satisfy most of the proposal. It costs little to start, and nothing here depends on the final text. Our HIPAA compliance checklist for medical practices gives the full practice-wide list. Use the table below for the billing side.

Questions to ask billing vendors and software providers

Any vendor that creates, receives, maintains or transmits ePHI on your behalf is a business associate. Ask the questions below in writing and keep the answers with your risk analysis. Our guide to choosing a medical billing company covers the commercial side.

• Will you sign a Business Associate Agreement before accessing any patient data, and how do you handle subcontractors?
• Which staff can see our claims, and are logins individual with multi-factor sign-in?
• Is there an audit log that shows who viewed or changed a claim, and can we see it?
• How is data encrypted in transit and at rest?
• How and how often do you test backups, and how fast can you restore?
• How do you notify us of a security incident, and how quickly?

Be careful with phrases such as “HIPAA certified.” Judge a vendor by its written answers and contract terms, not by a badge. If you are weighing outsourced billing, our medical billing services and revenue cycle management pages describe what we offer, and the free audit is the place to start.

A system built for billing can help with the access side. A practice management system that tracks claims by stage should offer role-based permissions and an audit log, so that each claim has a named owner and a record of who touched it. Specialty practices with unusual billing flows can start from our specialty billing pages.

How to track the rule without chasing every headline

Rely on primary sources. Check the HHS OCR HIPAA regulatory initiatives page and the Federal Register entry for RIN 0945-AA22 (the rule’s docket number). A final rule will appear in the Federal Register with an effective date and a compliance date. Until then, headlines that say a requirement is “now in effect” should be read as claims to verify.

Set a calendar reminder to review the status every quarter, and update your risk analysis whenever you add a system, vendor or remote billing arrangement. Keep a short note of what you checked and when. That record is useful whatever the final rule says.

Our recommendations

1. Run or refresh your risk analysis. Include billing software, the clearinghouse, payer portals and anywhere claim files are exported. Date it, sign it and store it with your policies.
2. Remove shared logins. Give every biller a unique login and turn on multi-factor sign-in wherever a system offers it. This is good practice now and would match the proposal.
3. Tighten roles and offboarding. Limit each user to the screens and claims their job needs, and remove access the day someone leaves.
4. Map where ePHI lives. List each system and file location that holds patient and claim data, and sketch how data moves between them.
5. Test a billing restore. Restore a copy of billing data from backup, time it and write down the gaps. The 72-hour idea is a useful benchmark even before it is a rule.
6. Collect vendor assurances in writing. Confirm a signed Business Associate Agreement and ask the security questions above for every vendor that touches ePHI.

Bottom line

The HIPAA Security Rule update may tighten requirements, but your obligations already exist and billing is where much ePHI moves. Start with a risk analysis, unique logins and vendor assurances. If you want a second reader on how claims flow through your practice, see our revenue cycle management service and ask for the free audit.

Frequently asked questions

Is the proposed HIPAA Security Rule update final?

No. As of October 2026 we found no final rule in the sources we checked. HHS published the proposal on January 6, 2025, comments closed March 7, 2025, and HHS says the current Security Rule remains in effect. Reports from July 2026 point to a possible final rule around July 2027, which is a target only.

Is multi-factor authentication required under HIPAA right now?

HHS’s summary of the current rule does not name a multi-factor mandate. The January 2025 proposal would require it with limited exceptions. The current rule does require authentication and access controls, so using multi-factor sign-in is sensible now, but check your own risk analysis.

When would practices have to comply if the rule is finalized?

The proposal says a final rule would take effect 60 days after publication, with compliance 180 days after the effective date, plus a separate transition for business associate agreements. That is about eight months from publication. The final text could change those periods.

What is the maximum HIPAA penalty?

It depends on the tier and the year. Under the January 28, 2026 inflation adjustment, per-violation amounts run from $145 to $73,011 for the first three tiers, up to $2,190,294 for willful neglect not corrected within 30 days, with a $2,190,294 calendar-year cap for identical violations.

Does a small practice need to do anything before a final rule?

Yes. The risk analysis, access control, audit control, contingency plan and business associate agreement duties apply to practices of every size today. Starting with the billing-side checks in this article also puts you closer to the proposal if it is finalized.

Does my billing company have to follow the Security Rule?

Yes. A billing company that handles ePHI for you is a business associate and is directly liable for Security Rule violations. You still need a written business associate agreement and should ask about its safeguards.

Sources

1. HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (NPRM) — HHS OCR via Federal Register (2025)
2. HIPAA Security Rule NPRM fact sheet — HHS OCR (2024)
3. Summary of the HIPAA Security Rule — HHS OCR (2026 (accessed 2026-10-17))
4. HIPAA regulatory initiatives — HHS OCR (2025)
5. Annual Civil Monetary Penalties Inflation Adjustment — HHS via Federal Register (2026)
6. OCR Risk Analysis Initiative settlement announcement — HHS Press Room (2025)
7. Final Rule Implementing HIPAA Security Rule Updates Edges Closer — HIPAA Journal (secondary) (2026)
8. HHS delays HIPAA Security Rule to 2027 — Alston and Bird (secondary) (2026)