Topic analysis

2026 HIPAA Security Rule Update

The 2026 HIPAA Security Rule, set to take effect following finalization in May 2026 after its January 2025 Federal Register publication, mandates new requirements for healthcare covered entities and business associates including annual security risk assessments, universal encryption of electronic protected health information (ePHI), multi-factor authentication for all ePHI-accessing systems, regular vulnerability scanning, and expanded compliance documentation. The guidance outlines preparation steps for organizations of all sizes, notes projected industry compliance costs of ~$9 billion in the first year, and confirms OCR will offer leniency for resource-constrained providers that demonstrate documented good-faith phased compliance efforts.