What changed in the 2026 HIPAA Security Rule update?

The 2026 update introduces mandatory encryption for ePHI at rest and in transit, required vulnerability scanning and penetration testing, network segmentation requirements, 72-hour incident notification to HHS, and elimination of the distinction between required and addressable specifications.

When do the new HIPAA Security Rule requirements take effect?

The final rule was published in early 2026, with most organizations given a compliance deadline within 180 days to one year depending on the specific requirement and organization size.

Does the 2026 HIPAA update require encryption?

Yes. The 2026 Security Rule update makes encryption of electronic protected health information (ePHI) mandatory both at rest and in transit, removing the previous addressable designation that allowed organizations to use alternative measures.

2026 HIPAA Security Rule Update: New Requirements to Prepare For

2026 HIPAA Security Rule Update: New Requirements Every Healthcare Organization Must Prepare For

Quick Answer: The 2026 HIPAA Security Rule update introduces significant changes including mandatory encryption of ePHI at rest and in transit (removing the “addressable” designation), required multi-factor authentication for all systems accessing ePHI, 72-hour incident reporting requirements, annual penetration testing, and enhanced business associate oversight obligations. These changes, proposed by HHS in late 2025, represent […]

HIPAA Compliance for Generative AI: What Healthcare Organizations Must Know

Quick Answer: HIPAA compliance for generative AI requires healthcare organizations to treat AI tools like ChatGPT, Gemini, or Copilot as potential business associates when they process electronic protected health information (ePHI). Key compliance requirements include: executing Business Associate Agreements with AI vendors before sharing any patient data, conducting risk assessments that specifically address AI-related vulnerabilities, […]

AI Security Risks in Healthcare: What Every Organization Needs to Know

Quick Answer: AI security risks in healthcare include unauthorized ePHI exposure through AI model training data, prompt injection attacks that extract sensitive information, AI-generated hallucinations leading to incorrect clinical decisions, supply chain vulnerabilities in AI dependencies, and insider threats amplified by AI-powered data access. Healthcare organizations must include AI systems in their HIPAA Security Risk […]

Network Vulnerability Assessments and HIPAA: Why Your SRA Isn’t Complete Without One

Quick Answer: A HIPAA network vulnerability assessment is a technical evaluation that scans your healthcare network infrastructure to identify security weaknesses that could expose electronic protected health information (ePHI). It involves scanning servers, workstations, firewalls, routers, and connected devices for known vulnerabilities, misconfigurations, and outdated software. HIPAA does not explicitly mandate vulnerability assessments, but they […]

The Complete HIPAA Compliance Checklist for 2026

Quick Answer: The 2026 HIPAA compliance checklist includes these essential requirements: (1) complete an annual Security Risk Assessment, (2) implement the proposed 2026 Security Rule changes including mandatory encryption and MFA, (3) update Business Associate Agreements, (4) conduct workforce HIPAA training with documentation, (5) establish breach notification procedures, (6) implement physical and technical safeguards for […]

How to Adapt to HIPAA Security Rule Changes: A Practical Guide

Quick Answer: To conduct a HIPAA risk assessment, follow these steps: (1) identify all systems that create, receive, maintain, or transmit ePHI, (2) identify potential threats and vulnerabilities to each system, (3) assess current security measures and their effectiveness, (4) determine the likelihood and impact of each threat exploiting a vulnerability, (5) assign risk levels […]

What Is a HIPAA Security Risk Analysis? The Complete Guide for 2026

Quick Answer: A HIPAA Security Risk Analysis (SRA) is a comprehensive evaluation required by the HIPAA Security Rule (45 CFR § 164.308(a)(1)(ii)(A)) that identifies potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI). Every covered entity and business associate must complete one. It is the most commonly cited […]

HIPAA Security Rule Changes in 2026: What You Need to Know (and Do) Now

Quick Answer: The HIPAA Security Rule changes for 2026, proposed by HHS in December 2025, include mandatory encryption of all ePHI at rest and in transit (eliminating the “addressable” loophole), required multi-factor authentication (MFA) for ePHI access, 72-hour incident notification to HHS, annual penetration testing, vulnerability scanning every six months, and enhanced documentation requirements. These […]

The Human Firewall: Why Culture Beats Code in HIPAA Security

Quick Answer: The “human firewall” in healthcare refers to building a security-conscious workforce culture where every employee serves as a line of defense against data breaches and cyber threats. Human error causes the majority of healthcare data breaches — including phishing clicks, improper access, lost devices, and verbal disclosures of patient information. Building an effective […]

Showing Your Work: What HIPAA Compliance Actually Looks Like

Quick Answer: Showing Your Work is a critical component of HIPAA compliance for healthcare organizations. Understanding and implementing the requirements helps protect patient data, avoid costly penalties, and maintain trust with patients and partners. A thorough Security Risk Assessment is the foundation for identifying and addressing compliance gaps. Showing Your Work: What HIPAA Compliance Actually […]