In January 2025, HHS proposed the biggest rewrite of the HIPAA Security Rule in twenty years: multi-factor authentication everywhere, encryption no longer optional, written restore plans, yearly audits. The final rule was expected in May 2026. In July 2026, HHS moved it to July 2027 and listed it as a “long-term action.”
It’s tempting to read that as “nothing to do until 2027.” That would be a mistake, for two reasons. The current rule is still in force, and federal investigators are enforcing parts of it harder than ever. And most of what the proposal would make mandatory is already the sensible thing to do, and much of it is already expected under today’s rule.
Here is where things stand, and the five things a small practice should do now regardless of when the new rule lands.
Where the rule stands (November 2026)
- Proposed, not final. The proposal was published on January 6, 2025 and the comment period closed on March 7, 2025. As of November 13, 2026, no final rule has been published.
- New target: July 2027. HHS’s regulatory agenda now lists the final action for July 2027, as a long-term action. The previous agenda had May 2026.
- It may change. Law firms following the rule expect HHS to finalize at least some of the proposal, probably the less controversial parts. Nobody outside HHS knows which.
- Today’s rule still applies in full.
Why waiting is risky
The Office for Civil Rights (OCR), which enforces HIPAA, launched a Risk Analysis Initiative in October 2024 and has been settling cases with practices of every size. A few examples involving small providers:
- A surgical practice in Michigan: $10,000 after a ransomware attack affecting about 15,000 patients (January 2025).
- A neurology practice in New York: $25,000 after a ransomware attack affecting about 6,800 patients (April 2025).
- A treatment center in Illinois: $103,000 after a phishing attack affecting about 2,000 patients (February 2026). OCR said it “failed to conduct an accurate and thorough risk analysis.”
Every settlement OCR announced in the first half of 2026 included a risk-analysis finding. And attacks keep coming: by our count of HHS’s public breach portal, hacking and IT incidents caused about 86% of the large health data breaches reported in 2026 through mid-October. Many of those breaches were at providers, and most provider breaches affected fewer than 10,000 people, which is to say the kind of breach a small practice has.
One more change worth knowing: from 2027, under the 2027 Medicare fee schedule, Medicare’s MIPS program drops the Security Risk Analysis measure from Promoting Interoperability. That only changes MIPS scoring. The HIPAA requirement to do a risk analysis is untouched.
The five things to do anyway
1. Do a real risk analysis, and act on it
Required today: yes. The current rule requires “an accurate and thorough assessment of the potential risks and vulnerabilities” to electronic patient information (45 CFR 164.308(a)(1)(ii)(A)), and then security measures that reduce those risks to a reasonable level (risk management).
What the proposal adds: a written inventory of your technology and a network map, a yearly review, and a yearly compliance audit.
What to do now: use the free HHS Security Risk Assessment Tool (version 3.7, updated September 2026), which is designed for small and medium providers. List every device, system and vendor that touches patient data, including the EHR, email, phones, laptops, the copier that scans documents, and any AI or billing tools. Write down the risks you find, what you’ll do about each, and by when. Then do it, and repeat the analysis at least once a year and whenever something big changes.
2. Turn on multi-factor authentication
Required today: the current rule requires you to verify that anyone accessing patient data is who they claim to be (164.312(d)), but it doesn’t name MFA.
What the proposal adds: MFA on all systems that hold or reach patient data, with narrow exceptions.
What to do now: turn on MFA for email first (HHS’s own small-practice cybersecurity guidance says to do this before anything else), then the EHR, remote access, the billing and clearinghouse portals, and any admin accounts. With MFA on, a password stolen in a phishing email is no longer enough to get in on its own.
3. Encrypt patient data at rest and in transit
Required today: encryption is “addressable.” That doesn’t mean optional: you must either implement it or document why it isn’t reasonable and use an equivalent alternative (164.306(d)(3)). For most practices, there is no good reason not to.
What the proposal adds: encryption of all patient data at rest and in transit, with limited exceptions.
What to do now: turn on full-disk encryption on every laptop and desktop (BitLocker on Windows, FileVault on Mac), encrypt backups, and ask your EHR and email vendors in writing how they encrypt data. There’s a practical benefit too: under HHS breach guidance, properly encrypted data that is lost or stolen is not “unsecured,” so a stolen encrypted laptop generally doesn’t trigger breach notification, as long as the key wasn’t taken with it.
4. Back up, and prove you can restore
Required today: yes. A data backup plan and a disaster recovery plan are both required (164.308(a)(7)).
What the proposal adds: written procedures to restore critical systems and data within 72 hours, and testing of backup controls every six months.
What to do now: keep at least one backup copy that ransomware can’t reach (offline, or immutable cloud storage), and actually test a restore. Time it. If your EHR is cloud-hosted, ask the vendor how often they back up, where the backups are, and how long a restore takes, and write the answers into your contingency plan. Decide now how the office will run for a day without the EHR.
5. Get your business associate agreements in order
Required today: yes. Any vendor that creates, receives, keeps or sends patient data for you needs a business associate agreement (BAA) that commits it to safeguard the data (164.308(b), 164.502(e), 164.504(e)).
What the proposal adds: written verification from each business associate, at least once a year, that it has the required technical safeguards in place, and notice within 24 hours if a business associate activates its contingency plan.
What to do now: list every vendor that touches patient data. That includes the EHR, billing service, clearinghouse, IT support, cloud backup, email, answering service, shredding company, and any AI tool such as an AI scribe. Check each has a signed BAA, file a copy, and ask each one now what security safeguards it has. Our list of privacy questions for AI scribe vendors works for most software vendors too.
The one-page checklist
| Task | Required today? | Proposed rule | Done |
|---|---|---|---|
| Risk analysis, written, with a risk management plan | Required | Plus asset inventory, network map, yearly audit | ☐ |
| MFA on email, EHR, remote access, admin accounts | Authentication required; MFA not named | MFA required | ☐ |
| Encryption on devices, backups and in transit | Addressable (implement or document why not) | Required | ☐ |
| Offline or immutable backup; restore tested and timed | Backup and recovery plans required | 72-hour restore; test every 6 months | ☐ |
| Signed BAA with every vendor that touches patient data | Required | Plus yearly written verification of safeguards | ☐ |
For the hands-on side (phishing drills, network separation and access reviews), see our cybersecurity checklist for small clinics.
Can doing this now help if something goes wrong?
Yes. A 2021 federal law (Public Law 116-321) requires HHS to consider whether a practice had “recognized security practices” in place for the previous 12 months when it decides on fines and audit outcomes. It isn’t an exemption from the rule, but a year of documented, sensible security can reduce penalties. Starting now gives you that year before the 2027 deadline.
Where MedTec fits
An EHR vendor can’t make you HIPAA compliant: the risk analysis and most of the steps above are your practice’s job. What a vendor can do is sign a BAA, encrypt the data it holds, offer role-based access, and answer your security questions in writing. Our security and compliance page explains our approach.
Frequently asked questions
Is the new HIPAA Security Rule final?
No. It was proposed in January 2025. As of November 2026, HHS lists the final action for July 2027, and no final rule has been published.
Is MFA required under HIPAA?
Not by name under the current rule, which requires you to verify users’ identity. The proposed rule would require MFA. HHS’s own guidance for small practices already recommends it.
Is encryption required under HIPAA?
It is “addressable” today, which means you must implement it or document why it isn’t reasonable and use an equivalent alternative. The proposed rule would make it required.
Is a security risk analysis still required now that MIPS dropped the measure?
Yes. The MIPS change for 2027 affects only MIPS scoring. The HIPAA Security Rule’s risk-analysis requirement is unchanged.
Sources
- HIPAA Security Rule proposed rule, Federal Register, January 6, 2025
- Unified Agenda, RIN 0945-AA22: final action July 2027
- Davis Wright Tremaine: HHS updates HIPAA rulemaking timeframes (July 2026)
- Current rule: 45 CFR 164.308, 164.312, 164.306
- HHS Security Risk Assessment Tool
- HHS 405(d) HICP Technical Volume 1: Cybersecurity Practices for Small Healthcare Organizations (PDF)
- HHS OCR breach portal (our count, November 13, 2026)
- HIPAA Journal: H1 2026 healthcare data breach report
- Brach Eichler: OCR’s Risk Analysis Initiative going strong (March 2026)
- Public Law 116-321 (recognized security practices)
This article is general information, not legal advice. The proposed rule may change before it is finalized. Confirm your obligations with your own attorney or compliance advisor.
Want to put your security questions to us? Book a Free Demo: a free 30-minute demo on your own workflows, no sales script.