The HIPAA Security Rule update is delayed: what to do in the meantime

What happened

In its July 8, 2026 post, Davis Wright Tremaine reported that HHS’s updated regulatory agenda moved the target for final HIPAA Security Rule amendments from May 2026 to July 2027. The item moved from “final rule stage” to “long term actions.” These are reported rulemaking targets, not effective dates.

The post also reported that a final Privacy Rule amendment to support coordinated care had been sent to the Office of Management and Budget on April 4, 2026 and was expected the following month, and that a proposed rule on individuals’ timely access to PHI was expected in November 2026. Readers should confirm the current status rather than treat those expectations as completed actions.

The Security Rule changes were proposed in the Federal Register on January 6, 2025 and, as of a September 2026 compliance-vendor review by Pact-One Solutions, had still not been finalized.

Why it's important to know

Proposals are not law, and reported targets are not effective dates.

A delay does not replace discussion of existing security basics.

Your IT and compliance advisers can help confirm current rule status.

How this could potentially affect your practice

• Depending on your practice, the delay may affect planning discussions with your IT and compliance advisers.
• A review could include when the practice last documented a risk analysis.
• Multi-factor sign-in, tested backups and removing access when staff leave might be useful discussion points for systems with patient information.
• Reported rulemaking targets could change, so your advisers may need to confirm current status before planning around them.

Questions for your practice

These are QCA discussion points, not findings about your practice or a compliance certification.

• When was the practice’s last documented risk analysis?
• Is multi-factor sign-in on for email and any system with patient information?
• Are backups tested?
• Who confirms rule changes for the practice?