What You Need To Know: HIPAA Security Rule Update in 2026
- Every HIPAA safeguard becomes mandatory. The HIPAA Security Rule update eliminates the “required vs. addressable” distinction. If the rule says implement it, you implement it – encryption, MFA, annual audits, and 72-hour recovery are no longer optional.
- The deadline is closer than it looks. HHS is expected to finalize the rule around May 2026. The compliance window is 180 to 240 days after publication, putting enforcement somewhere between late 2026 and early 2027. Preparation starts now.
- Running HIPAA, HITRUST, and SOC 2 as separate programs will strain your team. The new mandatory safeguards apply across all three frameworks at once. Teams that consolidate controls and share evidence across programs will absorb the new requirements. Teams that don’t will struggle.
What the mandatory safeguard requirements mean for healthcare organizations managing HIPAA, HITRUST, and SOC 2
For over two decades, the HIPAA Security Rule gave healthcare organizations a choice. Some safeguards were required. Others were “addressable,” meaning you could document why you chose not to implement them and move on.
That flexibility is going away.
The Department of Health and Human Services is expected to finalize updates to the HIPAA Security Rule around May 2026. The compliance window is 180 to 240 days after publication. That puts enforcement deadlines somewhere between late 2026 and early 2027.
The HIPAA security rule updates are significant. Not incremental. Here is what compliance teams need to understand now.
Table of contents
- What Is Actually Changing with the HIPAA Security Rule Updates
- Why This Hits Healthcare Compliance Teams Harder
- What Changes for Business Associates
- The HITRUST Connection
- What to Do Now
- The Opportunity Inside the Mandate
What Is Actually Changing with the HIPAA Security Rule Updates
The single biggest shift: every safeguard becomes mandatory. The distinction between “required” and “addressable” is eliminated. Organizations can no longer document their way out of implementing a control. If the rule says implement it, you implement it.
Specific requirements that move from optional to mandatory:
Encryption Everywhere
All electronic protected health information must be encrypted at rest and in transit. No exceptions for legacy systems. No exceptions for small practices. NIST-aligned encryption standards with proper key management.
Multi-Factor Authentication on Everything
MFA becomes mandatory for every system that stores, transmits, or accesses ePHI. That includes EHR platforms, email, file shares, cloud services, VPN, and administrative consoles. This applies to internal staff and external service providers.
Annual Compliance Audits
Organizations must conduct and document comprehensive compliance audits at least once per year. Not periodic reviews. Formal audits with tested and verified administrative, physical, and technical safeguards.
72-Hour System Recovery
Critical systems must demonstrate the ability to restore within 72 hours following an incident. Quarterly backup testing with documented results. This is the ransomware resilience requirement.
Business Associates Face the Same Rules
The updated requirements apply directly to business associates. Not just through BAA language. Direct enforcement. Every company that handles ePHI on behalf of a covered entity is held to the same mandatory safeguards.
Annual Vendor Verification
Business associates must provide written proof of their technical safeguards annually. 24-hour contingency notifications. Immediate incident reporting. Signed agreements are no longer sufficient.
Why This Hits Healthcare Compliance Teams Harder
Most healthcare organizations already manage multiple compliance programs. HIPAA sits with the privacy or legal team. HITRUST sits with information security. SOC 2 runs in parallel for technology operations. Each compliance framework has its own controls, its own evidence, its own audit cycle.
The new mandatory safeguards make this harder. Annual audits across every program. Mandatory encryption verified across every system. MFA enforced across every access point. Vendor verification for every business associate. All documented. All testable. All provable.
If your team manages these programs separately, with different tools, different spreadsheets, and different processes, the workload just multiplied. The new rule does not care how you organize internally. It cares that every safeguard is implemented, tested, and documented.
This is the operational reality that legal summaries of the rule do not capture. The regulation reads clean on paper. Implementing it across three concurrent compliance programs with a team of five people is a different conversation.
What Changes for Business Associates
Healthcare software companies, revenue cycle vendors, cloud hosting providers, data analytics firms, billing processors, and IT service providers with healthcare clients are all business associates. The mandatory safeguards apply to them directly.
Many business associates have operated under the assumption that signing a BAA was sufficient. The updated rule eliminates that assumption. You must implement the same controls. You must prove it annually. You must report incidents within 24 hours.
For business associates, compliance posture becomes a competitive differentiator. Healthcare organizations will increasingly select vendors who can demonstrate verified compliance. If you cannot provide written proof of your safeguards, you lose the deal to someone who can.
The HITRUST Connection
Organizations that already hold HITRUST certification are better positioned for this transition. The HITRUST CSF maps to the HIPAA Security Rule, and organizations with active HITRUST certifications have already implemented many of the controls that are about to become mandatory.
The gap is operational. HITRUST certification demonstrates your controls exist. The new HIPAA rule requires that those controls are continuously maintained, annually tested, and provable on demand. Static certification is not enough. Ongoing compliance readiness is the standard.
For organizations pursuing HITRUST certification, the timing is important. The new HIPAA requirements align closely with what HITRUST already expects. Getting certified now means you are building the infrastructure you will need anyway. Waiting means building it under a regulatory deadline with a compliance team already stretched thin.
What to Do Now
The HIPAA security rule update is not final yet. But the direction is clear, and OCR has been enforcing these expectations through settlements and penalties for years. The final rule codifies what has already been happening in enforcement actions.
Audit Your Current State
Identify which safeguards your organization treats as addressable today. Those become mandatory. Know the gap before the deadline creates the urgency.
Consolidate Your Compliance Programs
If HIPAA, HITRUST, and SOC 2 run as separate programs with separate evidence and separate processes, the new requirements will strain your team. Bringing them onto a single platform with shared controls and shared evidence reduces the workload.
Talk to Your Assessors
If you work with a HITRUST assessor or a HIPAA advisory firm, ask how they are preparing their clients. Firms like Accorian and CLA are already advising healthcare organizations on operational readiness. Their perspective on timeline and priorities is worth hearing.
Verify Your Vendor Relationships
The annual vendor verification requirement means your business associate agreements need to be updated. Your vendors need to be ready to provide written proof of their safeguards. Start that conversation now, not when the deadline arrives.
Quantify Your Current Compliance Labor
Most healthcare compliance teams spend 15 to 25 hours per week on manual evidence collection, status reporting, and audit preparation across concurrent programs. Over six months, that is 390 to 650 hours. Understanding that number helps you evaluate whether your current approach can absorb the additional mandatory requirements, or whether a different operational model is needed.
The Opportunity Inside the Mandate
Regulatory changes are disruptive. But they also create clarity. The organizations that prepare now will find themselves with stronger security postures, cleaner audit processes, and more efficient compliance operations than the organizations that wait.
The mandatory safeguard requirements are not a surprise. They are the direction healthcare compliance has been heading for years. The only question is whether your team is ready to operate at that standard, or still hoping the current approach will hold.
The compliance window starts when the HIPAA security rule update is published. The preparation window is right now.
ZenGRC is a governance, risk, and compliance platform built for healthcare teams managing HIPAA, HITRUST, and SOC 2. Our HITRUST MyCSF integration is live. To see how healthcare compliance teams are preparing for the mandatory HIPAA safeguards, request a demo.