What Are The Expected HIPAA Security Rule Changes?

While these changes have not yet been enacted (July 2027 is the current target date for a final decision), organizations would be wise to begin compliance now. With almost 2 billion healthcare entities likely affected, and compliance costs projected to total into the billions across the sector, last minute implementation will be painful. A headstart is a good way to ease the transition and gradually wade into those increased costs in a more strategic way. 

Encryption is mandatory. This is a major shift from the previous iteration of the HIPAA Security Rule, in which encryption was flexibly “addressable.” Not anymore. Any electronic protected health information (ePHI)–whether at rest or in transit–must be encrypted. For most healthcare entities, this will mean the implementation (and validation) of enterprise-wide encryption policies and may require the update of any old, outdated systems that lack the necessary encryption capabilities. 

Multi-Factor Authentication (MFA) is required for any systems accessing ePHI including all EHR systems, cloud-based platforms, administration tools, and remote access devices. While this move boosts cybersecurity by significantly reducing access, it also requires deployment of MFA across all user access points, compatibility across systems, and adequate user training. 

Vulnerability scans and penetration testing are required at a defined schedule. The 2026 update shifts from a suggestion to a requirement that vulnerability scans and penetration tests be performed at regular intervals of 6 months and 12 months, respectively. Compliance will require regular risk analysis and continuous monitoring. 

72-hour data restoration of critical ePHI systems and data must be possible for all regulated entities. In addition, business associates (and subcontractors) must notify covered entities no later than 24 hours after activating a contingency plan. This means that your organization (and third-party partners) must have contingency plans in place as well as testing procedures to maintain efficacy and reliability.

All regulated entities must create, maintain, and review (every 12 months) a written technology asset inventory and a network map detailing how ePHI travels through the organization’s digital systems. Inventory and mapping are essential steps to accurately analyze risk. You need a handle on what you have before you can develop or implement any customized cybersecurity defense strategies. 

Significant increases in documentation requirements include risk analysis reports, written procedures for all security measures, compliance audit records, and documentation of incidents and responses. 

Regulated entities must implement policies that segment their network. By containing potential breaches, network segmentation is another proactive cyber defense measure that restricts access, protects ePHI, and prevents lateral movement during a security incident. 

What Healthcare Organizations Need To Do Now

The major takeaway here is that it’s time to be proactive and invest seriously in cybersecurity infrastructure. With limited time before the HIPAA Security Rule Update 2026 is put in place, healthcare organizations should begin preparing now. 

Effective planning requires an expansive, accurate view of your current digital ecosystem and specifically, your cybersecurity infrastructure. Start with an inventory of all assets and map out your network. This is info you will need for compliance anyways. Conduct a cybersecurity assessment to measure your organization’s current security posture, identify vulnerabilities, and define actionable recommendations to enhance your security. What benchmarks are you currently hitting? Can you restore ePHI data within the 72-hour window? 

Once you have identified weaknesses and vulnerabilities, it’s time to prioritize. Do you need stronger access controls to comply with encryption and MFA requirements? What about network segmentation? Would your system benefit by transitioning to an Isolated Recovery Environment (IRE)?

Regulated entities can also get ahead on the changes affecting both documentation and policy compliance. Employee training (in HIPAA compliance and cybersecurity awareness) and an overall policy review (and update) are two places to start.  

You Don’t Need to Go It Alone

With our expertise in the healthcare space, Comport makes an ideal partner to assist and guide your organization through this transition. We have decades of experience in HIPAA compliance, assessment, contingency plan management, and cybersecurity. There is nothing on the list above that we don’t already do. We can jump in and meet you wherever you are in the process–evaluation, planning, implementation and deployment, or testing.