HIPAA Security Rule Changes Small Practices Should Plan For in 2027

Is the New HIPAA Security Rule Final?

No. As of October 29, 2026, the HIPAA Security Rule overhaul that HHS proposed in the Federal Register on January 6, 2025 is still a proposed rule. It has not been finalized and it has not been withdrawn. The current Unified Agenda entry (RIN 0945-AA22) lists it as a long-term action with final action projected for July 2027, later than the May 2026 date in the prior agenda, as McDermott Will & Schulte reported on July 16, 2026.

That means the rules you have to meet today are the existing Security Rule, and the most enforced part of it is the risk analysis. The proposal is still worth planning around, because almost everything in it (MFA, encryption, an asset list, tested backups) is cheap to start now and protects a small practice whether or not a final rule ever lands.

This guide is written for solo and small direct primary care and concierge practices. It is general information, not legal advice. For decisions about your own practice, talk with a healthcare attorney or a qualified HIPAA consultant.

What Is the Status of the HIPAA Security Rule Update in 2026?

Here is the timeline as it stands on October 29, 2026:

• December 27, 2024. HHS's Office for Civil Rights (OCR) issued the proposed rule, according to the HHS regulatory initiatives page.
• January 6, 2025. The proposal was published at 90 FR 898, with comments due March 7, 2025.
• September 2025 agenda. Final action was projected for May 2026.
• 2026 agenda. The rulemaking was moved to the long-term list with final action projected for July 2027. The full regulatory agenda was printed in the Federal Register on August 14, 2026.
• Through October 28, 2026. A search of final rules in the Federal Register turns up no final rule amending the Security Rule.

A projected date in the Unified Agenda is a plan, not a promise. Rules on the long-term list can move again, change shape after public comments, or stall. The honest answer for 2027 planning is that the proposal may be finalized in some form, and that the proposed text is the best available preview of what OCR thinks good security looks like.

When would a final rule take effect?

The proposal says a final rule would take effect 60 days after publication, and that regulated entities would generally have 180 days after the effective date to comply, which is the minimum compliance period the HIPAA statute allows. Existing business associate agreements would get a longer transition until they are renewed or a set date passes. If a final rule were published in July 2027, the general compliance date would land in early 2028.

What Would the Proposed HIPAA Security Rule Require?

The proposal rewrites much of the Security Rule. These are the changes that would touch a small practice most directly, each taken from the proposed rule text and the HHS fact sheet:

• No more "addressable." Every implementation specification would become required, with specific, limited exceptions. Today you can document why an addressable item is not reasonable for you and use an alternative. That flexibility would mostly go away.
• Multi-factor authentication. The proposal defines MFA and would require it for access to relevant electronic information systems, with limited exceptions.
• Encryption at rest and in transit. Regulated entities would have to encrypt all electronic protected health information (ePHI) they store and transmit, with limited exceptions.
• Technology asset inventory and network map. You would keep a written inventory of the technology that touches ePHI and a map of how ePHI moves through your systems, reviewed at least once every 12 months and whenever something important changes.
• A more specific risk analysis. The written risk analysis would have to cover named elements and be reviewed at least every 12 months.
• Annual compliance audit. A documented audit of your compliance with every Security Rule standard at least once every 12 months.
• 72-hour restore. Written procedures to restore critical systems and data within 72 hours of a loss, based on a criticality analysis.
• Vulnerability scans and penetration tests. Scans at least every six months and penetration testing at least every 12 months.
• Business associate verification. Written verification, at least once every 12 months, that each business associate has deployed the required technical safeguards. Business associates would also have to tell you within 24 hours when they activate their contingency plan.
• Written everything. All policies, procedures, plans and analyses would need to be in writing and reviewed and tested on a schedule.

HHS's own estimate in the proposed rule puts the cost of the proposal across all regulated entities at roughly 9 billion dollars in the first year and about 6 billion dollars a year in years two through five.

That estimate is one reason the rule drew heavy comment from small providers and why it is now on the long-term list. For a solo practice, the biggest real costs would be the annual audit, the penetration test and the time it takes to keep the written documents current.

What HIPAA Security Requirements Apply to Small Practices Today?

The current Security Rule applies in full to any practice that is a HIPAA covered entity, which for a provider means conducting at least one standard electronic transaction, such as sending an insurance claim or checking eligibility electronically. Some purely cash DPC practices fall outside that definition, but many still bill insurance for something, work with employer plans, or simply follow HIPAA because patients, employers and their own vendors expect it. Whether your practice is covered is a good first question for your attorney. For covered practices, today's rule requires:

• An accurate and thorough risk analysis of the risks to the ePHI you hold, and a risk management plan that reduces those risks to a reasonable level.
• Access controls, unique user IDs, automatic logoff and audit controls.
• Workforce security, including removing access when someone leaves.
• Security awareness training for everyone on the team.
• A contingency plan with data backup and disaster recovery.
• Business associate agreements with every vendor that creates, receives, keeps or sends PHI for you.
• Written policies and procedures, kept for six years.

Why the risk analysis is the part OCR enforces most

OCR has been running a Risk Analysis Initiative aimed at the most common failure it finds, which is a missing or inadequate risk analysis. In its April 23, 2026 announcement of four ransomware settlements, OCR said the initiative had reached 13 completed investigations. Its June 18, 2026 settlement with a health plan was described as the 14th enforcement action in the initiative.

The four April 2026 settlements together involved over 427,000 people and 1,165,000 dollars paid to OCR, plus two years of OCR-monitored corrective action.

On September 17, 2026, OCR announced a resolution agreement with Ambry Genetics that included a payment of 700,000 dollars and a two-year corrective action plan.

In the Ambry matter OCR found the company had not conducted an accurate and thorough risk analysis, as Nixon Peabody summarized on September 21, 2026. The same article notes OCR Director Paula M. Stannard calling a missing compliant risk analysis "one of the most common compliance failures." The pattern is consistent. When something goes wrong, OCR asks for the risk analysis first, and practices without a current written one are in a weak position no matter how careful they actually were.

What Happened to the 2024 Reproductive Health Privacy Rule?

In April 2024 HHS amended the HIPAA Privacy Rule to add protections for reproductive health care information. On June 18, 2025, the U.S. District Court for the Northern District of Texas declared most of that rule unlawful and vacated it in Purl v. HHS, according to the HHS regulatory initiatives page.

The court left part of the Notice of Privacy Practices (NPP) changes in place. HHS says the remaining NPP modifications are undisturbed and that compliance with them was required by February 16, 2026. Those surviving changes largely relate to how your notice describes substance use disorder records under Part 2. If your practice has not updated its NPP since early 2026, compare it against the current HHS model notice. State reproductive health privacy laws still apply where they exist, so a practice in a state with its own rules should check those separately.

Does the Part 2 Rule on Substance Use Disorder Records Apply to My Practice?

The updated 42 CFR Part 2 rule, which aligns the confidentiality rules for substance use disorder (SUD) treatment records more closely with HIPAA, had a compliance date of February 16, 2026. HHS announced on February 13, 2026 that OCR's civil enforcement program for Part 2 would begin that day, with penalties aligned to HIPAA's.

Part 2 applies to federally assisted programs that hold themselves out as providing SUD diagnosis, treatment or referral, and to anyone who receives Part 2 records from those programs. Most DPC and concierge practices are not Part 2 programs. If you prescribe medication for opioid use disorder, advertise addiction treatment, or regularly receive records from SUD programs, ask counsel whether Part 2 applies and how those records should be labeled and stored. The HHS Part 2 page is the starting point.

HIPAA Requirements at a Glance for 2027 Planning

The "Do This Now Regardless" Checklist for a Small DPC or Concierge Practice

Every item below is either already required or is something the proposal would require, and each one lowers your real risk this year. None of them needs an enterprise IT department.

1. Refresh your written risk analysis. The free Security Risk Assessment Tool from HHS and ONC is built for small practices. Date it, sign it and keep it with your policies.
2. Turn on MFA everywhere it exists. Start with email, the EHR, your membership billing platform, patient messaging and any remote access tool. Most of these vendors already offer it as a setting.
3. Make a one-page asset list. Write down every laptop, phone, tablet, server, cloud app and integration that touches patient information, who uses it, and whether it is encrypted. This is the start of the inventory and network map the proposal describes.
4. Encrypt your devices. Turn on full-disk encryption on every laptop and require a passcode and encryption on phones that receive patient messages or email.
5. Test a restore. Pick one critical system, such as your EHR export or your scheduling data, and confirm you could get it back within a few days if a vendor or device failed.
6. Collect your BAAs. Keep a folder with a signed business associate agreement from every vendor that handles PHI, and note which ones publish a security or SOC 2 summary.
7. Tighten onboarding and offboarding. Former staff with live logins show up in OCR investigations, and the proposal itself cites one. Our guide to tracking who has access to which clinic software walks through a simple checklist.
8. Run short, regular training. A 20-minute session on phishing and on how your team shares patient details is enough to start, as long as you document it.
9. Check your Notice of Privacy Practices. Make sure it reflects the changes that took effect in February 2026.
10. Review your cyber coverage. Many cyber policies ask about MFA, backups and encryption at renewal. Our guide to insurance for a new DPC practice covers what to ask.

If you are still choosing tools, our guide to keeping a HIPAA-compliant workflow across all your tools explains why the EHR is rarely where the risk sits. The bigger exposure is usually the spreadsheets, personal phones and side apps around it.

How the Tools Around Your EHR Fit In

Most small practices that run into HIPAA trouble are not careless. The problem is usually that patient information ends up spread across too many places, such as an EHR, a billing platform, a texting app, a shared inbox and a few spreadsheets, and nobody has a single view of who can see what. The proposed rule's asset inventory and access requirements are really asking you to know where your data lives and to keep that picture current.

Tabflows helps with that part of the work. It is a dedicated tech team that connects the tools a clinic already uses, like the EHR, billing and messaging, so follow-ups, tasks and patient context live in one place instead of in side spreadsheets and personal text threads. Fewer stray copies of patient data means a shorter asset list and a simpler risk analysis.

If you are planning a new practice for 2027, the step-by-step guide to starting a DPC practice and the guide to starting a concierge medicine practice both cover where HIPAA setup fits in your launch timeline, and our DPC software stack guide shows which tools most practices add at each stage.

The Bottom Line for 2027

The HIPAA Security Rule overhaul is still a proposal as of October 29, 2026, with final action projected for July 2027 and no final rule published. What is required today, and what OCR enforces most often, is a current written risk analysis backed by real safeguards. If you refresh your risk analysis, turn on MFA, encrypt your devices, list your systems, test a restore and collect your BAAs this winter, you will be in good shape under the current rule and well ahead if the new one is finalized.