If you run a dental or medical practice, you have probably heard some version of “big HIPAA changes are coming in 2026” for about eighteen months now. Vendors have been selling against it. Consultants have been quoting it. It has been on a lot of Q1 planning documents.
It has moved. The final rule is now expected in July 2027 — a full year later than the last target. Which raises a fair question from anyone who was budgeting for this: do we still care?
Short answer: yes, but not for compliance-deadline reasons. Here is the actual state of it.
What actually happened
The Office for Civil Rights issued a Notice of Proposed Rulemaking in late December 2024, and it was published in the Federal Register on January 6, 2025. It is the first serious rewrite of the HIPAA Security Rule in more than twenty years — not a tweak, a rebuild.
The comment period closed on March 7, 2025, and OCR received roughly 4,700 comments. That is an enormous response, and the tone of much of it was not enthusiastic. Hospital associations, provider groups, and small-practice advocates all raised the same objections: the cost, the pace, and the assumption that a four-operatory dental office has the same security staffing as a health system.
OCR is still working through those comments. The target date on the federal regulatory agenda moved from May 2026 to July 2027. Worth knowing: those dates are planning estimates, not commitments. They have slipped before and can slip again — or, less likely, tighten.
What the rule would require, as proposed
The single biggest change is structural. Today, the Security Rule splits its implementation specifications into “required” and “addressable.” Addressable has always been widely misread as optional — it never was; it means you implement it or document a reasoned alternative — but in practice it gave small practices a lot of room.
The proposal deletes that distinction. Nearly everything becomes required. The specific controls it names:
- A written technology asset inventory and a network map showing how ePHI moves through your systems — reviewed at least every 12 months and whenever your environment changes. Notably, the inventory would cover assets that never touch ePHI but could still affect it.
- Encryption of ePHI at rest and in transit, with narrow exceptions.
- Multi-factor authentication on systems that access ePHI.
- Network segmentation — imaging devices and general workstations no longer sharing one flat network.
- Anti-malware protection and patch management with defined timelines.
- Vulnerability scanning at least every six months, and penetration testing at least annually.
- Dedicated backup and recovery controls for ePHI, with tested restoration.
- An annual Security Rule compliance audit, plus a more prescriptive, documented risk analysis.
Read that list as a practice owner and the objections make sense. Annual penetration testing is a real line item. So is a formal compliance audit every year. For a solo practice, this is not a rounding error.
Why the delay is not a reprieve
Three reasons we are telling clients to keep going.
The current rule already requires most of the thinking
The Security Rule in force today already requires a real risk analysis, and OCR has been consistent for years that a missing or superficial one is the most common finding in its enforcement actions. The proposed rule makes the analysis more prescriptive. It does not invent the obligation. A practice that cannot produce a current risk analysis is not waiting for 2027 — it is out of compliance now.
Your cyber insurer is already asking
Look at that control list again and compare it to your last cyber liability renewal application. MFA, endpoint protection, tested backups, patch management, restricted admin rights — the overlap is close to total. Insurers moved on this years ago and did not need a federal rule to do it. If you answer those questions honestly today and several answers are “no,” the regulation is the second problem, not the first.
Attackers do not read the Federal Register
Small healthcare practices get hit because they hold valuable data behind thinner defenses than hospitals. That calculus is unchanged in 2027. Every control on that list exists because it stops something that is actively happening to practices the size of yours.
What to do in the next year
Not everything on the list is worth buying today. Here is how we would sequence it.
- Build the asset inventory. This is the highest-value item and it is mostly labor, not spend. Every workstation, server, sensor, panoramic unit, tablet, phone, NAS, and cloud service. What it runs, who touches it, whether ePHI passes through it. Most practices we inventory find at least one device nobody knew was still on the network.
- Turn on MFA everywhere it will go. Email first, then remote access, then any cloud portal holding patient data. This is the cheapest meaningful risk reduction available to you, and it is going to be required in some form regardless of how the final rule lands.
- Verify your backups restore. Not that they run — that they restore. Pick a date, pull a real file, time it. A backup nobody has tested is a receipt, not a recovery plan.
- Refresh the risk analysis. If yours is older than a year, or was produced by a template you filled in once, redo it. This is already required, and it is what OCR asks for first.
- Segment the network. Imaging equipment and IoT devices tend to run software that cannot be patched. Putting them on their own VLAN is a one-time project that limits what a compromised workstation can reach.
What we would not rush: annual penetration testing and formal third-party compliance audits. Both are real costs, both are still subject to change in the final rule, and both are far more useful after the five items above are done. Testing a network you have not yet inventoried or segmented mostly buys you a report confirming what you already suspect.
The honest read
The 2027 date is genuinely useful news, and not because it lets anyone off the hook. It converts a compressed scramble into an ordinary two-budget-cycle project. A practice that inventories its assets this year, segments the network next year, and keeps its risk analysis current will meet most of the final rule without a crisis — whatever the exact text turns out to say.
The practices that will struggle are the ones treating the delay as permission to close the file. They will be doing all of it at once in 2027, at whatever rates the market charges when every provider in Western New York needs the same work in the same quarter.
If you are not sure where you stand, the asset inventory and a current risk analysis are the place to start — and they are useful documents no matter what happens to the rule. Get in touch and we will walk your environment with you.
This article is general information about a proposed federal rule, not legal advice. The proposal may change before it is finalized.