Compliance
HIPAA Privacy Rule update 2026: Proposed changes explained
Estimated reading time: 8 minutes.
Summarize with ChatGPTTL;DR
- HHS is moving forward with several proposed changes to the HIPAA Privacy Rule.
- The proposals address care coordination, your Notice of Privacy Practices (NPP), and administrative simplification.
- Other proposals address how quickly you must respond to records requests. The current 30-day window is proposed to be shortened to 15 days.
- As of October 2026, nothing has been finalized. Current rules still apply.
- You don't need to do anything today. Reviewing your records access process, NPP, and how quickly you can retrieve client records will help you prepare.
If you've been following HIPAA news this year, most headlines have focused on the Security Rule update. It includes proposed cybersecurity, risk analysis, and other changes to protect electronic PHI.
But another update has been in the works longer, and it could affect everyday workflows in your practice.
The Security Rule focuses on protecting electronic PHI (think passwords and encryption). The Privacy Rule sets standards for how PHI can be used and shared. It also gives clients rights and requires practices to have privacy procedures and safeguards.
HHS originally proposed changes to the Privacy Rule in December 2020. Those proposed changes sat for years. Now they're moving again, and they're worth paying attention to. You don't need to act right away, but understanding what's on the table can help you prepare.
Here's what you need to know.
What's happening with the HIPAA Privacy Rule in 2026?
In December 2020, HHS proposed a set of changes to the HIPAA Privacy Rule and published the proposed rule in January 2021. It covered a wide range of updates, from care coordination to how quickly clients can access their records.
For several years, the proposal stalled. Other priorities, including the Security Rule update, took the spotlight.
In 2025, HHS picked it back up, and the changes are now moving towards becoming law. Here's how they break down.
| Care coordination and NPP final rule | Records-access timing proposed rule | |
|---|---|---|
| What it covers | Care coordination, family and caregiver involvement, NPP changes, administrative simplification | How quickly providers must respond to records requests |
| Current status | Sent for White House review (April 2026) | Separate proposed rule expected (November 2026) |
| What this means | Closer to being finalized, but not yet published | Still in early stages. The specifics haven't been published yet. |
As of October 2026, neither rule has been published. Current rules still apply. If a final rule is issued, it will include a compliance deadline. The 2021 proposal suggested 180 days after the effective date, but the final rule could set a different timeline.
“Don't wait for a final rule to start paying attention. The proposed Privacy Rule changes affect areas every provider touches regularly: records access, NPPs, and how information is shared for care coordination. Understanding what's on the table now puts you in a stronger position when the rules are finalized."
Margaret Hales, J.D., CEO of ET&C Group LLC and The HIPAA E-Tool
The bottom line: these changes are proposed, not final. Rulemaking timelines can shift. But knowing what's on the table helps you prepare.
How could the proposed HIPAA Privacy Rule changes affect your Notice of Privacy Practices?
If you updated your NPP for the federal substance use disorder changes that took effect in February 2026, you've been through this recently.
Here's what the proposed changes would do:
The first change is straightforward. The proposed rule would remove the requirement to make a good-faith effort to obtain written acknowledgment that a client received your NPP.
The second is broader. The proposal would also change some of the information NPPs must include. That includes clearer information about clients' access rights and whom they can contact with questions.
If your NPP is already current under today's rules, there's no need to rewrite it based on the proposal. But if you haven't updated your NPP to include the February 2026 required changes, don't wait for this new rule.
Here's a scenario to consider. You pull up your practice's NPP and realize you haven't touched it since you first opened your practice. You're not sure whether it reflects the substance use disorder privacy changes that took effect in February 2026. That's a sign to review it now, regardless of what the proposed rule eventually requires.
Need more help with your NPP?
For a practical guide to what your NPP should include and how to provide it to clients, read our Notice of Privacy Practices guide.
For an overview of the 2026 changes that affect NPPs, see The HIPAA E-Tool’s article.
How could the proposed HIPAA Privacy Rule change care coordination?
This part of the proposed update covers how providers share information with other providers, family members, and caregivers involved in a client's care.
Under the current Privacy Rule, you can share protected health information (PHI) with other providers for treatment purposes without written authorization. That hasn't changed and wouldn't change under the proposed rule. The proposed changes would expand flexibility in a few specific areas.
One of the most relevant changes is family and caregiver involvement, especially in emergencies. The proposed rule would change the standard for sharing information with a family member or caregiver from "professional judgment" to "good faith."
In practice, that means more flexibility when a client is in crisis and a caregiver is trying to help. If you've ever been in that situation, the proposed changes could give you more room to act.
Two other proposals deal with how clients can receive or direct copies of their health information.
One would explicitly recognize that sending an electronic copy of PHI to a personal health app counts as fulfilling a client's access request. If a client asks you to send records to an app, this proposal would confirm that doing so meets the access standard.
The other would narrow what information a client can ask you to send directly to a third party. Under the proposed change, that right would apply only to information in an electronic health record, not every piece of electronic information you hold.
👉 If you refer clients to other providers or coordinate care in any way, our post on HIPAA-compliant referrals covers the current rules in more detail.
Could the HIPAA records request deadline get shorter?
This proposed change could affect solo and small-group practices the most.
Current rules give you 30 calendar days to act on a request. If necessary, you can take one extension of up to another 30 days, provided you give the client written notice within the initial 30 days.
The current proposal would shrink the window to 15 days, with a possible 15-day extension period.
If your practice struggles to meet the current 30-day requirement, you will need to improve your systems to comply with the new requirements.
OCR continues to enforce the right of access. On October 8, 2026, it announced its 56th enforcement action under the Right of Access Initiative. In that case, a patient made multiple requests for her records, but the practice failed to provide timely access.
The HIPAA E-Tool breaks down OCR's latest Right of Access case and the practical lessons for healthcare practices.
Your process probably won't break down that dramatically. But the enforcement record shows that timely access matters. Delays can happen when a request gets missed, a provider isn't sure what to include, or a response gets pushed down the list.
A clear way for clients to submit requests, plus a simple way to track your response, goes a long way.
"A shorter response window doesn't change the underlying obligation. You're already required to respond to records requests within 30 days. What it does change is how much room you have if something falls through the cracks. A simple, repeatable process is the best protection you can give yourself.
Steven O. Youngman, VP of Legal and Compliance, Hushmail
💡 Hushmail tip: A secure form gives clients a consistent way to submit a records request and gives you a clear timestamp for when the request came in. When the response window is tight, knowing exactly when the clock started matters.
What should you do about the proposed HIPAA Privacy Rule changes?
As of October 2026, nothing has been finalized, and your current obligations haven't changed. But you can start now on a few things that will make things easier if and when the rules change.
- Review how you handle records requests. Not on paper, but in practice. Do you have a defined process? Do you know how long it actually takes you to respond? If a client asked for their records tomorrow, would you know where to start?
- Review your NPP. You don't need to rewrite it. But you should know when you last updated it and whether it reflects current requirements, particularly those from February 16, 2026.
- Know where client records are stored and how quickly you can retrieve them. This includes records held by vendors on your behalf. Under HIPAA, you must respond to an access request even when a business associate holds the records. The clock doesn't stop while you wait on them.
- Watch for the new rules. HHS is moving forward with changes to the Privacy Rule, including: care coordination, NPP changes, and records access timelines. The final rule will explain the required changes and compliance deadlines.
How to prepare for possible HIPAA Privacy Rule changes
These proposed Privacy Rule changes haven't taken effect yet. But if they're finalized, practices that already have the basics in place will adjust more easily.
If you're looking for a simple way to manage client communication, collect information securely, and keep your practice organized, Hushmail can help.
👉 For a broader look at what HIPAA requires and how to stay on track, our HIPAA compliance checklist is a good place to start.
Reviewed by: Margaret Hales, J.D., CEO of ET&C Group LLC and The HIPAA E-Tool, and Steven O. Youngman, VP of Legal and Compliance, Hushmail.
Overwhelmed by the business side of private practice? In this guide, therapists share 20 ways they've offloaded what drains them, to create more space for the work they love.
