Compliance
HIPAA Security Rule update 2027: do you need to do anything right now?
Estimated reading time: 8 minutes.
Summarize with ChatGPTTL;DR:
- The proposed HIPAA Security Rule update isn't final. The estimated timeline has shifted to July 2027.
- The current Security Rule remains in effect and still requires reasonable and appropriate safeguards to protect electronic PHI.
- "Addressable" has never meant optional. It means: assess whether a safeguard is reasonable and appropriate for your practice. If it is, implement it.
- If your risk analysis accounts for today's threats, steps like encryption and multi-factor authentication are hard to argue against, regardless of what happens with the proposed rule.
- Focus on what makes sense for protecting your clients' information today, and you'll be in good shape no matter what the final rule looks like.
Table of contents
What's happening with the HIPAA Security Rule?
If you've been anywhere near a therapist Facebook group or online forum lately, you've probably seen some version of this question: "Has anyone heard that the HIPAA rules are changing? Do we need to do something?"
You Google it. One article says new rules are coming in 2026. Another says 2027. A third says the whole thing might be scrapped. You're not sure whether to panic, overhaul your systems, or keep doing what you're doing.
Here's the short answer: the rules haven't changed yet. A significant update has been proposed, but it isn't final. And the most important thing you can do right now is something you should already be doing.
Let's break it down.
Where does the proposed rule stand right now?
In 2025, the Department of Health and Human Services (HHS) proposed major updates to the HIPAA Security Rule for the first time in over a decade. HHS originally targeted final action for May 2026, but that didn't happen. The proposal has since moved to the Long-Term Actions list, with a new estimated date of July 2027. It's still a work in progress, and the current Security Rule remains in effect.
So what's actually being proposed? The biggest change is eliminating the distinction between "required" and "addressable" implementation specifications. Everything would become required, with limited exceptions. In practice, that means:
- Encryption would be required for all electronic PHI, both in transit and in storage.
- Multi-factor authentication would be required, with limited exceptions.
- Greater specificity would be required in conducting a risk analysis.
- Contingency planning and incident response requirements would increase.
- Vulnerability scanning would be required every 6 months and penetration testing every 12 months. Security measures would need to be reviewed and tested at least every 12 months, with written documentation of all policies, procedures, and analyses.
- Business associates would face more specific security requirements and would have to verify compliance with the Security Rule technical standards.
You can read the full list of proposed changes in the HHS fact sheet.
None of this is final. But understanding what's on the table helps explain why the steps we'll cover next are worth taking now.
💡 Hushmail tip. For a deeper look at the regulatory process, check Person Centered Tech's article.
What hasn't changed?
The current HIPAA Security Rule requires you to implement reasonable and appropriate safeguards to protect electronic PHI. That standard hasn't changed. What's changed is the world around it.
When the Security Rule was written over twenty years ago, the threat landscape, available technology, and the cost of security tools were all different. What was "reasonable and appropriate" in 2003 is not the same as in 2026.
To put that in perspective: when the Security Rule took effect, few practices were using email to communicate with clients. Today, email is often the first point of contact, and it often carries PHI. The tools and threats have changed, and the standard adjusts with them.
This is where the word "addressable" trips people up. It has never meant optional. It means: assess whether a safeguard is reasonable and appropriate for your practice. If it is, implement it. If it isn't, document why and implement an equivalent alternative.
OCR Director Paula Stannard underscored this at the 43rd National HIPAA Summit in April 2026. She emphasized the cost of inadequate security, stressed that "addressable" does not mean optional, and reinforced the requirement for a risk analysis as a critical first step in identifying and managing security risks.
The bottom line: the standard is flexible by design, but the bar for what counts as "reasonable" keeps rising as threats evolve and affordable tools become more widely available.
"'Reasonable and appropriate' looks different for a solo therapist than it does for a hospital. But the standard still applies to both. The good news for smaller practices is that the tools to meet it are more accessible and affordable than they've ever been."
Margaret Hales, J.D., CEO of ET&C Group LLC and The HIPAA E-Tool
How does your risk analysis fit in?
Your risk analysis answers the "reasonable and appropriate" question. It connects the regulatory standard to your daily practice.
A current risk analysis may confirm that protections like encrypted email and multi-factor authentication are reasonable for your practice. It can also reveal gaps you didn't realize were there, especially as your technology, workflows, or client communication methods have changed over time.
OCR has signaled it's expanding enforcement beyond "did you do a risk analysis" into "did you actually act on what you found." But the core of it is straightforward: assess your risks, act on what you find, and document your decisions.
In today's threat landscape, it's easy to assume basic safeguards like encryption and multi-factor authentication are reasonable for just about any practice.
Is encryption required under HIPAA?
The current Security Rule requires you to protect electronic PHI in transit, meaning when it's going from your computer to your recipient's. That's the Transmission Security Standard, and it's not optional. Encryption is the primary way most practices meet that standard.
For stored data, encryption is currently "addressable." That means you assess whether it's reasonable and appropriate for your practice. Given today's threat landscape and the widespread availability of affordable encryption tools, it's increasingly difficult to document a defensible reason not to use it.
The proposed rule would explicitly require encryption for both. But that proposal isn't final.
Here's a quick way to think about where things stand:
| Current Security Rule | Your risk analysis today | Proposed rule (if finalized) | |
|---|---|---|---|
| Encryption (in transit) | Transmission Security Standard is required; encryption is the primary way to meet it | Most practices would find encryption reasonable and appropriate | Required |
| Encryption (at rest) | Addressable | Increasingly difficult to justify not using it | Required |
| Multi-factor authentication | Addressable | Reasonable and appropriate given credential theft threats | Required (with limited exceptions) |
| Risk analysis documentation | Required but not specific on format | Should reflect current threats and decisions | Annual review, written documentation required |
Here's what matters for your practice right now: whether you're looking at transmission or storage, encryption is the kind of safeguard that a risk analysis would point you toward. Not because a new rule says so, but because today's threats to your clients' information make it hard to justify going without it.
💡 Hushmail tip. If a client asks to receive certain low-risk messages, like appointment reminders, through regular email, handle it through a Request for Alternative Communication. It doesn't change the default expectation that PHI is protected during transmission.
Under the current Security Rule, some safeguards are still labeled 'addressable.' But I recommend practices start treating them as 'required'. Enforcement is moving in that direction, even before the proposed rule is finalized. If a safeguard is reasonable and appropriate for your practice, implement it and document it rather than waiting for the rule to change.
Margaret Hales, J.D., CEO of ET&C Group LLC and The HIPAA E-Tool
What should you do right now?
Whatever happens with the proposed rule, these steps make sense today. They protect your clients' information, demonstrate compliance with the current Security Rule, and they'll put you in a strong position if the proposed rule is finalized.
- Review or start your risk analysis. If you've never done one, explore the HIPAA E-Tool, or check out our simplified how-to guide on doing a risk assessment (with template). If you've done one before, revisit it. The threats your practice faces today aren't the same as they were a few years ago. Learn more about what OCR is looking for in a risk analysis.
- Check if your email is encrypted. If you use a regular email account to communicate with clients, it may not provide the protections PHI requires. Consider a service that provides encryption and the required signed BAA.
- Turn on multi-factor authentication for every account that touches client information. It's one of the simplest steps you can take, and it makes a real difference.
- Confirm your vendors have BAAs in place. If a company handles PHI on your behalf, it's a business associate, and you need a signed agreement.
- Document your decisions. If your risk analysis leads you to a specific safeguard, note why. If you decide a safeguard isn't appropriate for your practice, document that too.
Not sure where to start? This HIPAA compliance checklist walks through the basics step by step.
No matter what happens with the proposed rule, whether it's finalized, modified, delayed again, or withdrawn entirely, the reasoning behind taking these steps doesn't change. You're taking them because your clients' information needs protecting today.
Hushmail encrypted email and e-signable forms help you meet your HIPAA compliance needs without complex IT setup.
Reviewed by: Margaret Hales, J.D., CEO of ET&C Group LLC and The HIPAA E-Tool, and Steven O. Youngman, VP of Legal and Compliance, Hushmail.
Overwhelmed by the business side of private practice? In this guide, therapists share 20 ways they've offloaded what drains them, to create more space for the work they love.
