The HIPAA Security Rule is getting its first meaningful update in more than a decade. The proposed changes, published by HHS late last year, move several long-standing "addressable" controls into required status, add explicit technical specifications, and introduce new documentation obligations that every covered entity and business associate will need to meet.
01Encryption is no longer optional.
Under the current rule, encryption at rest and in transit is "addressable"meaning practices can justify not encrypting if they document why. The 2026 updates eliminate this escape hatch. Encryption becomes required, across endpoints, backups, email, and any system handling ePHI.
For most practices, this is a tooling question, not a technical one. Modern endpoints (Windows 11 Pro, macOS, iOS, Android) encrypt by default. The work is making sure it is turned on, verified, documented, and managed centrally.
02Multi-factor authentication, required.
The updated rule requires MFA on all systems that access ePHI. This includes EMR/EHR logins, VPN, remote desktop, email, and any administrative access. Exceptions are narrow and must be documented.
Practices still relying on password-only logins, especially for remote EMR access, have the biggest lift ahead. Start with the accounts most commonly targeted, administrative, billing, and anyone with remote access, and work inward.
03Annual technical testing is explicit.
The updates require documented vulnerability scanning and penetration testing on a defined cadence. "We meant to do one" is no longer acceptable evidence of compliance.
For most small practices, this means an annual external penetration test, quarterly internal vulnerability scans, and documented remediation of findings. A reputable third-party firm, not your MSP marking its own work, is the expectation.
04Written plans, audit-ready.
Every practice needs a written risk analysis, contingency plan, incident response plan, and sanction policy, and the documentation needs to be current, reviewed annually, and matched to your actual environment.
This is where most practices struggle. The binder is stale, the names are out of date, or the plan references systems that retired three years ago. An annual refresh is the baseline; a quarterly pass is better.
05Business Associate Agreements, reviewed and filed.
Every vendor touching ePHI needs a current BAA on file. The updated rule places sharper emphasis on verifying that BAs actually have the controls they attest to. Passing the paper is no longer enough.
Our compliance team maintains a living BAA register for each practice, who signed what, when, and what their last attestation covered. Practice managers can hand the file to an auditor without a week of scrambling.
HIPAA Readiness Assessment: $5,400 fixed, four weeks, delivered as a signed 45 CFR §164 gap analysis with technical controls mapped to the Security Rule. We've run this for 14 SW Florida practices, dental, dermatology, ortho, primary care, behavioral health. Deliverable is what a carrier or OCR auditor asks for, not a checklist screenshot.