HIPAA Security Rule 2025–2026 Update: What Changed and What Did Not

Current Status (2025–2026)

• In effect today: Administrative, Physical, and Technical Safeguards under §§164.308–164.312, with Required and Addressable implementation specifications under 164.306(d).
• Proposed (NPRM only): MFA; encryption at rest and in transit as required; technology asset inventory; network segmentation expectations; shorter restoration objectives; and other enhancements described in 90 FR 898.
• Planning estimate: Unified Agenda has projected final action around July 2027 — treat as a planning signal, not a compliance deadline.

What Not to Claim

Do not tell boards or customers that “new mandatory MFA and encryption are already law.” Until a final rule is published and effective, encryption remains addressable under §164.312, and MFA is not a standalone required Security Rule standard (though it is often reasonable and appropriate under access control / authentication).

Prudent Readiness Without Premature Claims

1. Complete / refresh the §164.308(a)(1) risk analysis covering all ePHI systems.
2. Document Required vs Addressable decisions with equivalent alternatives where applicable.
3. Inventory assets that create, receive, maintain, or transmit ePHI (aligns with NPRM direction and good security practice).
4. Adopt MFA and strong encryption where risk analysis supports them — and track them as programme priorities for any future final rule.
5. Map evidence in CyberSilo CSA and continuous monitoring via ThreatHawk.

How CyberSilo Helps

• CSA keeps Required/Addressable decisions and evidence URLs tied to Security Rule citations.
• ThreatHawk supplies audit-control and incident telemetry for §§164.312(b) and 164.308(a)(6).

Frequently Asked Questions

Did the HIPAA Security Rule change in 2025 or 2026?

HHS issued an NPRM in January 2025 proposing major changes. No final Security Rule update was in effect as of September 2026; the current Security Rule still governs.

Are MFA and encryption mandatory under HIPAA today?

Encryption at rest and in transit is addressable under §164.312. MFA is not a current standalone required standard. The NPRM proposed making several of these required — that is not final.

What should we do while waiting for a final rule?

Maintain Required specifications, document Addressable decisions, run risk analysis, and implement MFA/encryption where reasonable and appropriate.

Related HIPAA Resources

HIPAA hub · §164.312 · Encryption · MFA · CSA