Compliance
The HIPAA Security Rule Overhaul Is Delayed Again, But OCR Isn't Waiting
HHS's HIPAA Security Rule overhaul has slipped again, with the federal regulatory agenda now targeting a final rule no earlier than July 2027. The current rule is the only one OCR actually enforces in the meantime, and its 2026 settlements kept citing the same gap: an incomplete or missing risk analysis. Here is what that means for where a healthcare practice or business associate should actually spend its compliance effort this year.
HHS's plan to overhaul the HIPAA Security Rule, proposed in January 2025, is not arriving on the timeline some early coverage expected. The federal government's own regulatory tracker now lists July 2027 as the current estimated target for a final rule, and the rulemaking has been moved into the government's "long-term actions" category, used for items still under development where no further regulatory action is expected within the next 12 months. The rule is not dead, just not moving on the faster timeline some early coverage expected, and a proposal can still move faster than its own agenda entry suggests. Treat July 2027 as where things stand today, not a guaranteed date. None of that changes what a healthcare practice or a business associate handling patient data has to do right now. The rule enforced today, not the one still on paper, is the only one that matters, and the U.S. Department of Health and Human Services Office for Civil Rights (OCR) spent 2026 bringing settlements that all pointed at the same gap: an incomplete or missing security risk analysis.
What Actually Changed In 2026
HHS published its notice of proposed rulemaking for the Security Rule overhaul on January 6, 2025 (90 FR 898), and the public comment period closed on March 7, 2025. Early coverage of the proposal pointed to a possible final rule sometime in 2026. That timeline has not held. The federal Unified Agenda entry for this rulemaking (RIN 0945-AA22), the government's own tracker of pending regulations, now lists the next step as a final rule targeted for July 2027, and classifies the item as a long-term action rather than an active one. A proposal can still move faster or slower than its own agenda entry, but there is nothing in that record suggesting imminent action, and nothing in it changes what applies today.
The Rule In Force Hasn't Moved
The Security Rule that actually governs electronic protected health information (ePHI) today is the version OCR has enforced for years, organized into administrative, physical, and technical safeguards, with each implementation specification labeled required or addressable. Our practical guide to the HIPAA Security Rule walks through those safeguards and the required-versus-addressable distinction in detail. Nothing about that guide changes because of the delay. If your program already meets the current rule, the 2027 target gives you time, not an excuse to pause.
What OCR Actually Penalized In 2026
While the new rule sat on the shelf, OCR kept working through its Risk Analysis Initiative, a multi-year enforcement effort it has run since 2024 that targets organizations found to have skipped or botched the one safeguard every other control depends on. On February 19, 2026, OCR announced a $103,000 settlement with an Illinois substance use disorder treatment provider, its 11th enforcement action under the initiative. The case traced back to a 2023 phishing attack that compromised a workforce member's email account and exposed the ePHI of 1,980 patients. OCR's finding was not about the phishing email itself; it was that the organization failed to conduct an accurate and thorough risk analysis of the threats to its ePHI, the baseline requirement at 45 CFR 164.308(a)(1)(ii)(A). The settlement required a new risk analysis, a risk management plan, updated written policies, and annual workforce training, with two years of OCR monitoring.
Two weeks later, on March 5, 2026, OCR settled with MMG Fusion, a software vendor, as the initiative's 12th action: a 2020 breach had exposed roughly 15 million individuals' protected health information, and OCR cited both a failed risk analysis and a failure to notify the covered entities affected. The $10,000 penalty reflected MMG Fusion's financial position, paired with a three-year corrective action plan. Seven weeks after that, on April 23, 2026, OCR announced four more settlements under the same initiative, totaling $1,165,000 and covering breaches that together affected more than 427,000 individuals: Regional Women's Health Group (doing business as Axia Women's Health), Assured Imaging, Consociate Health, and the Star Group, L.P. Health Benefits Plan. Each case started with a ransomware incident, and in each one OCR's investigation reached the identical conclusion: no accurate, thorough risk analysis of the organization's ePHI. All four of these April settlements carried a two-year corrective action plan, the same term TWRTC accepted and shorter than MMG Fusion's three-year term; every entity named above is listed on HHS's own index of HIPAA resolution agreements, alongside its own corrective action plan.
The pattern across all six of these 2026 settlements is the same, and it is worth sitting with: OCR did not conclude the risk analysis gap caused the breach, only that the gap existed and amounted to a separate potential violation it found once it went looking afterward, negotiated through a resolution agreement rather than adjudicated. A thin or missing risk analysis gets discovered during an active incident investigation, which is the worst possible time to learn your documentation will not hold up.
What A Risk Analysis Actually Has To Cover
A risk analysis that would survive this kind of review covers a few things consistently, and the settlements above show what happens when it does not.
- An inventory of every system, device, vendor platform, and backup location that creates, stores, or transmits ePHI, not just the practice management system everyone thinks of first.
- Realistic threats and vulnerabilities assessed for each one, built from your actual environment rather than copied from a generic template.
- An honest record of which controls are actually in place today, including the gaps, not just the ones that are easy to check off.
- Likelihood and impact ratings that feed a written risk management plan with specific, tracked remediation steps and owners.
- A real review cadence, not a one-time exercise filed away. The current rule sets no fixed frequency, but it does expect you to revisit the analysis when your systems, vendors, or threat picture change enough to make the last one stale, not treat it as a box checked once.
A security risk assessment built this way becomes the paper trail behind every other decision your security program makes, including which addressable specifications you implemented and why.
Worth Doing Now, Not Waiting For 2027
The delayed proposal would still make some things mandatory that are already good practice: encryption of ePHI at rest and in transit, multi-factor authentication, a written technology asset inventory and network map, and documented procedures to restore critical systems within 72 hours of a disruption. None of it requires a final rule to start. Building toward it now, while the current rule is what you are actually measured against, is preparation, not a guarantee: the eventual final rule can still differ from the proposal, but a program that already does this work has less distance to close than one starting cold once a deadline is set.
If you want a quick read on where your own program stands, our HIPAA Security Rule checklist walks through ten core readiness checks mapped to the rule's requirements, starting with the risk analysis.
Article FAQs
Is The HIPAA Security Rule Changing In 2026?
No. The proposed overhaul published in January 2025 is still a proposal, and the federal government's own regulatory tracker now targets July 2027 for a final rule, with the item classified as a long-term action. The rule OCR enforces today has not changed.
What Happens If We Wait For The Final Rule Before Updating Our Security Program?
OCR is enforcing the current Security Rule right now, not the proposed one, and its Risk Analysis Initiative settlements through 2026 centered on the same existing requirement: a complete, accurate, documented risk analysis. Waiting for a 2027 rule to decide what to prioritize means ignoring what is actually being penalized today.
What Is OCR's Risk Analysis Initiative?
It is a multi-year enforcement program OCR has run since 2024 that targets covered entities and business associates found, usually during a breach investigation, to have an inadequate or missing security risk analysis. Settlements under the initiative have required new risk analyses, risk management plans, updated policies, and corrective action plans monitored by OCR for two to three years, depending on the case.
Does A Ransomware Attack Automatically Mean A HIPAA Violation?
Not automatically, but OCR's investigation after an attack routinely surfaces one: several of the 2026 settlements above started as ransomware breach reports, and OCR's investigation separately found the same underlying gap in each one, an incomplete risk analysis that predated the attack. OCR did not conclude that gap caused the breach; its resolution agreements treated the gap as a separate potential violation in its own right, negotiated rather than adjudicated.
If you want help building a risk analysis that would hold up under this kind of review, talk with us about a HIPAA security assessment.