If you have anything to do with patient data in 2026, the ground is moving under your feet. The HIPAA Security Rule is being rewritten for the first time in over two decades. The Notice of Privacy Practices deadline came and went on February 16 with most organizations completely flat-footed. The Office of Civil Rights (OCR) is back to pre-pandemic enforcement levels, penalties have been re-indexed for inflation, and AI is creating an entirely new category of compliance risk nobody had on their 2024 bingo card.
This is the field guide. What changed, what's coming, and what you need to do before OCR makes you a case study.
The Security Rule Is Getting Rewritten (Finally)
Healthcare has been the number one most-targeted industry for cyberattacks for 13 years running. Thirteen. The current Security Rule was written when "the cloud" was still just weather. In 2024 alone, healthcare data breaches affected more than 82 million individuals across roughly 670 separate incidents, and that number is conservative once you factor in the Change Healthcare ransomware fallout that hit millions more.
The proposed Security Rule update was published in December 2024, is scheduled to be finalized in May 2026, and will likely take effect in July or August 2026. That sounds like runway. It isn't.
What the new rule actually requires.
The biggest single change: the distinction between "required" and "addressable" controls is gone. For years, organizations treated "addressable" as a synonym for "optional." That is over. Everything is mandatory. Here is the short list of what the rule wants you doing:
- Encryption everywhere: All electronic PHI must be encrypted at rest and in transit. No exceptions.
- Multifactor authentication: Required on every system that touches electronic PHI.
- 24-hour offboarding: When an employee leaves, system access must be terminated within 24 hours.
- 72-hour recovery: After a cyber incident, you must be able to restore lost systems within 72 hours.
- Annual compliance audits: Plus technology asset inventories, network mapping, and documented vulnerability management.
Spreadsheet-and-clipboard compliance is dead. If your EHR vendor doesn't understand these new obligations, that is your problem, not theirs. And it's a serious problem.
The industry is split.
CHIME (the College of Healthcare Information Management Executives) and over 100 hospital systems have asked HHS to withdraw the proposed rule entirely, calling it a "crushing regulatory burden." OCR has pushed back, pointing out that cyberattacks cost more than compliance, both in ransomware payments, reputational damage, lawsuits, and regulatory penalties. Even the groups opposing the rule admit cybersecurity is now a patient safety issue.
“Wait for the mandate and you've already lost. Start adopting the NIST cybersecurity framework now.”
Hardening and Patching Are Already Required
Separate from the proposed rewrite, in January 2026 OCR issued guidance making system hardening and patching mandatory components of the existing Security Rule. Translation: this is not future-tense. Right now, today, regulated entities must maintain IT asset inventories, monitor NIST and CISA vulnerability alerts, conduct vulnerability scanning, and run a formal vulnerability management program.
Patching is a continuous process, not an annual task. And when patches don't exist (legacy systems, zero-day vulnerabilities), OCR expects compensating controls like network segmentation and access restrictions. If those terms are unfamiliar to your team, you need someone in the room who can translate them into actual implementations.
The Notice of Privacy Practices Deadline Already Passed
February 16, 2026. That was the deadline to update your Notice of Privacy Practices to align HIPAA with 42 CFR Part 2 (the substance use disorder records framework). Most organizations missed it. HHS has not published a model notice, so this is a custom drafting exercise. Call your healthcare attorney, do not improvise.
Under the new framework, patients can grant blanket consent for use of their SUD records for treatment, payment, and operations. But SUD records still carry heightened protections, can't be used in legal proceedings without consent or a court order, and your notice has to disclose those restrictions, provide fundraising opt-outs, and include re-disclosure warnings. This applies to every HIPAA covered entity that receives Part 2 records, not just SUD treatment providers.
State laws are stricter than HIPAA.
HIPAA is a floor, not a ceiling. New York now imposes a 30-day breach notification deadline and an expanded definition of protected health data. Colorado prohibits disclosing patient information for out-of-state investigations of gender-affirming or reproductive care. Montana and Nevada require faster patient access than HIPAA's 30-day standard. New Mexico requires patient consent for electronic record disclosures. Alabama just raised its age of medical consent from 14 to 16. Your notice has to reflect every state you operate in.
AI Just Became a HIPAA Problem
This is the part nobody is ready for. HHS has proposed expanding the Security Rule to explicitly cover AI systems that handle patient data: training data, predictive models, algorithms, all of it. The January 2025 proposed rule, scheduled for finalization in May 2026, will require written inventories of AI software and active vulnerability monitoring.
Here is the line that should make every administrator stop scrolling: public-facing tools like ChatGPT do not comply with the HIPAA Privacy and Security Rules. AI tools touching PHI must use encrypted internal servers. Civil penalties can reach $50,000 per violation. Criminal penalties for knowing violations run 1 to 10 years in prison with fines from $50,000 to $250,000. Twelve states have already enacted their own AI healthcare legislation on top of that.
And remember, "per violation" means per record. Disclose 500 patients' records inappropriately and that is potentially 500 separate $50,000 violations. The math gets ugly very quickly.
AI scribes: the lawsuit is already here.
The AI medical scribe market is exploding, from $397 million in 2025 to a projected $3 billion by 2033. Thirteen states require all-party consent for recordings. In November 2025, a class action was filed against Sharp Healthcare alleging an ambient AI documentation tool recorded over 100,000 clinical encounters without patient consent, violating California's wiretapping statute. The complaint also claims the EHR notes contained fabricated consent language saying patients had agreed when they hadn't.
If your clinicians are using ambient AI scribes, you need verified, documented, jurisdiction-aware consent flows. Not "we mentioned it once." Actually documented.
De-identification is no longer a shield.
Researchers at NYU showed that AI language models can re-identify patients from medical notes stripped of every HIPAA identifier. Their model hit over 99.7% accuracy predicting biological sex and produced re-identification risks 37 times higher than baseline. There is a multi-million dollar market for de-identified clinical notes. The technical assumption that de-identification protects patients does not survive contact with modern AI. The legal exposure is going to follow.
Enforcement Is Back and the Penalties Just Went Up
OCR levied more than $6.6 million in HIPAA fines in 2025. A few of the most instructive settlements:
- Syracuse Ambulatory Surgical Center, $250,000: Ransomware incident, no prior risk analysis, and late notification of nearly 25,000 affected individuals.
- Deer Oaks, $225,000: A coding error left patient information exposed online for 18 months, followed by a network breach affecting over 171,000 individuals.
- Cadia Healthcare, $182,000: Posted patient names, photos, and treatment information as success stories without written authorization.
- Academic medical center, $200,000: Patient right-of-access delays. This was OCR's 53rd enforcement action on patient access alone.
On the access issue: the proposed rule may shrink your response window from 30 days to 15. "Information blocking" is now actively enforced, and OCR has built its reputation on this category.
New 2026 penalty structure.
Effective January 28, 2026, penalties were re-indexed under the Federal Civil Penalties Inflation Adjustment Act. Unintentional violations now run from $127 to nearly $64,000 per violation with an annual cap around $1.9 million. Willful neglect not corrected within 30 days runs from $73,000 to over $2.1 million per violation, with an annual cap of $2.1 million. Criminal penalties top out at $250,000 and one to ten years in prison.
A 2019 notice of enforcement discretion still lowers the maximum in three of those four tiers, but don't bet your organization on it sticking around.
Breaches, Vendors, and the Things You Aren't Watching
Healthcare data breaches affected 289 million individuals in 2024 (largely driven by Change Healthcare), and another 31 million in just the first half of 2025. A survey of 613 healthcare professionals found 60% of organizations have experienced a HIPAA incident or near miss. And here is the kicker: 49% of those incidents came from internal employee error, not external hackers. Most HIPAA risk is sitting on the inside of your network, caused by inadequate training.
A Business Associate Agreement does not protect you.
Having a BAA on file does not absolve you when a vendor gets breached. Connected medical devices and cloud apps often integrate third-party software that doesn't meet your security standards. Google Docs and Dropbox in their standard commercial configurations are not HIPAA-compliant. If your team is using them with PHI, you are exposed.
Tracking pixels are still doing damage.
Patient portals and telehealth platforms running tracking pixels (Meta/Facebook, Google, others) on PHI-adjacent pages have already racked up over $100 million in fines. If your marketing team installed a pixel on the page right before a patient logs in, you may have a problem.
Email is a sleeping giant.
Internal email contains more PHI than almost any other system, and it usually sits outside your encryption requirements because it's "internal." One business email compromise can expose PHI for tens of thousands of patients via a single attached spreadsheet. Archive, encrypt, filter, and audit.
Offshoring and parental access.
HIPAA does not prohibit offshoring PHI, but you remain fully liable for offshore vendor breaches. Texas, Ohio, and Florida have all added their own restrictions. Separately, OCR has prioritized parental portal access. Parents must now receive electronic access to their children's non-confidential records, which many systems are not configured to allow.
On the Legislative Horizon
A Texas lawsuit challenging the entire HIPAA Privacy Rule was dismissed by joint stipulation in November 2025, a meaningful win for HIPAA's continued authority. Meanwhile, the proposed HIPAA Information Privacy Reform Act (HIPRA) would extend HIPAA-style obligations to wearables, healthcare apps, wellness programs, retail clinics, and certain data vendors that currently sit outside HIPAA entirely.
HHS also initiated information blocking enforcement in September 2025 under the 21st Century Cures Act with penalties up to $1 million per violation. No actions yet, but the infrastructure is built. HHS itself is reorganizing, with workforce dropping from 82,000 to 62,000 and a new Assistant Secretary for Enforcement coming online. The pace and intensity of enforcement going forward is genuinely uncertain.
Six Action Items for Right Now
- Update your Notice of Privacy Practices: The February 16, 2026 deadline already passed. Address Part 2 SUD requirements and state-specific mandates with your counsel.
- Prepare for Security Rule 2.0: Start gap analysis now. Encrypt all PHI, implement MFA, inventory your tech assets, and build a 72-hour recovery capability.
- Audit your AI tools: Every system that touches patient data. Ensure encrypted internal servers, document consent flows (especially for AI scribes), and find out what your staff is using without telling you.
- Strengthen vendor oversight: Annual vendor risk assessments. Update BAAs to cover AI analytics and behavioral tracking. Continuous monitoring, not annual checkbox.
- Address email and legacy risks: Archive old emails, encrypt PHI in transit, deploy DLP filters that detect PHI before it leaves, and review retention policies.
- Document a real risk analysis: The single most common finding in OCR enforcement actions is the absence of one. A documented analysis with identified gaps and remediation steps is the difference between a settlement and a press release.
HIPAA in 2026 is no longer a paperwork exercise. It is an infrastructure question, an AI governance question, and a leadership question. The organizations that treat it that way will be quietly compliant. The ones that don't will be the next OCR press release.
If you are reading this and quietly realizing you don't have a current risk analysis, your AI usage isn't documented, your vendor list is older than the iPhone you're holding, or your Notice of Privacy Practices is still the 2013 version, you are not alone. Most organizations are in exactly the same spot. The fix is to stop reading and start moving.