HHS pushes final HIPAA Security Rule overhaul to July 2027

The HHS Office for Civil Rights has moved its target for finalizing the HIPAA Security Rule amendments from May 2026 to July 2027, according to its updated regulatory agenda on reginfo.gov. Davis Wright Tremaine reported on July 8, 2026 that the rule also moved from the 'final rule stage' to 'long term actions' and is no longer on HHS's 2026 rule list. Alston & Bird noted on July 10 that the May 2026 date passed without action. The proposed rule was first published in January 2025.

For healthcare providers, health plans and their business associates, this means no new Security Rule mandates in the near term. It does not mean the current rule is relaxed. Davis Wright Tremaine expects HHS to finalize only some of the proposals, likely the less controversial ones that offer the most risk reduction, and Alston & Bird advises treating the rule as delayed, not abandoned.

Keep doing the work the current rule already requires, especially an accurate, documented risk analysis and a risk management plan that addresses what it finds. Those are where OCR enforcement has focused. When budgeting for technology changes, favor controls that reduce real risk regardless of how the final rule reads, such as multi-factor authentication, encryption, asset inventories and tested backups. Ask your IT and security vendors to map what they provide to the current Security Rule requirements.

Watch for HHS's next agenda update. Separately, OCR's agenda showed Privacy Rule changes on a faster track, so policy and notice updates may arrive before any Security Rule changes.