Key Takeaways
- HIPAA compliance centers on the Privacy, Security, Breach Notification, and Enforcement Rules.
- The Security Rule protects electronic protected health information through administrative, physical, and technical safeguards.
- HHS has proposed major Security Rule updates, but the current rule remains in effect while the proposal is pending.
- Breach notifications must be issued without unreasonable delay and no later than 60 days after discovery.
- Risk analysis, risk management, business associate oversight, and documented security practices remain central enforcement priorities.
HIPAA compliance continues to evolve in 2026, but organizations need to distinguish between current requirements and proposed changes. HHS has proposed a substantial update to the HIPAA Security Rule. Until that proposal is finalized, however, covered entities and business associates must continue complying with the Security Rule currently in effect.
Understanding the Core Components of HIPAA
The HIPAA framework was originally enacted in 1996 to protect sensitive patient data and ensure the secure exchange of health information. Over time, its framework has expanded to cover privacy, security, breach notification, and enforcement. Today, HIPAA compliance is primarily organized around the Privacy, Security, Breach Notification, and Enforcement Rules, supported by Administrative Simplification requirements.
1. HIPAA Privacy Rule
The Privacy Rule is the cornerstone of HIPAA. It sets forth guidelines for how healthcare organizations handle and protect Protected Health Information (PHI). The primary goal is to protect patients’ privacy by restricting access to their sensitive data and ensuring it is only used or disclosed in specific situations.
Key provisions of the Privacy Rule:
- Patient Rights: Patients have the right to access and control their own PHI. They can request copies, amend their records, and obtain an accounting of disclosures.
- Permitted Uses and Disclosures: PHI can be shared with patient consent for treatment, payment, and healthcare operations. However, its use is strictly regulated to prevent unauthorized access.
- Minimum Necessary Standard: PHI should only be shared to the extent necessary to fulfill its intended purpose, minimizing exposure and reducing risk.
Privacy Rule requirements have also been affected by recent regulatory and court developments. Most provisions of a 2024 specialized privacy rule were vacated by a federal court in June 2025. Certain Notice of Privacy Practices amendments remained in effect and carried a February 16, 2026 compliance deadline. Organizations should therefore verify current HHS guidance before relying on summaries of the original 2024 rule.
2. HIPAA Security Rule
The Security Rule focuses on safeguarding electronic PHI (ePHI) and outlines a set of administrative, physical, and technical safeguards to ensure data security. The rule ensures that ePHI is protected from unauthorized access, alteration, or destruction.
Key provisions of the Security Rule:
- Administrative Safeguards: These include policies and procedures for managing and monitoring the protection of ePHI, such as risk assessments and employee training.
- Physical Safeguards: These protect the physical aspects of data storage, including facility access and device security.
- Technical Safeguards: These safeguards are designed to protect ePHI through encryption, access control, and audit trails to track access to sensitive data.
The push for stronger cybersecurity has led to a proposed update to the Security Rule, focusing on the latest cybersecurity practices, including encryption, multi-factor authentication, and asset inventory. These changes reflect the growing risks of cyberattacks in healthcare. For example, the recent increase in ransomware attacks across the healthcare sector has highlighted the need for stronger technical safeguards.
3. HIPAA Breach Notification Rule
The Breach Notification Rule ensures that individuals and authorities are notified if their PHI has been compromised. The rule mandates healthcare organizations to take swift action when a breach occurs, helping patients stay informed and mitigate potential harm.
Key provisions of the Breach Notification Rule:
- Notification Timelines: Healthcare organizations must notify affected individuals within 60 days of discovering a breach.
- Risk Assessment: A thorough risk assessment must be conducted to evaluate the potential harm caused by the breach.
- Public Notification: If more than 500 individuals are affected, a public media notification must be made.
4. HIPAA Enforcement Rule
The Enforcement Rule outlines the penalties and procedures for HIPAA violations. Ensuring compliance is not just a matter of following the regulations; organizations must be prepared for enforcement actions if they fall short.
Key provisions of the Enforcement Rule:
- Civil Penalties: Fines can range from $100 to $50,000 per violation, depending on the severity and frequency of the violation.
- Criminal Penalties: In cases of willful neglect, criminal charges can apply, with potential prison sentences and hefty fines.
- Audits and Investigations: The HHS Office for Civil Rights (OCR) conducts investigations and audits to assess HIPAA compliance.
5. HIPAA Omnibus Rule
The Omnibus Rule, which was finalized in 2013, expanded HIPAA’s protections, including extending compliance requirements to business associates and tightening the privacy and security rules. The Omnibus Rule updated and harmonized existing regulations, ensuring stronger patient protections and greater accountability.
Key provisions of the Omnibus Rule:
- Business Associate Agreements (BAAs): Business associates must sign BAAs outlining their responsibilities in safeguarding PHI. Non-compliance can lead to substantial penalties.
- Strengthened Patient Rights: The rule also strengthened patients’ rights, including the right to restrict certain uses and disclosures of their PHI.
HIPAA Developments to Watch in 2026
The proposed HIPAA Security Rule remains pending
HHS has proposed the most substantial update to the Security Rule in years. The proposal would require more prescriptive cybersecurity measures, including multifactor authentication, encryption, network segmentation, asset inventories, vulnerability scanning, penetration testing, incident response procedures, and annual compliance audits.
These provisions should inform security planning, but they are not yet binding requirements. Covered entities and business associates remain responsible for complying with the current Security Rule until HHS publishes a final rule and establishes the applicable compliance dates.
Risk analysis remains an enforcement priority
An accurate and thorough risk analysis is already required under the current Security Rule. It must account for all ePHI that an organization creates, receives, maintains, or transmits, including information held in cloud platforms, connected systems, endpoints, backups, and by business associates.
Risk analysis is not meant to be a one-time compliance exercise. Organizations should update it when systems, threats, business operations, vendors, or the scope of ePHI change. Identified risks should feed directly into a documented risk management plan.
Notice of Privacy Practices requirements changed
Following a 2025 federal court decision, most provisions of a specialized 2024 Privacy Rule amendment were vacated. Other Notice of Privacy Practices changes remained in effect, with compliance required by February 16, 2026.
Organizations affected by these changes should confirm that their notices, policies, training materials, and related procedures reflect the portions of the rule that remain valid.
Business associate oversight remains essential
Business associates have been directly liable for applicable HIPAA requirements since the 2013 Omnibus Rule. Covered entities still need to identify which vendors create, receive, maintain, or transmit PHI, execute appropriate Business Associate Agreements, and assess whether relevant safeguards remain effective.
A signed agreement does not replace security oversight. Vendor access, evidence, incidents, remediation work, and changes in service scope should be monitored throughout the relationship.
Recognized security practices can affect enforcement
HHS must consider whether a regulated entity adequately demonstrated that recognized security practices were in place during the previous 12 months when conducting certain Security Rule enforcement and audit activities. This does not create a compliance safe harbor, but it increases the importance of documenting how security controls are implemented and maintained over time.
2025 HIPAA Updates: A History of Past Developments
In 2025, several important changes to HIPAA security regulations addressed the evolving landscape of healthcare privacy and cybersecurity. These update affected how healthcare organizations comply with HIPAA’s core components.
1. Updates to the HIPAA Privacy Rule
The Privacy Rule saw changes in 2025, particularly around reproductive health data privacy and improving patient access to health information.
What Changed?
Reproductive Health Data Privacy: The rule prohibits the use or disclosure of PHI in investigations or proceedings related to reproductive health care, particularly in states with restrictive abortion laws. Healthcare organizations are required to implement processes that protect reproductive health data from being used in criminal or civil investigations.
The new protections ensured that PHI related to reproductive health care cannot be disclosed unless required by law, reinforcing patient privacy amidst the shifting legal landscape surrounding reproductive rights.
This change also requireed organizations to reassess their data-sharing policies for sensitive health data, especially in cases where local laws conflict with federal protections. Health systems were mandated to be proactive in updating their Notice of Privacy Practices (NPP) and reinforcing training to ensure staff understands these boundaries.
2. Updates to the HIPAA Security Rule
The Security Rule got a significant overhaul in 2025 to address the ongoing threat of cybersecurity breaches, particularly in response to the rise of ransomware attacks targeting healthcare organizations.
What Changed?
Stronger cybersecurity measures: Healthcare organizations will be required to adopt more stringent cybersecurity practices, including multi-factor authentication (MFA), encryption of data at rest and in transit, network segmentation, and the implementation of asset inventories for ePHI.
The addressable vs. required distinction within the Security Rule will be removed, making all implementation specifications mandatory for compliance.
This shift ensured that healthcare organizations are not just addressing risks reactively but are putting preventive measures in place to guard against emerging threats. This will directly affect the operational protocols of healthcare IT departments.
3. Updates to the HIPAA Breach Notification Rule
The Breach Notification Rule saw updates aimed at speeding up the process and enhancing transparency when a data breach occurs.
What Changed?
Healthcare organizations are required to notify affected individuals and the HHS more quickly- the notification window has been shortened from 60 days to a more immediate timeline. This aligns with the increasing urgency of notifying patients to mitigate potential harm.
Timely notification is crucial for minimizing the damage to individuals whose PHI may have been exposed. The faster the notification, the more likely organizations are to contain a breach and prevent further exposure of sensitive data.
To meet this new timeline, healthcare organizations are turning to automated breach detection systems that can immediately trigger notifications once a breach is detected. By automating parts of the breach response process, healthcare organizations can improve their ability to meet these faster notification requirements and ensure full compliance.
4. Updates to the HIPAA Enforcement Rule
The Enforcement Rule went through revisions to tighten penalties and strengthen audits, especially concerning cybersecurity measures and breach notification compliance.
What Changed?
The OCR focused on increased enforcement in 2025, especially for healthcare organizations that failed to comply with the new cybersecurity standards or who are slow to notify patients of data breaches.
Healthcare organizations need to prioritize compliance, particularly in how they handle ePHI, risk assessments, and breach notifications.
5. Updates to the HIPAA Omnibus Rule
The Omnibus Rule already had significant impacts, but in 2025, further clarifications were made regarding the responsibilities of business associates.
What Changed?
Expanded obligations for business associates: The rule ensured that business associates of healthcare organizations are held directly accountable for HIPAA violations. This further clarifies the need for Business Associate Agreements (BAAs) to be updated regularly and ensure that third-party vendors also comply with HIPAA’s security and privacy standards.
Third-party vendors often have access to sensitive patient data, and this update ensures they, too, follow strict HIPAA compliance protocols. Ensuring that all parties in the healthcare ecosystem- providers, insurers, and vendors- are aligned will improve overall data security.
Centraleyes has everything needed for HIPAA compliance for mid-to-large organizations. The platform is actively updated with the latest HIPAA changes and ties them to other frameworks like NIST CSF 2.0 and ISO 27001.
Why Healthcare Security Teams Choose Centraleyes for HIPAA
- Automation: Evidence gathering, policy mapping, and report-writing happen automatically.
- Flexibility: You can tweak controls, workflows, and structures to match how your organization really works.
- Scalability: Whether you’re a small clinic or a large health system, the same platform grows with you.
- Built-in Risk Management: Each HIPAA control links to live risk scores, so compliance becomes an ongoing resilience exercise rather than a one-off task.
FAQs
What does the HIPAA Privacy Rule protect?
The HIPAA Privacy Rule protects individuals’ medical records and other personal health information (PHI). It sets limits on how healthcare providers, insurers, and business associates can use and disclose PHI, and grants patients rights over their own health data, including access and correction.
What actions are required in the event of a HIPAA breach?
In the event of a HIPAA breach, covered entities must conduct a risk assessment, notify affected individuals without unreasonable delay (no later than 60 days), report the breach to the U.S. Department of Health and Human Services (HHS), and in some cases, inform the media. Organizations should also document the breach and take steps to mitigate harm and prevent recurrence.
What is the purpose of the HIPAA Enforcement Rule?
The HIPAA Enforcement Rule outlines the procedures and penalties for investigating complaints, conducting compliance reviews, and applying civil monetary penalties when HIPAA rules are violated. It gives HHS the authority to hold violators accountable and incentivizes stronger compliance programs.
What are some common HIPAA violations to avoid?
Common HIPAA violations include unauthorized access to PHI, failure to encrypt or securely store data, lack of proper access controls, improper disposal of records, and failure to conduct risk assessments. Neglecting employee training and not having a breach response plan are also frequent pitfalls.
