2026 HIPAA Security Rule: What Small Practices Should Know

What the 2026 HIPAA Security Rule Actually Is

First, the part almost nobody leads with: it is a proposed rule, not law. The government published the proposal at the end of 2024, the public comment period closed in early 2025, and it would be the biggest change to the HIPAA Security Rule in over a decade.

The original target was to finalize it around the middle of 2026. That window has come and gone with nothing published, there is no confirmed date, and a large group of hospital and provider organizations has formally asked the government to pull the proposal back. So whether it becomes law, when, and in what final form is genuinely up in the air.

That does not make it irrelevant. It tells you clearly where the rules are heading. It just is not a deadline on your calendar yet, and any vendor telling you otherwise is selling urgency that does not exist.

The new rule is a signal of where things are going. It is not a deadline you are already late for.

What It Would Require If It Becomes Final

If the proposal becomes law close to its current form, here is what would change for a practice your size. All of this is still proposed, so treat it as direction, not gospel.

If a final rule is issued, practices would get roughly 240 days to comply. The catch is that the final language can differ from the draft, so building your whole plan around a proposal you cannot see the finished version of is a good way to do the work twice.

The Part That Is Already the Law

Here is what the scary emails tend to skip. While the new rule is still proposed, one of its core requirements is already in force and has been for years: a thorough, written security risk analysis. If you have heard it called an SRA, that is the same thing.

It is the single most common failure the government finds when it investigates a practice, and it is far from the only HIPAA gap that quietly puts practices at risk. The Office for Civil Rights has been running a dedicated enforcement campaign around the risk analysis since late 2024, and as of spring 2026 has closed more than a dozen cases under that campaign alone.

The pattern is almost identical every time. A practice gets hit with ransomware or a breach. The government investigates. It finds there was never a real, documented risk analysis. A settlement follows, along with a corrective action plan that runs two to three years with mandatory progress reports to the federal government. Settlements have ranged from around ten thousand dollars for small organizations to several hundred thousand for larger ones, but the multi-year oversight usually costs more in time and disruption than the fine does in dollars.

And no, being small is not a shield. The government has settled with solo and small practices. The size of your office does not change the standard you are held to.

The breach is what starts the investigation. The missing risk analysis is what turns it into a settlement.

What a Small Practice Should Actually Do Now

The takeaway is not to panic-buy security products because of a proposed rule. It is to get your foundation in order, because it protects you under the rules that already exist and puts you ahead of the one that might be coming. Almost everything the new rule would make mandatory is already considered basic, sound practice.

None of this depends on the new rule being final. These are the things the government already looks for, and the things that keep a small practice out of trouble whether the proposal lands this year, next year, or not at all.