Guide · HIPAA · Security Rule

What the HIPAA Security Rule Already Requires in 2026: A Readiness Guide

The current rule is less forgiving than its reputation. What it requires, how OCR tests it, and how a small team reaches a defensible position.

By Lincoln Square Law · 8-minute read

Much of the discussion about HIPAA security in 2026 is about a rule that does not yet exist. The proposed overhaul published in January 2025 has not been finalized, and every OCR investigation is still measured against the Security Rule already on the books. That rule is less forgiving than its reputation for flexibility suggests. Its standards apply to every covered entity and business associate that handles electronic protected health information, whatever its size, and its documentation requirements are where most small practices fall short. This guide walks through what the current rule requires, how OCR tests it, and how a small team can reach a defensible position in a few months.

Flexibility with conditions

The Security Rule lets each organization choose security measures that are reasonable and appropriate for it, considering its size and complexity, its technical infrastructure, the cost of the measures, and the probability and criticality of potential risks (45 C.F.R. 164.306(b)). That flexibility has limits. Required implementation specifications must be implemented. Addressable specifications must be implemented if reasonable and appropriate. If one is not, the organization must document why and implement an equivalent alternative measure where reasonable and appropriate (45 C.F.R. 164.306(d)(3)). An addressable specification that was simply skipped, with no written reasoning, is a violation.

The foundation: risk analysis and risk management

Two requirements anchor everything else. The organization must conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of all the ePHI it holds (45 C.F.R. 164.308(a)(1)(ii)(A)). It must then implement security measures sufficient to reduce those risks to a reasonable and appropriate level (45 C.F.R. 164.308(a)(1)(ii)(B)).

These are the requirements OCR cites most. In March 2026, OCR described its settlement with a software business associate as the twelfth enforcement action under its Risk Analysis Initiative, and in April 2026 it announced four ransomware settlements in which the recurring violation was the failure to conduct an accurate and thorough risk analysis. A risk analysis that covers only the practice management system, or that was done once years ago, will not satisfy an investigator. The analysis must reach every place ePHI lives, including email, mobile devices, backups, cloud services, and vendor systems.

The administrative standards

Beyond risk analysis, the administrative safeguards require:

• A security official responsible for the program (45 C.F.R. 164.308(a)(2)).
• A sanctions policy for workforce members who violate policies, and regular review of system activity such as audit logs and access reports (45 C.F.R. 164.308(a)(1)(ii)(C), (D)).
• Workforce security and access management, so that people have access only as their roles require and lose it when they leave (45 C.F.R. 164.308(a)(3), (4)).
• Security awareness and training for the entire workforce, including management (45 C.F.R. 164.308(a)(5)).
• Security incident procedures to identify, respond to, mitigate, and document incidents (45 C.F.R. 164.308(a)(6)).
• A contingency plan with data backup, disaster recovery, and emergency operations plans, and procedures for testing them (45 C.F.R. 164.308(a)(7)).
• Periodic evaluation of the program when the environment or operations change (45 C.F.R. 164.308(a)(8)).
• Business associate contracts that meet the regulatory requirements (45 C.F.R. 164.308(b), 164.314(a)).

The physical and technical standards

Physical safeguards cover facility access, workstation use and security, and the disposal and reuse of devices and media that contain ePHI (45 C.F.R. 164.310). A practice that replaces laptops or copiers without a documented wiping process has a gap here.

Technical safeguards cover five standards: access control, which includes unique user identification and automatic logoff, audit controls, integrity controls, person or entity authentication, and transmission security (45 C.F.R. 164.312). Encryption at rest and in transit is addressable. It is also the single control that most changes the outcome of an incident, because ePHI encrypted in line with HHS guidance is not unsecured protected health information, and its loss does not trigger breach notification (45 C.F.R. 164.402). An organization that decides not to encrypt laptops or email needs a documented reason and an equivalent alternative, and few can write one convincingly.

Documentation is the evidence

The rule requires written policies and procedures and written records of required actions, activities, and assessments (45 C.F.R. 164.316(b)(1)). Documentation must be kept for six years from the date it was created or last in effect, whichever is later, made available to those responsible for implementing it, and reviewed and updated periodically (45 C.F.R. 164.316(b)(2)).

In an investigation, OCR typically asks for the current and prior risk analyses, the risk management plan, policies and procedures, training records, business associate agreements, and evidence that the safeguards described actually operate. A program that exists but was never written down cannot be shown, and one that was written years ago and never updated invites the conclusion that the organization stopped paying attention.

Business associates carry the same duties

The Security Rule applies directly to business associates, not only through their contracts (45 C.F.R. 164.302). A billing company, an IT managed service provider, or a software vendor that handles ePHI needs its own risk analysis, policies, and safeguards, and it must obtain satisfactory assurances from its own subcontractors (45 C.F.R. 164.308(b)(2)). When a business associate discovers a breach of unsecured PHI, it must notify the covered entity without unreasonable delay and no later than sixty calendar days after discovery (45 C.F.R. 164.410). Covered entities should know which vendors touch ePHI, confirm that each has signed an agreement, and ask what each does to protect the data.

When the environment changes

A risk analysis is a living record. The rule requires periodic technical and nontechnical evaluation in response to environmental or operational changes (45 C.F.R. 164.308(a)(8)), and documentation must be reviewed and updated when changes affect the security of ePHI (45 C.F.R. 164.316(b)(2)(iii)). A new electronic health record, a move to cloud services, a new location, an acquisition, or the adoption of AI tools that process patient information should each prompt an update to the analysis before the change goes live, not after.

Recognized security practices

Since 2021, the HITECH Act has required HHS to consider whether an entity had recognized security practices in place for the previous twelve months when deciding fines, audit results, and other remedies (Pub. L. 116-321). Recognized practices include the NIST Cybersecurity Framework and the practices developed under section 405(d) of the Cybersecurity Act of 2015. The consideration is not a safe harbor, but a documented program aligned to one of these frameworks gives the organization a concrete record to present if an incident occurs.

Penalties

Civil money penalties are tiered by culpability, from violations the entity did not know about and could not reasonably have known about, through reasonable cause, to willful neglect that was or was not corrected within thirty days (45 C.F.R. 160.404). The dollar ranges are adjusted for inflation each year. In practice, most resolutions are settlements that combine a payment with a multi-year corrective action plan monitored by OCR, and the corrective action plan is often the larger burden.

A realistic plan for a small team

A practice with no dedicated security staff can reach a defensible position in a few months by working in this order. Name a security official. Build the asset and vendor inventory. Refresh the risk analysis against it and write down the risk levels. Close the largest gaps first, which usually means multi-factor authentication, device encryption, patching, and access removal for departed staff. Test a restore from backup. Update policies so they describe what the practice actually does, train the workforce on them, and calendar the next review. Each step produces documentation, and the documentation is what an investigator will ask to see.

Looking ahead

If the proposed overhaul is finalized, most of this work carries forward, and the gap to the new requirements will be much smaller for an organization that has done it. If the proposal changes or stalls, the organization will have done what the current rule already requires.