HIPAA Security Rule Update 2026: Status Tracker and Readiness Checklist

The HIPAA Security Rule overhaul proposed in January 2025 is not final as of 17 October 2026. HHS's regulatory agenda lists a final action for July 2027 under "Long-Term Actions"; under the proposal, compliance would fall 180 days after the rule's effective date, which is itself 60 days after publication. It would make encryption, multi-factor authentication (MFA), asset inventories and annual audits mandatory. Use the status table and checklist below.

Who this is for: security and privacy leads who run customer data platform (CDP), email, analytics and tag systems that touch electronic PHI (ePHI). Part of the regulation hub.

Status table

| Proposed timing if a final rule is published: effective 60 days later; compliance 180 days after that (about 240 days after publication) | Not before final rule | Federal Register 2 |

The July 2027 date is an agenda target, not a commitment.

What the proposed rule would require

The notice would rewrite the Security Rule's text (45 CFR 164.304 to 164.318). The main proposals, from the proposed regulatory text 2:

HHS says most of these codify what a thorough risk analysis already implies, such as inventorying assets and mapping ePHI movement, and that it would apply the standard 180-day compliance period 2. It estimates first-year costs of about $9 billion and about $6 billion a year in years two to five 2.

What provider groups objected to

According to HIPAA Journal, a coalition of more than 100 hospital systems and provider associations urged HHS to withdraw the proposal, citing substantial new financial burdens, an unreasonable implementation timeline, and a conflict with the administration's deregulatory agenda; the group asked instead for a collaborative effort to develop practical standards 1. A later HIPAA Journal item says critics also raised reduced flexibility for technical safeguards and the difficulty small organizations would have meeting an eight-month (240-day) timeframe, and that a CHIME-led coalition petitioned for withdrawal 5. HHS's own notice asked whether removing the addressable distinction would have unintended negative consequences 2. We found no primary text of the coalition letters; treat these descriptions as secondary.

Likely timeline

The dates in the first row follow the NPRM's own periods and are arithmetic, not a forecast 2. Plan to the proposal's content, not to a date.

HIPAA Security Rule 2026 readiness checklist for customer data platform (CDP) and martech systems

You can do most of this under the current rule, which already requires an accurate and thorough risk analysis 2. The column on the right shows where it lands in a customer data platform (CDP) or marketing stack.

Security is separate from marketing permission: see HIPAA marketing rules for authorization, and HIPAA-compliant customer data platforms for buying criteria. A customer-owned PrivyCDP deployment (on-premise, private cloud or VPC) places these controls under the provider's own management; see the HIPAA-ready page.

Track every date in one place with the regulatory deadline tracker, and return to the regulation hub for related guides.