Federal Register record checked October 4, 2026; proposal published January 6, 2025 at 90 FR 898
The HIPAA Security Rule Overhaul Is Still a Proposal: There Is No 2026 Deadline, and the Current Rule Still Bites
Vendor claims that the HIPAA Security Rule overhaul is final, took effect in March 2026, or carries a 240-day compliance clock do not survive a check of the primary record. The Federal Register holds exactly one document, titled HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information: a Proposed Rule published January 6, 2025 at 90 FR 898 under RIN 0945-AA22, with comments closed March 7, 2025, and no final action, effective date, or clock since. HHS's projected final action date has slid to July 2027 and the rulemaking has moved to long-term actions, the category used for rules not expected to move within a year. The practical warning runs the other way: most of what the proposal would require, encryption, unique user identification, asset inventory, and logging, is already required under the current Security Rule or is exactly what OCR cites in settlements, so a fictional deadline is no reason to defer real controls, and a remediation plan built on a fake date becomes fragile when the date passes uneventfully.
Executives
If a vendor or an internal plan shows a 2026 HIPAA Security Rule deadline, the date is fictional and the plan built on it will lose credibility when nothing happens. Fund the controls on their own merit instead: they are enforceable today under the existing rule, and they survive the proposal being finalized, delayed again, or rewritten.
CIO / CISO
Separate binding obligations from projected ones in your tracking, and verify any compliance date against the Federal Register before it enters a board deck. Use the pause the way the second source urges: the current rule already requires an accurate and thorough security risk analysis, access controls, and documented safeguards, and HHS enforcement under it has not stopped while the proposal waits.
Engineers
Work the controls that are already citable: encryption at rest for stored ePHI, including the spool directories and archive shares everyone forgets, unique user IDs with no shared logins, a complete inventory of every place protected health information comes to rest, and logging that someone actually reviews.
Everyone (non-IT)
You may see alarming notices claiming new health privacy rules took effect this year with a countdown to comply. The official record shows the overhaul is still a proposal with no deadline. Your existing rights to your health records and to breach notification are unchanged and fully in force.