HIPAA Security Rule 2026: 72-Hour Restore, 12-Month Audits

HHS now projects final action on the HIPAA Security Rule overhaul for July 2027, according to McDermott Will & Schulte's July 16, 2026 client alert. The prior regulatory agenda, issued in September 2025, listed May 2026, so the date moved back by about 14 months.

The proposal would still change a long list of routine tasks for any practice that holds electronic patient records. This post lists those tasks with the intervals the proposal sets, and the cost HHS attached to them.

When would the rule take effect?

The Office for Civil Rights published the proposed rule in the Federal Register on January 6, 2025, and set a comment deadline of March 7, 2025. The 2026 Unified Agenda, released by the Office of Information and Regulatory Affairs, now classes the rulemaking as a "long-term action," according to McDermott Will & Schulte.

The Federal Register notice sets the clock after a final rule. It says the effective date "would be 60 days after publication" and proposes the standard compliance date of 180 days after that effective date. Adding the two gives 240 days between publication and compliance.

A rule finalized in July 2027 on that clock would require compliance around March 2028. That date is arithmetic from the proposal, not a date HHS has announced.

The proposal also gives existing business associate agreements a grace period. Under the transition rule, as Alston & Bird summarized it on January 7, 2025, an agreement can continue until the earlier of its renewal after the compliance date or one year after the final rule's effective date.

What does HHS say the rule would cost?

Alston & Bird reports that HHS estimated $9 billion in first-year compliance costs across all regulated entities. For each of the four following years, HHS estimated $6 billion in recurring costs. Adding those figures gives about $33 billion over five years.

The estimate covers the whole industry, so it does not give a figure for one practice. A practice with 5 physicians and a practice with 50 appear in the same total. HHS did not publish a per-practice number in the portions of the notice reviewed for this post.

HHS based the proposal on breach trends. Alston & Bird cites an OCR figure of a 102% increase in reported large breaches caused by ransomware over five years. It also cites an 89% increase in reported large breaches caused by hacking over the same five years.

Which tasks would repeat, and how often?

Most of the proposal turns one-time work into scheduled work. The table lists the intervals as Alston & Bird summarized them.

Task	Proposed interval	Rule section
Technology asset inventory and network map update	Every 12 months	164.308
Written risk analysis review and update	Every 12 months	164.308
Workforce training	Every 12 months	164.308
Contingency plan test	At least every 12 months	164.308
Incident response plan test and revision	At least every 12 months	164.308
Compliance audit	At least every 12 months	164.308
Business associate safeguard verification	At least every 12 months	164.308
Physical security review and test	At least every 12 months	164.310
Penetration test	At least every 12 months	164.312
Vulnerability scan	At least every 6 months	164.312
Backup restoration test	At least monthly	164.312
Documentation update	At least every 12 months	164.316

Source: Alston & Bird, "New Year, New HIPAA Security Rule," January 7, 2025.

Ten of the twelve rows run on a 12-month cycle. One runs every 6 months and one runs monthly. A practice manager who owns this work would carry at least 10 annual deliverables, plus the scans and the monthly restore tests.

What are the short clocks?

Some items run in hours or days, not months. Alston & Bird lists these:

Disaster recovery must restore critical systems and data within 72 hours of a loss.
Backups must be exact, retrievable copies no more than 48 hours old.
Workforce access must end no later than one hour after termination. If another entity hosts that access, it must be told within 24 hours.
Critical risks must be patched within 15 calendar days, and high risks within 30 calendar days.
A business associate must tell the covered entity within 24 hours after it activates a contingency plan.

The one-hour limit is the tightest of these. A practice that removes a departing employee's logins at the end of the next business day would miss it by many hours.

What else changes in the text?

The proposal removes the split between "required" and "addressable" specifications. Alston & Bird and McDermott Will & Schulte both report that every standard and implementation specification would become mandatory.

The proposal adds 10 newly defined terms and modifies 14 existing ones. It defines "deploy" and "implement" so that a safeguard must be "in use, operational, and function as expected throughout the covered entity or business associate." A policy on paper would no longer count.

It makes encryption a standard for patient data at rest and in transit, and it requires multi-factor authentication on relevant technology assets. Both have limited exceptions. The last change to the Security Rule came in 2013, per McDermott Will & Schulte.

What can a practice do before a final rule?

The rule is a proposal, and the final text can differ from it. Work that matches both the current rule and the proposal carries little risk of being wasted:

Build a list of every system that stores or sends patient data, with a map of how the data moves.
Write down who can restore the practice's systems, and time one restore test against the proposed 72-hour limit.
Check how fast a departed employee's access ends today, in hours.
Ask each billing or software vendor how it would meet the 24-hour notice and the annual verification.

If HHS keeps the proposed clocks, a practice would run at least 1 compliance audit, 1 penetration test, and 2 vulnerability scans in every 12-month period, plus 12 backup restoration tests.

Sources

Talk to us

Fifteen minutes about your practice and the systems you run.

Book a demo