HHS-OCR (Again) Delays Issuance Of Final HIPAA Privacy And Security Rules

For those that have been awaiting the federal government’s issuance of the final rules modifying the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security regulations, the wait is not over! While the proposed HIPAA Privacy and Security Rules, issued in January 2021 and January 2025, respectively, were slated to be finalized in May 2026, that deadline came and went without any movement. Instead, in a recent update posted on the Federal Office of Information and Regulatory Affairs website at reginfo.gov, finalization of the proposed Security Rule was pushed back another year to July 2027, while finalizing the HIPAA Privacy Rule was delayed slightly, with expected action in August 2026.

The Proposed Security Rules

When first published on January 1, 2025, the proposed Security Rules received over 4,700 comments from regulated entities (covered entities and business associates), health care associations and the public. However, all action was halted on January 20, 2025, when the President issued a Regulatory Freeze Pending Review.

According to the Department of Health and Human Service, Office of Civil Rights (HHS-OCR), the proposed modifications to the Security Rule are designed to “better protect the confidentiality, integrity, and availability of electronic protected health information (ePHI)” by increasing the cybersecurity for ePHI through changes that address the ever-evolving health care landscape, including significant increases in breaches and cyberattacks and the deficiencies that were identified when investigating these incidents. The proposed rules seek to align HIPAA with current cybersecurity guidelines, best practices, methodologies, procedures, and processes, including the National Institute of Standards and Technology’s (NIST’s) ‘‘Cybersecurity Framework,’’ the HHS 405(d) Program’s ‘‘Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients,’’ and HHS’ “Cybersecurity Performance Goals (CPGs)”.

HIPAA Privacy Rule

The proposed changes to the HIPAA Privacy Rule have been in the works for more than 5 years, with the initial Notice of Proposed Rulemaking (NPRM) issued on January 1, 2021, which received more than 1,400 comments. The proposed Privacy rules seek to modify the rules to enable greater access for value-based health care and care coordination by and between individuals and covered entities, while preserving the confidentiality of health information. Like the Security Rule modification, the Privacy Rule was most recently scheduled for finalization in May 2026. However, HHS recently updated that deadline to August 2027 on reginfo.gov. Once finalized, the Rules will not take immediate effect. Assuming they are finalized in August, they would be effective 60 days after publication in the Federal Register with a 180-day compliance period, thereafter, essentially requiring regulated entities to be prepared by April 2027.

What Should be Done Now?

While organizations subject to HIPAA will have to wait at least another year before the Security Rule is finalized, and a few months until the final Privacy Rules are issued, updated policies, procedures and security practices should not be pushed to the back burner. With the ever-increasing cybersecurity risks, ensuring your Protected Health Information (PHI) and ePHI is adequately protected in accordance with best practices (i.e., NIST Cybersecurity Framework, HHS, Health Industry Cybersecurity Practices (HICPs) or CPGs) should be a priority.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.