This article has been rewritten because the situation changed and a lot of coverage has not caught up.
If you have been told that a major HIPAA Security Rule overhaul is about to land and your practice needs to prepare urgently, that is not where things stand.
The actual position
A notice of proposed rulemaking was published in January 2025 and the comment period closed in March 2025. Since then it has moved to Long-Term Actions on the regulatory agenda, with a target of July 2027.
Targets on that agenda slip routinely. A proposed rule is not a rule. Nothing in it is enforceable and nothing in it requires action from your practice today.
Anyone using it to create urgency is selling on a deadline that does not exist. That should tell you something about the rest of their advice.
What is actually happening
Enforcement of the rules that already exist, and it is steady.
Four ransomware settlements in April 2026 totalled $1,165,000. The OCR Risk Analysis Initiative has produced fourteen enforcement actions. The Right of Access initiative has produced 55, the most recent in August 2026 involving a small optometry practice.
The pattern across almost all of it is the same, and it has been the same for years: no accurate and thorough risk analysis.
That is the real story. It is not a rule change coming. It is an existing requirement being enforced now, and the same failure appearing again and again.
What to do meanwhile
Everything in the proposed rule that matters is something you should be doing under the current rule anyway. Know where your data is. Have a current risk analysis. Encrypt things. Control access. Train people. Have a plan for when something goes wrong.
A practice doing those things will absorb whatever eventually arrives in 2027 or later without drama. A practice that is not doing them has a problem today, and it has nothing to do with a proposed rule.
What we will do
When there is a final rule with a compliance date, we will write about it with the actual dates and the actual requirements. Until then, we would rather not manufacture a deadline.