What are the new HIPAA requirements?


Editorial team Published on

You can review the HIPAA Security Rule NPRM and general updates through the U.S. Department of Health and Human Services (HHS) Regulatory Initiatives.

Recent and proposed HIPAA changes focus heavily on updated privacy restrictions and tightening cybersecurity standards across the healthcare sector.

Key Privacy Rule Updates (Active in 2026)

  • Reproductive Health Protection: Protected health information (PHI) cannot be used or disclosed to investigate or impose liability for seeking, obtaining, or providing lawful reproductive health care.
  • Signed Attestations: Covered entities must secure a signed attestation stating that requested PHI disclosures are not meant for prohibited investigations into reproductive health care.
  • Substance Use Disorder (SUD) Records: As of February 16, 2026, covered entities must include specific disclosures regarding SUD patient records (42 CFR Part 2) in their updated Notices of Privacy Practices (NPP).

Proposed Security Rule Overhaul (Pending / Under Review)

  • Mandatory Controls: Proposed changes shift many previously flexible ("addressable") technical safeguards—such as data encryption at rest and in transit and multi-factor authentication (MFA)—into strict requirements.
  • Asset Inventories: Regulated entities would be required to maintain ongoing asset inventories and visual network maps showing the movement of electronic PHI (ePHI).
  • Rigorous Testing: Proposals suggest mandating regular intervals for vulnerability scans and annual penetration testing.