When was the last time HIPAA was changed?

Editorial team Published on

The last major update to HIPAA occurred in August 2024 through a Department of Health and Human Services (HHS) and CMS final rule streamlining prior authorization standards, closely following an April 2024 privacy rule update (though portions of the latter regarding reproductive health were later vacated in mid-2025).

Recent HIPAA Timeline and Updates

  • August 2024: Updated standard administrative requirements and transactions to streamline prior authorization processes.
  • April 2024: Published a final rule strengthening privacy protections for reproductive health care information, which set a compliance deadline to update Notices of Privacy Practices by February 16, 2026 (despite a federal court vacating parts of it in June 2025).
  • December 2024: HHS issued a Notice of Proposed Rulemaking (NPRM) to significantly overhaul the HIPAA Security Rule to strengthen sector-wide cybersecurity, with final action anticipated around 2027.
  • 2013 Omnibus Final Rule: The last massive structural overhaul, which implemented the HITECH Act, made business associates directly liable for violations, and expanded patient access rights.

Is HIPAA changing in 2026?

Yes, HIPAA is experiencing important updates and proposed overhauls, though a major anticipated security rule change has been delayed by federal regulators to July 2027. You can review official guidance and resources via the Department of Health and Human Services portal.

Key Privacy Rule Updates in Effect

  • Notice of Privacy Practices (NPP): As of February 16, 2026, covered entities must include specific information regarding substance use disorder (SUD) patient records under 42 CFR Part 2.
  • Combined Notices: Programs that handle both standard protected health information (PHI) and Part 2 records may use updated model templates provided by HHS to streamline compliance.

Proposed Security Rule Overhaul Status

  • Delayed Timeline: A heavily discussed proposed update to the HIPAA Security Rule—which would turn previously "addressable" security safeguards like multi-factor authentication (MFA) and encryption into strict mandates—was pushed back from mid-2026 to a projected final action date of July 2027.
  • Industry Pushback: Major hospital and provider groups have requested adjustments due to compliance costs, leaving the exact final requirements under review.

What was the last update to HIPAA?

The most recent finalized update to HIPAA is the Privacy Rule amendment requiring healthcare providers to update their Notice of Privacy Practices by February 16, 2026, to align with substance use disorder record regulations.

Current Regulatory Status

  • Privacy Rule Changes: The final rule regarding reproductive health information and substance use disorder records took effect for compliance starting in late 2024 and early 2026, though parts were contested in court (Carmen Purl v. HHS).
  • Security Rule Overhaul: A major update to the HIPAA Security Rule NPRM was proposed to mandate multi-factor authentication, encryption, and asset inventories.
  • Timeline Delays: This comprehensive security update has been delayed to mid-2027 by the administration while evaluating public comments, meaning current security rules remain fully enforceable as written.

How often is HIPAA updated?

HIPAA regulations do not mandate a single rigid timeline for updating internal policies, but the U.S. Department of Health and Human Services (HHS) requires organizations to periodically review and update documentation in response to environmental or organizational changes.

Policy and Procedure Reviews

  • Annual Review: Most healthcare organizations and business associates establish a formal annual review cycle as a best practice to ensure policies match actual data handling and technical systems.
  • Immediate Updates: Policies must be revised immediately following significant events, such as security incidents, major software or infrastructure changes, new vendor agreements, or fresh federal guidance.

Training and Risk Assessments

  • Staff Training: While federal rules do not state an explicit expiration interval, the Office for Civil Rights (OCR) and industry standards strongly enforce annual refresher training for all current employees.
  • Risk Analysis & Technical Testing: Security risk assessments, asset inventories, and network maps should be evaluated and refreshed at least annually, with automated vulnerability scans recommended every 6 months and annual penetration testing.

Notice of Privacy Practices (NPP)

  • Your Notice of Privacy Practices does not update on a fixed calendar schedule, but must be promptly revised and redistributed whenever there is a material change in privacy practices, legal duties, or state/federal rules (such as substance use disorder record regulations).

What was life like before HIPAA?

Before the Health Insurance Portability and Accountability Act (HIPAA) passed in 1996, there was no federal standard for medical privacy, and workers faced severe barriers to keeping health insurance when changing jobs.

Lack of Medical Privacy

  • No federal privacy rules: Patient health data had no overarching federal protection.
  • Unrestricted sharing: Medical information could be shared with employers, lenders, or credit card companies without patient permission or notice.
  • No record access: Patients did not have a guaranteed right to view or receive copies of their own medical records.
  • Patchwork state laws: Privacy depended entirely on a weak, inconsistent mix of state regulations.

Insurance and Job Lock

  • Pre-existing conditions: Insurance companies could deny coverage or charge higher rates if a person had a pre-existing medical issue.
  • Job lock: Workers often stayed in jobs they disliked just to keep their employer-sponsored health insurance, fearing they could not get coverage elsewhere.
  • Gaps in coverage: Switching jobs often triggered long waiting periods or complete loss of health benefits.

News YOU Can Use | HIPAA Rule Changes & Extension

9 related questions found

When was HIPAA last modified?

HIPAA was last updated in August 2024 by the Centers for Medicare & Medicaid Services (CMS) to streamline prior authorization standards, though a notable privacy rule regarding reproductive health was issued in April 2024 (and later partially vacated in mid-2025).

Recent and Upcoming HIPAA Timeline

  • August 2024: CMS updated Part 162 administrative transaction standards for prior authorization.
  • February 2026: Compliance deadline for updating Notices of Privacy Practices (NPP) regarding substance use disorder record rules (42 CFR Part 2 alignment).
  • July 2027: HHS delayed the proposed sweeping cybersecurity overhaul of the HIPAA Security Rule to this projected timeframe.

What are the top 5 HIPAA violations?

The top 5 most common HIPAA violations involve failing to protect patient data through unauthorized access, weak safeguards, or delayed notifications.

1. Unauthorized Access to Patient Records

  • What it is: Staff members viewing Protected Health Information (PHI) out of curiosity or without a direct clinical need.
  • Example: Looking up the medical chart of a coworker, family member, or celebrity.

2. Theft or Loss of Unencrypted Devices

  • What it is: Laptops, phones, or USB drives containing electronic PHI (ePHI) going missing without proper encryption.
  • Example: Leaving a portable hard drive in an unlocked car where it gets stolen.

3. Lack of an Enterprise Risk Analysis

  • What it is: Failing to conduct regular, thorough security reviews of organizational systems and vulnerabilities.
  • Example: Not checking software or networks for security gaps that later lead to ransomware attacks.

4. Improper Disposal of Patient Records

  • What it is: Tossing physical paper files or un-wiped electronic media straight into standard trash or recycling bins.
  • Example: Putting printed daily appointment schedules into an open office dumpster.

5. Failure to Issue Timely Breach Notifications

  • What it is: Failing to notify affected individuals, the government, or the media within the mandatory 60-day window following a discovered data breach.
  • Example: Waiting six months to tell patients that their health records were exposed in a cyberattack.

What is the new HIPAA rule?

You can review the HIPAA Security Rule NPRM and general updates through the U.S. Department of Health and Human Services (HHS) Regulatory Initiatives.

Recent and proposed HIPAA changes focus heavily on updated privacy restrictions and tightening cybersecurity standards across the healthcare sector.

Key Privacy Rule Updates (Active in 2026)

  • Reproductive Health Protection: Protected health information (PHI) cannot be used or disclosed to investigate or impose liability for seeking, obtaining, or providing lawful reproductive health care.
  • Signed Attestations: Covered entities must secure a signed attestation stating that requested PHI disclosures are not meant for prohibited investigations into reproductive health care.
  • Substance Use Disorder (SUD) Records: As of February 16, 2026, covered entities must include specific disclosures regarding SUD patient records (42 CFR Part 2) in their updated Notices of Privacy Practices (NPP).

Proposed Security Rule Overhaul (Pending / Under Review)

  • Mandatory Controls: Proposed changes shift many previously flexible ("addressable") technical safeguards—such as data encryption at rest and in transit and multi-factor authentication (MFA)—into strict requirements.
  • Asset Inventories: Regulated entities would be required to maintain ongoing asset inventories and visual network maps showing the movement of electronic PHI (ePHI).
  • Rigorous Testing: Proposals suggest mandating regular intervals for vulnerability scans and annual penetration testing.

What are the penalties for HIPAA violations in 2026?

HIPAA penalties in 2026 are split into civil money penalties enforced by the Office for Civil Rights (OCR) and criminal penalties enforced by the Department of Justice (DOJ), with maximum fines reaching over $2.19 million per violation category per year.

Civil Penalties (Tiered Structure for 2026)

Civil penalties adjust annually for inflation and depend on the level of culpability (ranging from unknowing mistakes to uncorrected willful neglect).

  • Tier 1 (Unknowing): For violations where the entity did not know and, by exercising reasonable diligence, would not have known. Fines range from roughly $145 to $73,011 per violation, with an annual maximum cap of $2,190,294.
  • Tier 2 (Reasonable Cause): For violations where the entity knew or by exercising reasonable diligence would have known, but wasn't willful neglect. Fines range from $1,461 to $73,011 per violation, with an annual cap of $2,190,294.
  • Tier 3 (Willful Neglect - Corrected): Conscious intentional failure or reckless indifference that was corrected within 30 days of when the entity knew or should have known. Fines range from $14,606 to $73,011 per violation, with an annual cap of $2,190,294.
  • Tier 4 (Willful Neglect - Uncorrected): Conscious intentional failure or reckless indifference that was not corrected within 30 days. Fines sit at a flat rate of $73,011 per violation, with an annual maximum cap of $2,190,294.

Criminal Penalties

Handled by the DOJ for individuals or organizations that "knowingly" obtain or disclose protected health information (PHI):

  • Level 1 (Knowingly obtain/disclose info): Fines up to $50,000 and up to 1 year in prison.
  • Level 2 (Offenses committed under false pretenses): Fines up to $100,000 and up to 5 years in prison.
  • Level 3 (Intent to sell, transfer, or use for commercial advantage, personal gain, or malicious harm): Fines up to $250,000 and up to 10 years in prison.

You can read more about current enforcement priorities and resolution agreements directly on the HHS OCR Resolution Agreements page.

What are the 5 main HIPAA rules?

The five main rules of the Health Insurance Portability and Accountability Act (HIPAA) are the Privacy Rule, Security Rule, Breach Notification Rule, Transactions and Code Sets Rule, and Unique Identifiers Rule.

1. The Privacy Rule

  • What it does: Controls how protected health information (PHI) is used and shared by healthcare providers and plans.
  • Key right: Gives patients the right to view, get copies of, and request corrections to their medical records.

2. The Security Rule

  • What it does: Protects electronic protected health information (ePHI).
  • Key controls: Requires administrative, physical, and technical safeguards—such as encryption and access controls—to secure digital medical data.

3. The Breach Notification Rule

  • What it does: Requires healthcare groups to report compromised PHI.
  • Key requirement: Mandates notifying affected individuals, the government, and sometimes the media without unreasonable delay (within 60 days).

4. The Transactions and Code Sets Rule

  • What it does: Standardizes electronic billing and data exchanges.
  • Key goal: Makes healthcare claims and transactions uniform and efficient by using standard coding formats like ICD-10.

5. The Unique Identifiers Rule

  • What it does: Assigns standard identification numbers to healthcare participants.
  • Key example: Requires providers to use a unique 10-digit National Provider Identifier (NPI).