The HIPAA Security Rule Overhaul Slipped to 2027. What Therapy Practices Should Do Now

By The Professions Cloud Editors Updated October 2026 · 5 sources · 3 min read

Prices and facts checked October 13, 2026. We don't accept payment for rankings.

What happened: in July 2026, the federal Unified Agenda pushed the projected final date for the HIPAA Security Rule overhaul to July 2027 and classed it as a "long-term action". The previous agenda had targeted May 2026 (McDermott Will & Schulz, Jul 16, 2026).

Why it matters today: nothing in the proposal is enforceable yet, and OCR still enforces the current Security Rule, with risk analysis failures as a top target (Compliance Hub). But the proposal shows where requirements are heading, and most of it is good practice for any practice running AI notes, telehealth and cloud EHRs.

The timeline

Sources: McDermott; MyWorkDrive.

If finalized as proposed, it would take effect 60 days after publication, with compliance 180 days after that (Medcurity).

What the proposal would require

Sources: MyWorkDrive; McDermott.

What this means for a small therapy practice

Most practices run on SaaS, so many of these controls belong to your vendors: your EHR, telehealth platform and AI note tool. Penetration testing, for example, is generally your vendor's job, and your part is making sure they can show evidence (Person Centered Tech).

Your part is closer to:

• Identity: MFA on every account that touches client data, including email
• Devices: encrypted laptops and phones, screen locks, updates, and a policy for personal devices
• Inventory: a list of every app and device that handles PHI, including AI tools

Questions to ask your AI note vendor

AI scribes process session audio or transcripts, often the most sensitive data in your practice. Under the proposal's direction of travel, ask each vendor:

1. Is data encrypted at rest and in transit, and who holds the keys?
2. Do you support MFA and single sign-on, and can I enforce MFA for my staff?
3. How long do you keep audio and transcripts, and can I set it to delete immediately after the note is approved?
4. Is client data used to train models, even de-identified?
5. Can you share a recent security assessment (SOC 2 Type II or penetration-test summary)?
6. Will you sign a BAA that covers subcontractors, including AI model providers?

Vendors who can answer these quickly are usually the ones who are ready for whatever the final rule requires.

Do these 7 things now

1. Do (or refresh) your security risk analysis. It's required today and is OCR's top enforcement target.
2. List every system with PHI: EHR, telehealth, email, AI notes, scheduling, file storage.
3. Turn on MFA everywhere it's available.
4. Encrypt devices (BitLocker, FileVault) and require screen locks.
5. Review BAAs with each vendor, including AI scribes. Ask for a security report.
6. Document everything, since undocumented security is hard to prove (Medcurity).
7. Write a simple incident plan: who to call, and how to restore access.

Using AI for notes? See HIPAA and consent for AI note takers and our AI progress notes comparison.

FAQ

Is the new HIPAA Security Rule in effect?

No. It's a proposal. The current Security Rule applies and is actively enforced.

Could the proposal be withdrawn?

Possibly. Provider groups have pushed back on cost, but HHS has kept it on the agenda.

Do I need a penetration test as a solo therapist?

Not under current rules. If the proposal is finalized, your vendors would carry most of that work, but you'd need evidence from them.

Changelog: Oct 13, 2026: first published.