According to Reginfo.gov, the U.S. Office of Management and Budget's website for the federal regulatory process, the new Final Action Date – the projected publication date of the final Health Insurance Portability and Accountability Act (HIPAA) Security Rule – is July 2027.
In January 2025, the U.S. Department of Health and Human Services' Office for Civil Rights (OCR) published a proposed rule to strengthen the HIPAA Security Rule. The proposal responded to substantial increases in large-scale data breaches – those affecting 500 or more individuals – reported to OCR between 2018 and 2023.
Read more about the proposed rule.
Although OCR characterized the proposed rule as primarily adding detail to existing HIPAA Security Rule requirements, it marked significant changes from the original rule, prompting criticism from provider organizations and other stakeholders. It is unclear how the current administration will respond to those criticisms, but it appears that we may have to wait another year to find out.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]