HIPAA Security Rule — 2026 Modernization
The HIPAA Security Rule underwent its first major overhaul since its 2003 introduction. The final rule was published by HHS in early 2026. Compliance deadline: approximately 180 days from the effective date, estimated as September 2026.
Status
Final rule published early 2026. Effective approximately 60 days after Federal Register publication. 180-day compliance grace period. Estimated compliance deadline: ~September 2026. (Source: HIPAA Vault, January 2026; Chess Health Solutions, November 2025.)
Note: The addressable-vs-required safeguard distinction that existed in the 2003 Security Rule is eliminated. All safeguards are now mandatory with no documented-equivalent substitutions.
Mandatory Requirements
Multi-factor authentication (MFA). All access to electronic Protected Health Information (ePHI) — by covered entity staff and by business associates (CDPs, data processors, activation vendors) — must use MFA.
Encryption — required. Encryption of ePHI at rest and in transit is now mandatory (previously "addressable"). CDPs and data warehouses holding ePHI must provide encryption at rest and in transit.
Annual penetration testing. All ePHI-handling systems must undergo annual penetration testing by a qualified party. This is distinct from the existing risk analysis requirement.
Biannual vulnerability scanning. Systematic vulnerability scans of ePHI-handling infrastructure required twice per year. CDPs, CDWs, and activation pipelines touching ePHI are in scope.
72-hour recovery time objective. Critical systems must be restorable within 72 hours following a security incident or failure. CDPs serving covered entities must confirm their RTO for ePHI-handling components meets this threshold.
Annual written vendor verification. Covered entities must obtain annual written confirmation from business associates — including CDPs, CDWs, and activation vendors — that they have implemented the required technical safeguards. BAA language must be updated to reflect this obligation.
Comprehensive asset inventories. Covered entities and business associates must maintain documented inventories of all systems that handle ePHI, including CDP integrations, activation destinations, and CDW connections.
Documented risk analyses. Regular, systematic risk analyses (not one-time assessments) are required. For CDP deployments: periodic architectural reviews covering all data flows, new integrations, and vendor access points.
Shortened breach notification. Business associate breach notification windows may be shortened to 24 hours in some categories (from 60 days). CDP vendors in BAA relationships must update incident-response workflows.
Marketing Rule: Unchanged
The HIPAA Privacy Rule marketing authorization requirements are not affected by the 2026 Security Rule update. PHI marketing use restrictions remain as documented in constraint.hipaa-phi-cdp-healthcare.
CDP Implications
CDPs serving healthcare organizations (covered entities, health plans, specialty care networks) that process ePHI must:
- Implement MFA for all ePHI system and API access
- Confirm full encryption at rest and in transit (not addressable-equivalent)
- Schedule annual penetration tests and biannual vulnerability scans
- Demonstrate a 72-hour RTO for all ePHI-handling infrastructure components
- Provide annual written safeguard-implementation verification to covered-entity clients
- Maintain auditable asset inventories
- Update BAA language to reflect shortened breach notification and annual verification obligations
Vendors with existing "HIPAA-ready" tiers should update their compliance posture documentation:
- AEP Healthcare Shield: confirm pen test schedule and 72-hour RTO against updated rule
- Freshpaint: confirm annual pen test and biannual scanning programs
Relationship to constraint.hipaa-phi-cdp-healthcare
This constraint governs how systems holding ePHI must be built and secured. constraint.hipaa-phi-cdp-healthcare governs what you may do with PHI in marketing contexts. Both apply simultaneously to CDPs serving covered entities.