2026 HIPAA Security Rule Changes — HIPAA Vault

source.hipaavault-com.resources-2026-hipaa-changes-2026 ↗

Overview of the 2026 HIPAA Security Rule overhaul: final rule published early 2026, effective approximately 60 days after Federal Register publication, compliance deadline approximately 180 days from effective date (~September 2026). New mandatory technical requirements beyond the 2003 rule: annual penetration testing, biannual vulnerability scanning, 72-hour critical-system recovery time objective, and annual written vendor verification of technical safeguard implementation. The addressable-vs-required two-tier standard is eliminated — all safeguards are now mandatory. Marketing rule and PHI marketing authorization requirements are unchanged. MFA, encryption at rest and in transit, asset inventories, and breach-notification timelines also confirmed as mandatory.