The HIPAA Security Rule Rewrite Just Slipped to 2027. Your Documentation Gap Didn't

October 5, 2026

Ric Hall, CRO— AI-assisted and reviewed prior to publication.

The federal rule that would have forced every hospital, clinic, and health plan to run twice-yearly vulnerability scans, annual penetration tests, and mandatory encryption just slipped to 2027. That does not mean the requirements disappeared. OCR still enforces the current Security Rule today, and the delay gives compliance teams a rare window to build the documentation and staffing evidence the new rule will demand before an examiner forces the issue.

Why Did HHS Push Back the HIPAA Security Rule Update?

HHS moved the proposed changes to its Long-Term Actions agenda in the Fall 2026 Unified Agenda, and the agency now points to July 2027 as its anticipated timeframe for final action. As Clark Hill's analysis of the delay notes, HHS has not explained the reasoning, but one likely factor is the sheer volume of public comments the agency is still working through on what would be the most significant revision to the Security Rule in over a decade.

That delay does not reset the clock on enforcement. The same analysis is direct about what stays in force while the rewrite sits in limbo: the existing HIPAA Security Rule remains fully enforceable, and OCR continues to expect covered entities and business associates to implement reasonable and appropriate safeguards, with recent enforcement actions centered on risk analyses, vendor oversight, and workforce training. In other words, the paperwork obligations you already have are not going anywhere, and the ones coming are only getting more specific.

What Would the New Rule Actually Require, and Who Has to Prove It?

The proposed rule would strip out the flexibility that has let organizations talk their way around weak controls for twenty years. Under the current rule, some safeguards are labeled addressable, meaning an organization can adopt an alternative and just document why. According to HHS's own fact sheet on the proposal, the NPRM would remove the distinction between required and addressable implementation specifications entirely, making nearly all of them mandatory, while also requiring vulnerability scanning at least every six months, penetration testing at least once every 12 months, mandatory network segmentation, and a formal review and test of security measures at least once every 12 months in place of the current general maintenance requirement. The same fact sheet also calls for written incident response plans that document how workforce members report suspected security incidents and how the organization responds to them, which turns an informal escalation habit into an auditable procedure.

That is a shift from "explain your judgment call" to "produce the test report." Here is roughly how the two regimes compare on the controls compliance teams ask about most:

The practical effect lands on whoever has to sign the attestation. A risk analysis that says "we considered encryption and decided against it" will no longer satisfy an examiner. What will satisfy one is a named, qualified person who ran the scan, ran the test, and can show the remediation ticket that closed the finding.

Does the Delay Give Healthcare Organizations a Pass?

No, and the breach numbers explain why. Large healthcare data breaches held steady at a high level even before this rule was drafted, with the OCR breach portal showing 725 large data breaches reported in 2024 and a 60.5 percent jump in the number of records exposed compared with the year before, according to HIPAA Journal's 2024 breach report. That volume is exactly what OCR pointed to when it opened the rulemaking, and it has not reversed course while the rule sits on a long-term agenda.

The vendor angle makes the case for accountability even sharper. Reporting from the American Hospital Association's 2025 cybersecurity review found that over 80 percent of stolen protected health information records were not taken from hospitals directly but from third-party vendors, software services, and business associates. If you sell into healthcare as a vendor or a business associate, your customers' compliance teams are already asking who on your staff owns security testing and whether that person can produce evidence on demand. That question does not wait for a final rule.

There is also a real incentive to move early rather than scramble later. The 2021 HITECH amendment already rewards organizations that adopt recognized security practices, since OCR is required to factor that adoption into fines and other consequences when it reviews a compliance case, as Epstein Becker Green's analysis of the NPRM explains. Building the testing cadence and documentation trail the new rule describes protects you under the current enforcement regime, not just the future one.

Who Signs the Attestation When OCR Comes Knocking?

This is the question the rewrite is really about. The Security Rule already requires a regulated entity to train all workforce members on its security policies and procedures, a duty spelled out plainly in HHS's own summary of the Security Rule. The proposed rule builds on that baseline by making the tests, the reviews, and the incident response exercises things a specific, qualified person has to own, schedule, and certify happened.

That is a staffing and procurement decision as much as a technical one. When an examiner or a business partner's security questionnaire asks who ran your last penetration test or who validated your vulnerability scan results, "our IT contractor did something" is not an answer that holds up. A credential tied to governance, risk, and compliance work gives you a name and a paper trail to point to instead. Forge University's CGRC certification prep is built around exactly this kind of documentation-and-controls discipline, covering how to structure a compliance program so the evidence exists before anyone asks for it.

The same logic extends to your contracts with business associates. If your organization signs business associate agreements with billing vendors, cloud hosts, or software providers, someone on your team needs the standing to review those vendors' own testing evidence, not just their signature on a template agreement. Given that most stolen health records in recent years trace back to a vendor rather than the covered entity itself, a compliance officer who can actually interrogate a vendor's scan reports and remediation timelines is not a nice-to-have. It is the control that keeps a partner's failure from becoming your breach notification.

What This Means for Your Team's Hiring and Training Decisions Now

Build the staffing case before the mandate forces it. Waiting for a final rule that HHS itself says is more than a year out means walking into 2027 with no one on staff who can run the required tests, document the results, or explain the gaps to an auditor. If you want a clearer picture of how a compliance-focused credential maps to that kind of program ownership, the Forge University resources page walks through the curriculum and exam structure so you can plan training against a real timeline instead of a guess.

Two things belong in that plan. First, someone on your team needs to own the recurring cadence, the twice-yearly vulnerability scan and the annual penetration test, whether the final rule requires it in 2027 or your cyber insurer requires it next renewal. Second, that ownership needs to be documented in a way a named person can defend, not buried in a shared drive with no accountable owner. If you want a study plan built around that kind of role, you can start training whenever you're ready rather than waiting for the Federal Register to force the decision.

The rule may have moved to a long-term agenda, but the breach numbers, the vendor exposure, and the existing training and safeguard duties have not moved anywhere. Treat the delay as a planning window, not a reprieve.

Start training free at Forge University