HIPAA Security Rule Amendments Now Projected for July 2027

According to Reginfo.gov, the U.S. Office of Management and Budget's website for the federal regulatory process, the new Final Action Date – the projected publication date of the final Health Insurance Portability and Accountability Act (HIPAA) Security Rule – is July 2027.

In January 2025, the U.S. Department of Health and Human Services' Office for Civil Rights (OCR) published a proposed rule to strengthen the HIPAA Security Rule. The proposal responded to substantial increases in large-scale data breaches – those affecting 500 or more individuals – reported to OCR between 2018 and 2023.

Read more about the proposed rule.

Although OCR characterized the proposed rule as primarily adding detail to existing HIPAA Security Rule requirements, it marked significant changes from the original rule, prompting criticism from provider organizations and other stakeholders. It is unclear how the current administration will respond to those criticisms, but it appears that we may have to wait another year to find out.