The HIPAA Security Rule update slipped to 2027. Here's what dental practices should do now
If you've been waiting to see what the new HIPAA Security Rule will require before changing anything in your practice, you have more time than you expected, and you don't need all of it.
The Office for Civil Rights at HHS had targeted May 2026 to finalize its overhaul of the Security Rule. That date has passed. The updated federal regulatory agenda now shows final action no earlier than July 2027, and the rule's status moved from "final rule stage" to "long-term actions." Agency timetables aren't binding, so it could come sooner, later, change, or not happen at all.
The current rule still applies
This part is easy to miss in the headlines. The delay doesn't pause anything. The existing HIPAA Security Rule remains in force, and OCR has said its cybersecurity enforcement already looks at risk management, not only whether a risk analysis exists on paper.
So the question for a dental office isn't "what will the new rule make us do?" It's "are we doing what the current rule expects, and would we be ready if the proposal lands roughly as written?"
What the proposal would change
HHS published the proposed rule in January 2025. Its fact sheet and the legal summaries since then describe a few big shifts. Here they are in plain terms.
An inventory and a map. Practices would keep a written list of the technology that touches patient data (computers, the server, imaging equipment, software, cloud services) and a network map showing how that data moves. Both would be reviewed at least once every 12 months.
A more specific risk analysis. The written risk analysis would have to start from that inventory and map, and walk through the threats and weak spots for each system.
Multi-factor sign-in and encryption as requirements. Today some of these safeguards are "addressable," which leaves room to document why you chose something else. The proposal would make multi-factor authentication and encryption of patient data, at rest and in transit, firm requirements with limited exceptions.
Network segmentation. Only the systems that need access to patient data would have it.
A 72-hour restore plan. Practices would need written procedures to restore critical systems and data within 72 hours of a loss.
Faster word from vendors. Business associates, which includes your IT provider, would have to tell you within 24 hours when they activate their own contingency plans.
Why waiting isn't the safe choice
Almost everything on that list is ordinary good practice. Dental offices are being hit right now: Becker's Dental Review had counted 23 dental data breaches reported in 2026 by late September. Attackers don't wait for a final rule.
Each item also helps on its own terms. With multi-factor sign-in on email and remote access, a stolen password alone is no longer enough to get in. A restore plan you've tested is what gets the schedule running again after a bad morning. An inventory is how you find the forgotten computer in the back still holding years of x-rays.
What a practice can do this quarter
None of this needs a big project. Here's a reasonable order.
- Make the list. Write down every computer, the server, imaging devices, the practice software and any cloud services that hold patient information. Note who uses each one.
- Turn on multi-factor sign-in for email and anything that allows remote access. These are the doors attackers use most.
- Check encryption. Laptops and any computer that leaves the building should be encrypted. Ask how backups are encrypted, too.
- Test a restore. Restore a patient chart and its images somewhere safe and time it. Compare that number to 72 hours.
- Update your risk analysis. If it's more than a year old, or was written before your last server or software change, it's due.
- Ask your IT provider for their part in writing: a signed business associate agreement, what they monitor, and how fast they would tell you about a problem on their side.
A note on what we can and can't tell you
We're an IT company, not a law firm. We won't tell you what HIPAA requires of your practice specifically, and if a final rule does come out, read it with your compliance advisor or attorney. Our part is the technical side: putting the safeguards in place, keeping them working and giving you honest documentation of it.
Final thoughts
The delay gives practices breathing room, but it doesn't change the direction. Most of what the proposal asks for is what a careful practice should already be doing: know what you have, lock the front doors with multi-factor sign-in, encrypt what leaves the building, and prove you can restore.
If you'd like a second set of eyes on where your practice stands, we're glad to walk through it with you. We support dental practices in Asheville, Hendersonville and across Western North Carolina.
Source / further reading: Paubox, "HHS pushes final HIPAA Security Rule update to 2027"; HHS fact sheet on the proposed Security Rule; Davis Wright Tremaine on the updated timeframes.
