The upcoming HIPAA Security Rule update expected in May 2026 may be the most significant overhaul in more than a decade.

This is not a minor compliance tweak. It represents a shift toward demonstrable, operational cybersecurity across healthcare organizations and their vendors.

If your organization records calls, stores messages in portals, routes PHI through cloud platforms, uses remote support agents, or relies on vendors for security, you are in scope.

What's Likely Coming

Early indicators point to stricter expectations around MFA, encryption, formal risk analysis, penetration testing, vendor oversight, and faster recovery timelines.

Multi-Factor Authentication

Expect MFA to become a default expectation for systems that access or process electronic protected health information.

Encryption Expectations

Encryption at rest and in transit will be harder to treat as optional or compensating-control territory.

Formal Risk Analysis

Organizations will need to show documented assessments, evidence of mitigation, and an ongoing program instead of checklist-only compliance.

The Bigger Shift

Documentation alone will not be enough. Security programs will need to be implemented, measured, and continuously improved.

The Bottom Line

Now is the time to evaluate your security posture and make sure your organization is ready for the next phase of healthcare cybersecurity regulation.