HIPAA Privacy, Security and Breach Notification Rules: what is final, proposed or vacated in 2026

The HIPAA Privacy, Security and Breach Notification Rules (45 CFR Parts 160 and 164) govern PHI use, ePHI safeguards and breach notice, and all three are final and in force. A stricter Security Rule proposed in January 2025 is still a proposal, targeted for July 2027.

This guide is for compliance managers at US covered entities, business associates and GCC vendors handling US patient data.

What do the three HIPAA rules cover, and who must follow them?

HHS defines each rule as Part 160 plus Part 164 Subpart A and one more subpart. That is Subpart E for the Privacy Rule, C for the Security Rule and D for the Breach Notification Rule. PHI is protected health information, and ePHI is its electronic form.

The rules apply to covered entities: health plans, health care clearinghouses, and providers that transmit health information electronically in a HIPAA standard transaction (45 CFR 160.103). They also apply to business associates, which create, receive, maintain or transmit PHI for a covered entity, or provide services involving PHI such as billing or data analysis. Their subcontractors are business associates too.

Under the HITECH Act and HHS's 2013 rule, business associates are directly liable to OCR, the HHS Office for Civil Rights. Failures include ignoring the Security Rule or not reporting a breach. State laws more stringent than the Privacy Rule still apply (45 CFR 160.203).

Which HIPAA rules are final, proposed or vacated?

Status on 4 October 2026:

The Texas court vacated most of the reproductive health rule, but only paragraphs (F) to (H) of the privacy notice rule, 45 CFR 164.520(b)(1)(ii). The other notice changes, including the Part 2 content, stand. The intervenors had their own appeal dismissed on 10 September 2025.

A trap remains: the eCFR still prints the vacated attestation section (45 CFR 164.509) and the reproductive health care definition, as no rule has removed them.

What would the proposed Security Rule change?

HHS published the proposal at 90 FR 898, and its fact sheet says the current Security Rule remains in effect. As HHS describes it, the proposed rule would require:

• all implementation specifications, with limited exceptions, and written documentation
• an asset inventory and network map, reviewed at least every 12 months
• encryption of ePHI at rest and in transit, and multi-factor authentication
• vulnerability scans every 6 months, penetration tests every 12 months, and network segmentation
• written procedures to restore critical systems and data within 72 hours of a loss
• an annual compliance audit, and annual written verification of technical safeguards from business associates
• notice within 24 hours when a business associate activates its contingency plan, or when workforce access changes

A final rule would take effect 60 days after publication, with compliance 180 days later. Until then, assess yourself against the rule in force.

What are the HIPAA breach notification deadlines?

Any impermissible acquisition, access, use or disclosure of PHI is presumed to be a breach. Exceptions are three narrow exclusions, or a documented risk assessment showing a low probability of compromise. The assessment weighs at least four factors: the PHI involved, who received it, whether it was actually acquired or viewed, and mitigation (45 CFR 164.402). PHI encrypted to the HHS standard is not "unsecured", so it needs no notice.

The clock starts at discovery: the first day any workforce member or agent, other than the person responsible, knew or should reasonably have known. The deadlines in Subpart D are:

• Individuals: without unreasonable delay and no later than 60 calendar days after discovery, with five required elements (164.404).
• Media: if more than 500 residents of one state or jurisdiction are affected, prominent outlets there, within the same 60 days (164.406).
• HHS, 500 or more individuals: at the same time as the individual notices (164.408(b)).
• HHS, fewer than 500: log each breach and report within 60 days after the end of the calendar year of discovery (164.408(c)).
• Business associate to covered entity: without unreasonable delay and within 60 days of discovery, naming each affected individual where possible (164.410).
• Law enforcement delay: as long as a written request states, or up to 30 days for a documented oral request not confirmed in writing (164.412).

Sixty days is an outer limit, not a target. You carry the burden of proving that you notified, or that no breach occurred (164.414(b)).

What do OCR investigations focus on, and what are the penalties?

Risk analysis comes first. In April 2026 OCR settled four ransomware investigations for $1,165,000, all involving risk analysis failures. They included Consociate, a business associate, and Assured Imaging, whose case also covered late breach notice.

In September 2026 Ambry Genetics paid $700,000 after a phishing breach affecting 225,370 people. Its corrective action plan shows what OCR expects: a new risk analysis, a risk management plan, revised Security Rule policies, unique user IDs and workforce training.

The Security Rule requires risk analysis, risk management and periodic evaluation (45 CFR 164.308). For an addressable specification, you implement it, adopt an equivalent alternative or document why neither is reasonable (164.306(d)). An ISMS built to ISO/IEC 27001:2022 can feed this work, but HIPAA's specifications need their own records.

You must also act on an access request within 30 days, with one 30-day extension on written notice (164.524(b)(2)). Azul Vision paid $50,000 in August 2026 after taking almost two years over one request.

Civil money penalties have four culpability tiers (45 CFR 160.404). For penalties assessed from 28 January 2026, the maximum per violation is $73,011 in tiers 1 to 3 and $2,190,294 in tier 4, also the calendar-year cap for identical violations. Under a 2019 enforcement notice, HHS applies lower annual caps of $25,000, $100,000 and $250,000 to tiers 1 to 3, before inflation adjustment. Figures change yearly, so check 45 CFR 102.3.

Does HIPAA reach vendors and platforms in the GCC?

It can, through the business associate route. Status depends on the function you perform for a covered entity, and the definition contains no location condition. That is AGS's reading of 45 CFR 160.103, so confirm it with counsel.

HHS's cloud computing guidance allows a cloud provider that stores ePHI outside the US, with a business associate agreement in place. It warns that overseas outsourcing may increase risks and raise enforceability issues, which belong in the risk analysis. A provider holding only encrypted ePHI without the key is still a business associate.

For a GCC vendor, that means:

• a business associate agreement with the 45 CFR 164.504(e) contents, such as safeguards, breach reporting, subcontractor flow-down and return or destruction of PHI
• your own Security Rule programme, because you are directly liable for it
• an incident process that can meet the 60-day notice to each covered entity client
• for telehealth platforms, the full rules: the COVID-era enforcement discretion ended on 9 August 2023

In the UAE, Article 13 of Federal Law No. 2 of 2019 keeps data on health services provided in the UAE inside the country, unless a health authority decision, in coordination with the Ministry, allows otherwise. Article 24 sets a fine of AED 500,000 to 700,000. This is the 2019 text, so check for later amendments.

In AGS's reading, one firm can face HIPAA on US clients' PHI and UAE localisation on UAE care data. Abu Dhabi entities also work to ADHICS, covered in our ADHICS guide.

How AGS can help

The HIPAA Privacy, Security & Breach Notification Management System contains 121 editable Microsoft Word and Excel documents. They include a required versus addressable determination matrix, a risk analysis methodology and worksheet, and ePHI, PHI and information system inventories. For breaches and vendors there is a breach risk assessment form, an individual notification letter template, HHS and media notification checklists, and a business associate agreement template. A HIPAA compliance requirements matrix completes it.

Frequently asked questions

Does HIPAA require encryption?

Not today. Encryption at rest and in transit is addressable under 45 CFR 164.312, so you assess it and document the decision.

Does HIPAA require multi-factor authentication?

The current rule requires person or entity authentication but prescribes no method (164.312(d)). MFA appears only in the 2025 proposal.

Is annual HIPAA training required?

The Privacy Rule requires training for all workforce members as appropriate for their functions, with no interval set (164.530(b)).

How long must HIPAA documentation be kept?

Six years from creation or the date it was last in effect, whichever is later (164.316(b)(2) and 164.530(j)). This covers HIPAA documentation, not medical records.

AGS provides independent documentation toolkits. HHS, OCR and UAE health authorities are named for identification only. AGS is not affiliated with, endorsed by or approved by any of them. The kit is designed to support HIPAA requirements and does not guarantee compliance, and this guide is not legal advice.

Reviewed October 2026. Facts checked against the sources current at publication.