2026 HIPAA Security Rule Changes: What Memphis Practices Must Update

The HIPAA Security Rule hasn’t had a major overhaul since 2013. That’s still coming – just later than first expected. The Department of Health and Human Services (HHS) proposed sweeping updates in late 2024, but HHS has since pushed the final rule’s target date back from May 2026 to July 2027. For dental practices, veterinary clinics, and medical offices across Memphis, that delay doesn’t change the outcome: the compliance bar is about to get significantly higher, just on a longer runway.

The biggest change? The word “addressable” disappears entirely. Every safeguard becomes mandatory. No more documenting why you chose not to encrypt a laptop or why MFA wasn’t feasible for your front desk. If you’re a Memphis practice owner wondering what this means for your operations, your budget, and your timeline, this guide breaks down the specific changes and what you need to do about them.

What’s Changing in the 2026 HIPAA Security Rule (And Why It Matters Now)

The proposed rule, published in the Federal Register on January 6, 2025, represents the most comprehensive update to the HIPAA Security Rule since its adoption. HHS cited a 278% increase in major healthcare data breaches since 2018 as the driving force behind the changes.

Nothing this significant has touched the Security Rule in over a decade. In that time, cloud-based EHRs became the default, telehealth went from a novelty to a routine visit type, ransomware became the top threat facing healthcare data, and Business Associates – billing companies, imaging vendors, IT providers – became deeply embedded in day-to-day operations. The current framework, built for a world of on-premise servers and paper backups, has struggled to keep pace with how practices actually operate today. The 2026 rule is HHS’s attempt to close that gap in one comprehensive pass instead of another decade of incremental guidance.

That timeline slip matters for planning purposes: HHS has moved the rulemaking from its near-term regulatory agenda to a “long-term action” designation, confirming the update is delayed, not shelved – though the extra time also means some of the more contested provisions could still be scaled back before the rule finalizes.

Here’s the timeline every Memphis practice needs to know:

• July 2027 (estimated, delayed from an original May 2026 target): Final rule published in the Federal Register
• 60 days after publication: Rule takes effect
• 240 days after effective date: Full compliance required for all covered entities

That 240-day window sounds generous, but consider what’s involved: implementing MFA across every system that touches patient data, encrypting every device and every data transmission, updating your risk assessment, revising policies, retraining staff, and renegotiating Business Associate Agreements. For a busy practice in Germantown or Bartlett that’s also seeing patients full-time, 240 days goes fast.

“Addressable” Is Gone – Every Safeguard Is Now Mandatory

Under the current HIPAA Security Rule, safeguards fall into two categories: “required” and “addressable.” Required means you must implement it. Addressable means you can evaluate whether it’s reasonable and appropriate for your practice, and if you decide it isn’t, you document why and implement an alternative.

In practice, this created a loophole. Many smaller practices – particularly dental and veterinary offices – used “addressable” as a reason to skip safeguards like encryption and multi-factor authentication. The documentation was often thin or missing entirely. Aesthetics practices operated in an even grayer area, unsure whether HIPAA applied to them at all; if you run one, the med spa HIPAA requirements under the 2026 rule spell out when your practice becomes a covered entity and which safeguards are now mandatory.

The 2026 rule eliminates this distinction. Every implementation specification becomes mandatory. Period.

What this means for your practice:

• Encryption is no longer optional on any device storing or transmitting ePHI
• MFA is required on every system, not just remote access
• Audit controls must produce reviewable logs, not just exist on paper
• Access controls must follow the minimum necessary standard with technical enforcement

The OCR has been signaling this shift for years. In 2026, the OCR Director confirmed that enforcement is expanding beyond risk analysis to include risk management – meaning they’re not just checking whether you identified risks, but whether you actually fixed them. Dental practices have been explicitly called out as needing encryption, Business Associate Agreements, and annual risk assessments.

MFA Everywhere: No More Exceptions for Small Practices

Multi-factor authentication has been an “addressable” safeguard under HIPAA for years. Many Memphis dental offices and vet clinics operate with simple password logins on shared workstations, reasoning that physical access to the office constitutes a form of security.

The 2026 rule makes MFA mandatory for every system that accesses ePHI. That includes:

• Practice management software (Dentrix, Eaglesoft, Open Dental, eVetPractice, Cornerstone)
• Email containing patient information
• Cloud portals for imaging, lab integrations, and patient communication
• Remote access for providers working from home or between locations
• Administrative portals for billing, scheduling, and insurance verification

For a five-operatory dental practice in Collierville, this means every team member – from the front desk to the hygienists – will need to authenticate with a second factor at login. The most common approach is app-based MFA using Microsoft Authenticator or Duo, which adds about 10 seconds per login.

This isn’t just a HIPAA requirement anymore. Cyber insurance carriers already deny 37% of claims due to MFA failures, and MFA is the number-one factor in policy underwriting. Getting MFA in place now checks two boxes simultaneously.

Rolling out MFA smoothly takes more planning than flipping a switch. Practices that treat it as a same-day mandate run into predictable friction: staff locked out mid-shift, front-desk turnover requiring new device enrollment every few months, and shared workstations where nobody has built the login-then-logout habit yet. Practices that avoid this friction stage the rollout – start with administrative and billing logins where the stakes and interruptions are lower, work out the enrollment process, then extend to clinical and imaging workstations once staff are comfortable with the second factor. Budget a short training session for whichever authenticator app you choose; a five-minute walkthrough at a staff meeting prevents the “I can’t get in” calls on day one. If you’re not sure where your practice’s MFA and encryption coverage actually stands, a Security Risk Assessment maps the gaps before you spend a dollar on licenses.

Encryption at Rest and in Transit: What This Means for Your EHR

Encryption requirements under the current rule are addressable. Under the proposed 2026 rule, encryption becomes mandatory in two forms:

Encryption at rest means every device that stores ePHI must have full-disk encryption enabled. This includes:

• Workstations and laptops
• Servers (on-premise or cloud)
• External drives and USB devices
• Backup media
• Mobile devices used to access patient records

Encryption in transit means every data transmission containing ePHI must be encrypted. This covers:

• Email (TLS 1.2 minimum)
• Data syncing between practice management software and cloud services
• Lab result transmissions (IDEXX, Antech, Dexis)
• Patient portal communications
• VPN connections between office locations

For practices running on-premise servers – still common in Memphis dental and veterinary offices – this may require hardware upgrades. Older servers and workstations without TPM 2.0 chips cannot run modern full-disk encryption efficiently. If your practice is running Windows 10 machines from 2018, encryption compliance may coincide with a hardware refresh.

The good news: most cloud-based practice management platforms (cloud Dentrix, eVetPractice cloud) already encrypt data at rest and in transit by default. Your responsibility is ensuring every endpoint that connects to those platforms is also encrypted.

The refresh-versus-repair decision usually comes down to a handful of aging machines, not a full fleet overhaul. Dental practices we work with typically find the oldest hardware sitting at the imaging workstation or the back-office server nobody has touched since installation – exactly the systems flagged in our HIPAA compliance checklist for Memphis dental practices. Veterinary clinics see a similar pattern with in-house lab servers and older Cornerstone installations; our guide to HIPAA compliance for Memphis veterinary practices walks through why these systems matter even when HIPAA’s applicability is unclear.

We’ve made that refresh-or-repair call across 100+ cloud migrations in healthcare, dental, and other regulated industries – enough repetition to size up a workstation in a walkthrough instead of pushing a full-fleet replacement you don’t need.

24-Hour Breach Reporting: The New Business Associate Requirement

The current HIPAA Breach Notification Rule requires covered entities to notify HHS within 60 days for breaches affecting 500 or more individuals. Business Associates have a similar reporting obligation to the covered entity, but timelines have been loosely enforced.

The 2026 rule tightens this dramatically:

• Business Associates must notify the covered entity within 24 hours of discovering a breach or security incident
• Covered entities must notify HHS within 72 hours of learning about the breach
• Annual compliance audits become mandatory for both covered entities and Business Associates

For Memphis practices, this means every vendor relationship needs scrutiny. Your IT provider, your cloud EHR vendor, your billing company, your shredding service – anyone with access to ePHI is a Business Associate, and your BAA with each one must reflect these new timelines.

Questions to ask your current vendors:

1. Can you commit to 24-hour breach notification in writing?
2. Do you have an incident response plan that supports this timeline?
3. When was the last time you tested your breach detection and notification process?
4. Will you update our BAA to reflect the new requirements at no additional cost?

If your vendors hesitate on any of these, that’s a red flag. A vendor that can’t answer clearly today isn’t going to have better answers once the rule takes effect – give them a hard deadline to update their BAA and incident response documentation, and treat a missed deadline as grounds to start evaluating replacements. Your practice, not the vendor, is the one who answers to OCR.

Memphis saw this play out firsthand when the Stryker cyberattack in March 2026 demonstrated how quickly a breach at a medical technology company cascades to local offices.

The 240-day compliance window isn’t just about your practice – it’s about every vendor, partner, and associate in your ePHI ecosystem.

Your 240-Day Compliance Roadmap Starts Now

Don’t wait for the final rule to start preparing – especially with HHS now targeting July 2027 instead of May 2026. The core technical requirements – MFA, encryption, risk assessments, and breach notification timelines – have been consistent through every draft, so the extra runway is for getting it right, not for putting it off. Here’s a practical roadmap for Memphis practices:

Months 1-2: Assess and Plan

• Complete a Security Risk Assessment that covers every system touching ePHI
• Inventory all devices, software, and vendor relationships
• Review every Business Associate Agreement for breach notification language
• Get a baseline on your current encryption and MFA coverage

Months 3-5: Implement Core Controls

• Deploy MFA on all systems accessing ePHI (practice management, email, cloud portals)
• Enable full-disk encryption on every workstation, laptop, and server
• Configure email encryption (TLS 1.2+) and secure file transfer
• Replace hardware that cannot support modern encryption

Months 6-7: Train and Document

• Update your HIPAA policies and procedures to reflect mandatory (not addressable) language
• Train all staff on new authentication procedures and incident reporting
• Execute updated BAAs with all Business Associates
• Document your compliance program for audit readiness

Month 8: Test and Verify

• Conduct a tabletop incident response exercise
• Verify backup encryption and recovery procedures
• Run a mock audit against the new requirements
• Address any remaining gaps before the compliance deadline

We help healthcare practices across Memphis prepare for exactly this kind of regulatory shift. Whether you need a Security Risk Assessment, MFA deployment, or a complete compliance overhaul, we’ll map out a plan that fits your practice size, budget, and timeline.

If you’re a Memphis dental, veterinary, or medical practice wondering where you stand, schedule a free IT assessment and we’ll walk through the gaps together – before the clock starts ticking.