Health Care / Privacy, Cyber & Data Strategy Advisory | HIPAA Security Rule: Still On Track For Finalization

Executive Summary

2 Minute Read

Our Health Care and Privacy, Cyber & Data Strategy groups review the status of the proposed update to the HIPAA Security Rule.

• The proposed changes to the HIPAA Security Rule include prescriptive, strict security requirements
• The rule's finalization remains on the Department of Health and Human Services Office for Civil Rights' regulatory agenda for May 2026
• Stakeholders should prepare for what could be a transformational change to their HIPAA security programs

Since the Department of Health and Human Services Office for Civil Rights' (OCR) publication of a proposed rule to overhaul the HIPAA Security Rule in January 2025, many in the health care privacy community have wondered whether the rule would quietly fade away. Some even hoped it might be dead in the water. However, despite sharp criticisms and industry pushback, recent developments confirm that the OCR has kept the rule's finalization on its official