2026 HIPAA Security Rule Update: Mandatory Encryption, MFA, and 72-Hour Reporting Requirements for Healthcare Organizations

Summary

The 2026 HIPAA Security Rule update introduces major compliance changes for healthcare organizations, including mandatory encryption of ePHI at rest and in transit (removing the previous "addressable" designation), required multi-factor authentication for all systems accessing ePHI, a strict 72-hour incident reporting requirement, annual penetration testing, and enhanced business associate oversight obligations. Proposed by HHS in late 2025, this represents the most significant overhaul of HIPAA security requirements since the original rule. Healthcare organizations need to begin preparations immediately by assessing their current security posture against these new mandates.