2026 HIPAA Security Rule Changes: What Hospital IT Teams Need to Implement Now

The biggest overhaul to the HIPAA Security Rule since its inception is here. If you work in hospital IT, health system infrastructure, or healthcare security engineering, these changes directly affect your architecture decisions and implementation timelines. What Changed and Why It Matters HHS finalized major updates to 45 CFR Part 164 (the HIPAA Security Rule) that eliminate many of the "addressable" implementation specifications that previously gave organizations flexibility. For hospitals, this means several controls that were optional are now mandatory. The 6 Critical Changes for Hospital IT 1. Encryption Is Now Required (Not Addressable) Previously, encryption was an "addressable" specification — you could document why an alternative was reasonable. That's over. // What this means in practice: - All ePHI at rest: AES-256 encryption minimum - All ePHI in transit: TLS 1.2+ required - Database-level encryption for EHR systems - Full-disk encryption on all endpoints - Encrypted backup