What is the HIPAA Security Rule and why was it delayed?

HHS originally proposed the Security Rule overhaul in December 2024 to strengthen protections for electronic protected health information (ePHI) as cyberattacks and ransomware continued to affect the healthcare sector. The new rule is still under consideration, but HHS has pushed its projected timeline to July 2027 and moved it to its long-term rule-making agenda.

HIPAA Security Rule timeline

\r\n December 2024 : HHS issued its proposed HIPAA Security Rule overhaul

\r\n

\r\n January 2025 : The proposed rule was published in the Federal Register

\r\n

\r\n May 2026 : HHS had previously chosen this date for final action

\r\n

\r\n July 2026 : HHS moved projected final action to July 2027

\r\n

\r\n July 2027 : Current projected timeframe for final action

\r\n

\r\n \r\n The July 2027 date is a projected agency timeframe, not a statutory deadline.…