HIPAA Final Rule Updates: Security, Part 2, and Enforcement

Recent HIPAA final rule updates cluster into three tracks with very different statuses: the 2024 reproductive health privacy rule was vacated nationwide in June 2025 and is no longer in effect; the proposed overhaul of the HIPAA Security Rule, published in January 2025, remains under review and has not been finalized; and the alignment of 42 CFR Part 2 substance use disorder records with HIPAA reached its compliance deadline on February 16, 2026, and is now being actively enforced by the HHS Office for Civil Rights.

Reproductive Health Privacy Rule Is No Longer In Effect

HHS published the “HIPAA Privacy Rule to Support Reproductive Health Care Privacy” on April 26, 2024, in response to concerns after Dobbs v. Jackson Women’s Health Organization that medical records could be used to investigate people for lawful reproductive care.¹ It barred covered entities and business associates from using or disclosing PHI to investigate or impose liability on anyone for seeking, obtaining, providing, or facilitating reproductive health care that was lawful under the circumstances in which it was provided. It also added an attestation requirement for certain PHI requests and required updates to Notices of Privacy Practices.²

On June 18, 2025, Judge Matthew Kacsmaryk of the U.S. District Court for the Northern District of Texas vacated the rule nationwide in Purl v. United States Department of Health and Human Services. The court found that HHS had exceeded its statutory authority, including by limiting state authority over public health investigations and child abuse reporting in a way HIPAA does not permit.³⁴ The Trump administration, which took office in January 2025, did not defend the rule on the merits and instead challenged only standing and the scope of relief.⁵ The Fifth Circuit dismissed the appeal on September 10, 2025, leaving the vacatur intact.⁶

The practical effect: the prohibition on reproductive health disclosures, the attestation requirement, and the related privacy notice updates are all gone. Organizations that had already updated policies, trained staff, revised business associate agreements, and modified their Notices of Privacy Practices had to reverse those changes and return to the pre-rule framework.⁷ Entities that had already distributed updated notices were advised to send corrected versions within 60 days of the material change.⁸ The court did preserve, by severing them, the provisions requiring notice updates tied to substance use disorder records, since those came from a separate rulemaking.³

One boundary worth flagging: the vacatur removed federal HIPAA protections specific to reproductive health, but state privacy laws still apply. Some states, including California, have their own restrictions on disclosing abortion-related information.⁸

The Proposed Security Rule Overhaul Is Still In Review

On January 6, 2025, HHS published “HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information,” the most significant proposed update to the Security Rule since 2013.⁹ The proposal would replace the current flexible framework with a prescriptive one by eliminating the distinction between “required” and “addressable” implementation specifications and making nearly all safeguards mandatory.¹⁰

What Would Change

If finalized as proposed, regulated entities would face a much longer list of concrete obligations:

Mandatory encryption of electronic PHI at rest and in transit, with limited exceptions.
Multi-factor authentication for access to systems containing ePHI, with limited exceptions.
An ongoing technology asset inventory and a network map showing how ePHI moves through the organization, updated at least annually.
Vulnerability scans at least every six months and penetration testing at least every twelve months.
More detailed written risk analyses identifying all reasonably anticipated threats and vulnerabilities.
Procedures capable of restoring systems and data within 72 hours of an incident.
Internal compliance audits at least every 12 months.
Annual written verification from business associates that they have deployed the required technical safeguards.¹⁰

Industry Response and Current Status

The public comment period closed March 7, 2025, and drew 4,747 comments.⁹¹¹¹²

Cost is central to the objections. HHS’s own regulatory impact analysis put first-year compliance costs at roughly $9 billion, with recurring costs of about $6 billion in years two through five, and industry commenters argued those figures were still too low.¹¹ The National Rural Health Association called mandatory encryption, MFA, and continuous documentation “cost-prohibitive” for small and rural facilities and asked HHS to extend the compliance window to at least three years, rather than the 180 days proposed.¹³

OCR’s Spring 2025 Unified Agenda listed a May 2026 finalization target, but OCR Director Paula M. Stannard confirmed at HIMSS 2026 that comment review is still ongoing. If finalized as proposed, regulated entities would have 240 days from publication to comply: 60 days until the rule takes effect and 180 days after that to reach compliance.¹²¹⁴ Whether the final rule will be scaled back is still unresolved.

Substance Use Disorder Records Are Now Aligned With HIPAA

Separately, HHS finalized a rule on February 16, 2024, aligning the confidentiality regulations for substance use disorder patient records under 42 CFR Part 2 with the HIPAA Privacy Rule and the HITECH Act, as required by Section 3221 of the CARES Act.¹⁵ The main changes:

Patients can now give a single consent covering future uses and disclosures for treatment, payment, and health care operations, rather than a separate consent for each disclosure.
A new category of “SUD counseling notes,” analogous to psychotherapy notes under HIPAA, requires separate consent.
Part 2’s older criminal penalty structure is replaced with HIPAA’s civil and criminal enforcement framework.
Part 2 records are now subject to the HIPAA Breach Notification Rule.
Part 2 records still cannot be used in legal proceedings against a patient without specific consent or a court order, preserving a protection that goes beyond standard HIPAA.¹⁵

The rule took effect April 16, 2024, with a compliance deadline of February 16, 2026.¹⁶¹⁷¹⁸

What OCR Is Actually Enforcing

OCR’s enforcement work in 2025 and early 2026 has concentrated on cybersecurity failures, particularly ransomware, hacking, and inadequate risk analysis. The agency’s “Risk Analysis Initiative” targets entities that failed to conduct adequate security risk assessments. Recent actions include a $1.5 million civil money penalty against Warby Parker tied to credential-stuffing breaches affecting nearly 198,000 individuals between 2018 and 2022, an $800,000 settlement with BayCare Health System over access controls that let a former employee view medical records, and a $3 million settlement with Solara Medical Supplies over a phishing attack.¹⁹²⁰²¹

OCR has also restarted HIPAA compliance audits for the first time since 2017. The third audit phase, announced in March 2025, is examining 50 covered entities and business associates with a focus on Security Rule risk analysis and risk management. Results have not been published.²²

The 2021 Patient Access Proposal Remains Pending

One other HIPAA rulemaking is worth knowing about because it has been sitting unresolved for years. A proposed modification to the Privacy Rule published in January 2021 would shorten the maximum time to provide patients access to their records from 30 days to 15 days, require covered entities to post fee schedules online, and let patients inspect their records in person and take notes or photographs.²³ The proposal drew over 1,400 comments and has never been finalized or formally withdrawn. A Tribal Consultation meeting was scheduled for February 2026, suggesting the current administration may still be weighing it.²⁴

1
Federal Register. HIPAA Privacy Rule To Support Reproductive Health Care Privacy
2
HHS.gov. Final Rule Fact Sheet: HIPAA Privacy Rule To Support Reproductive Health Care Privacy
3
Groom Law Group. Texas Judge Vacates HIPAA Reproductive Health Care Rule
4
HK Law. HIPAA’s Reproductive Health Rule Is Vacated Nationally
5
Georgetown Law. Purl’s HIPAA Ruling Rolls Back Essential Reproductive Privacy Protections Nationwide
6
American Health Law Association. Appeals Closed: HIPAA Reproductive Health Care Privacy
7
Quarles & Brady. HIPAA Reproductive Health Rule Vacated Nationally
8
Stinson LLP. Federal Court Strikes Down HIPAA Reproductive Health Privacy Rule
9
Federal Register. HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information
10
HHS.gov. HIPAA Security Rule NPRM Fact Sheet
11
CHIME. CHIME Comments to HHS on Proposed HIPAA Security Rule
12
Compliancy Group. Proposed HIPAA Security Rule Update
13
National Rural Health Association. NRHA Comments on HIPAA Security Rule NPRM
14
Alston & Bird. HIPAA Security Rule Overhaul
15
HHS.gov. Fact Sheet: 42 CFR Part 2 Final Rule
16
American Psychiatric Association. 42 CFR Part 2
17
HHS.gov. Part 2 Information
18
HIPAA Journal. February 16, 2026 Compliance Deadline: Part 2 Final Rule
19
HHS.gov. Penalty Against Warby Parker
20
Nixon Peabody. 2025 HIPAA Enforcement Tally Rises Following Three New Settlements
21
HHS.gov. Enforcement Highlights
22
HHS.gov. HIPAA Audit Program
23
Federal Register. Proposed Modifications to the HIPAA Privacy Rule To Support and Remove Barriers to Coordinated Care
24
HIPAA Journal. HIPAA Updates and Changes