HIPAA Changes in 2027: What Healthcare Organizations Need to Do Now

Picture a practice manager named Dana. This is an illustration, not a real client. It is 7:40 on a Tuesday morning, the coffee is still too hot, and a headline on her phone says HIPAA is changing in 2027. She sighs and sets the phone face down next to the front desk.

Right beside it sits a printed email from a patient. It asks for a copy of her records. It arrived three weeks ago, and nobody has answered it yet.

The headline is about next year. The email is about this month, and it is the one an investigator would ask about first. If you have felt that pull, I get it. Regulatory news is loud. The work that protects you is usually sitting in your inbox.

So here is how to sort the noise from the work.

What HIPAA changes are actually coming in 2027?

Twice a year, federal agencies publish the Unified Agenda, a list of the rules they are working on and the month they hope to act. Those months are planning targets. They slip often, and none of them is a compliance deadline. A rule only binds you once a final rule is published in the Federal Register with its own effective date and compliance date.

Here is where the three big HIPAA items stand on the current agenda, checked on October 26, 2026:

(Sources: RIN 0945-AA22, RIN 0945-AA28, RIN 0945-AA00)

Notice that last row. The care coordination target came and went. That is normal, and it is why you plan around what is final, not what is forecast.

The Security Rule overhaul is still a proposal

We covered the proposed Security Rule changes in detail in our 2026 HIPAA Security Rule overhaul breakdown, so I will not repeat the whole list here. The update for 2027 is the timeline. In the spring 2025 agenda, HHS listed the final rule for May 2026. In the current agenda, the rule moved to the long-term actions list with a target of July 2027. (Source: RIN 0945-AA22, spring 2025 entry)

One proposal deserves a plain reminder because it is often misread. The proposed rule would remove the distinction between required and addressable safeguards. That has not happened. Today, an addressable safeguard is still not optional. You must implement it if it is reasonable and appropriate for your organization. If it is not, you must document why and put an equivalent alternative measure in place if that is reasonable and appropriate. (Sources: Proposed rule, 90 FR 898, 45 CFR 164.306(d))

Patient records requests: the 30-day clock may get shorter

This is the change most likely to land on the front desk, so it is the one I would watch.

Today, when a patient asks for their records, you must act no later than 30 days after you receive the request. You may take one extension of up to 30 more days, but only if you tell the patient in writing, within the first 30 days, why you are delayed and when you will finish. (Source: 45 CFR 164.524(b)(2))

The new agenda item, titled "HIPAA Privacy Rule to Promote Individuals' Timely Access to their Protected Health Information," says the proposals "would address the amount of time that covered entities have to respond to requests." HHS has not published that proposal yet, so nobody knows the new number. For context, the 2021 Privacy Rule proposal would have cut the clock to 15 calendar days with one 15-day extension. (Sources: RIN 0945-AA28, Proposed rule, 86 FR 6446)

OCR is already enforcing the current clock. In August 2026, OCR announced that Azul Vision, a California eye care provider, paid $50,000 after a patient waited almost two years for records she requested in January 2023. In October 2026, OCR announced that Shen Smiles, a Pennsylvania dental practice, agreed to pay $140,000 after OCR found it had no right of access policies and had not reasonably safeguarded patient records. Those were the 55th and 56th actions in OCR's Right of Access Initiative. (Sources: HHS, Azul Vision, HHS, Shen Smiles)

The lesson is simple. If you cannot meet 30 days reliably now, a shorter clock will hurt. If you can, you are already most of the way there.

The Privacy Rule care coordination rewrite is still pending

The 2021 proposal would strengthen patient access rights, ease information sharing for care coordination, and widen family and caregiver involvement during a health crisis. It has been on the agenda for years. HHS held a Tribal consultation on it in February 2026, which tells you the work is active. It does not tell you when, or whether, a final rule will appear. (Sources: RIN 0945-AA00, Tribal consultation notice, 91 FR 1481)

What already changed in 2026, and is easy to miss

While everyone watched the proposals, two final changes arrived quietly.

Your Notice of Privacy Practices. As of February 16, 2026, HHS says HIPAA covered providers and health plans must include information about substance use disorder records protected by 42 CFR Part 2 in their notice, with more detail required if you create or maintain those records. HHS revised its model notices in February 2026 to help. Separately, a federal court vacated most of the 2024 reproductive health privacy rule in June 2025, but the remaining notice changes still apply, and compliance with them was required by February 16, 2026. When your notice changes materially, you must promptly revise and distribute it. (Sources: HHS Model Notices, HHS, Part 2, HHS, reproductive health rule status, 45 CFR 164.520, 42 CFR Part 2)

Claims attachments. In March 2026, HHS finalized a standard for electronic health care claims attachments and electronic signatures. It took effect May 26, 2026, and compliance is required by May 26, 2028. Most practices will feel this through their billing company or clearinghouse, so the right move is a question, not a project. (Source: Final rule, 91 FR 14350)

What the 2026 enforcement record says about 2027

OCR's 2026 settlements keep returning to one requirement: the risk analysis.

In February 2026, an Illinois substance use disorder treatment provider paid $103,000 after a phishing attack exposed records for 1,980 patients and OCR found no accurate and thorough risk analysis. In April 2026, OCR announced four ransomware settlements totaling $1,165,000, affecting more than 427,000 people. As OCR Director Paula M. Stannard put it, you cannot protect electronic patient information if you have not identified the risks to it. (Sources: HHS, Top of the World Ranch, HHS, four ransomware settlements)

Risk analysis and risk management are both labeled Required in the current Security Rule. No proposal needs to pass for that to matter. (Source: 45 CFR 164.308(a)(1)(ii))

What to do now: four moves before 2027

1. Refresh your risk analysis and date it. If yours is more than a year old, or it predates your current software and vendors, start here. It protects you today, and the proposed Security Rule builds on it. Our HIPAA risk assessment guide walks through it step by step.
2. Put your records requests on a log. Write down the date each request arrives and the date you complete it. That is exactly what OCR asked Azul Vision to report in its corrective action plan. If your average is close to 30 days, fix the workflow now, before any shorter clock arrives.
3. Compare your Notice of Privacy Practices to the February 2026 model notices. Check the substance use disorder language, then post the updated notice on your website and at the front desk.
4. Ask your vendors two questions. Ask your billing company or clearinghouse how it is preparing for the claims attachments standard. Ask your IT and software vendors what they would change if the Security Rule proposal is finalized. Our HIPAA compliance checklist covers the rest of the vendor review.

For the full picture of what HIPAA requires this year, see our HIPAA compliance guide for 2026.

Compliance is a living thing

Back to Dana. The headline was real, but the email was urgent. Rules will keep changing in 2027 and beyond. That is a reason to build habits that keep you current, not a reason to panic: a risk analysis you update, a records process you can show, and a notice that matches the law.

We have done this since 2010 for 500+ healthcare organizations, with a 100 percent audit success rate. Audit-ready in 60 days, or we keep working at no additional cost until you are.

Get My Audit-Readiness Score and see where your practice stands before 2027 arrives.