HIPAA Security Rule Final Rule: May Deadline Passes With No Announcement

OCR set May 2026 as its target for publishing the HIPAA Security Rule final rule. May is here. No announcement has been made.

This is not unusual — federal regulatory agendas are targets, not guarantees. Agencies miss them routinely, particularly when proposed rules face significant industry opposition or administrative headwinds. But the silence is notable given how closely the healthcare industry has been watching this particular rulemaking.

Where things stand right now

A final action is still listed for May on HHS OCR's regulatory agenda, though federal agencies routinely extend those deadlines, and the next agenda update is expected shortly.

The proposed rule — published December 27, 2024, in the final days of the Biden administration — would represent the most significant update to the HIPAA Security Rule since the original rule took effect in 2005. Its core proposals include mandatory encryption of ePHI at rest and in transit, required multi-factor authentication, annual penetration testing, documented asset inventories and network maps, and 72-hour system restoration objectives.

It remains to be seen whether the Trump administration will view the benefits of the proposed rule as worth the short term financial and administrative pain of implementation. Based on the feedback received, the proposed rule could be slimmed down to reduce the compliance burden, although doing that would water down the protections. If the final rule is released, OCR could extend the timeframe for compliance to ease the burden on HIPAA-regulated entities.

Three scenarios playing out simultaneously

Scenario 1 — Published in May as scheduled OCR could still publish a final rule before the end of the month. Given the regulatory agenda listing, this remains possible. If published, it would likely differ from the NPRM in some respects — particularly around implementation timelines — reflecting the substantial industry feedback received during the comment period.

Scenario 2 — Delayed to later in 2026 or 2027 The most likely near-term outcome given the silence. A delay would allow OCR to continue reviewing comments, potentially negotiate a more scaled-back version of the rule, and give the administration more time to assess the political calculus of finalizing a $9 billion compliance mandate.

Scenario 3 — Withdrawn or significantly scaled back The HIPAA update was proposed by OCR under the Biden administration, and the new Trump administration may choose to do nothing with the update, as was the case with the HIPAA Privacy Rule update proposed by the previous Trump administration, which was shelved by OCR under the Biden administration.

What OCR is doing regardless of the final rule

Here is the critical point that gets lost in the final rule coverage: OCR is not waiting for a final rule to enforce strong security expectations.

Whether the NPRM is finalized, revised, or rescinded, OCR is actively enforcing the rules that exist today — and the bar it is applying is whether your organization has a functioning, continuous risk management program. Not a point-in-time assessment. Not a binder of policies. A living program.

OCR Director Paula Stannard has been explicit about this. Even if the proposed rule does not make it to a final rule, Stannard said there have already been benefits from the proposed rule. "The proposal to modify the Security Rule helped put a spotlight on information security in the healthcare system and drew attention to the need for better compliance and to take cybersecurity seriously."

The six enforcement actions OCR has taken in 2026 — all citing risk analysis and risk management failures — demonstrate that the agency's enforcement posture does not depend on the final rule. The existing Security Rule, enforced with increasing rigor, is sufficient to generate significant penalties for organizations with inadequate security programs.

The asset inventory question

You cannot manage risk to electronic protected health information you have not fully accounted for. Every system, application, device, and data flow that touches ePHI needs to be in scope — including the ones that have been quietly accumulating through acquisitions, new vendors, and technology changes.

This is where most organizations have the largest gap — not in their policies, but in their knowledge of what systems actually exist and what ePHI they contain. The proposed rule would make asset inventories and network maps a formal requirement. Under the existing rule, they are essential to completing the risk analysis that OCR already requires and enforces.

What to do right now

The regulatory uncertainty does not change the operational advice. Organizations that are waiting for final rule publication before acting are making a strategic mistake regardless of which of the three scenarios plays out.

If the rule is published this month: Organizations that have already begun implementing encryption, MFA, and asset inventories will need only to formalize and document what they have done. Organizations that have not started will face a compressed 180-day implementation window.

If the rule is delayed: The time created by a delay is preparation time. Every month of delay is an additional month to close gaps that OCR is already enforcing under the existing rule.

If the rule is withdrawn: The underlying security expectations remain. OCR's enforcement data from 2024 through 2026 makes clear that the agency expects encryption, strong access controls, documented risk analyses, and active risk management regardless of whether those expectations are codified in a new rule.