What Does the 2026 HIPAA Security Rule Update Mean for My Houston Medical Practice?

Here's the short version: the biggest HIPAA Security Rule rewrite since 2003 isn't final yet, and HHS has pushed the expected effective date out to 2027. But the direction is already clear, and the proposed changes are big enough that waiting until it's official is the expensive way to do this. If you run a medical practice, MedSpa, or dermatology clinic in Houston, Dallas, Austin, or San Antonio, the practices getting ahead of this now are the ones who won't be scrambling 12 months from now when the rule actually lands.

Where Things Actually Stand Right Now

HHS published its proposed update to the HIPAA Security Rule in January 2025 — the first major overhaul of the technical safeguards since the rule was written. Since then, the timeline has slipped. HHS has delayed the anticipated final rule, and current guidance points to a compliance window opening around mid-2027 rather than sometime in 2026. That's a meaningful gap, and it's worth knowing so you don't act on outdated urgency you may have read elsewhere.

That said, a delay isn't a cancellation. The proposal reflects where federal regulators and cyber insurers are already pushing healthcare IT, delay or no delay. Several of the practices we work with are already being asked for some of these exact controls by their cyber insurance carriers, well ahead of any HIPAA deadline.

What HHS Is Actually Proposing to Change

The proposed rule would eliminate the old distinction between "required" and "addressable" safeguards. Today, a practice can look at an addressable item, document why it doesn't apply, and move on. Under the proposal, nearly every safeguard becomes mandatory, with only narrow, documented exceptions. Here's what that would mean in practice:

Encryption Becomes Mandatory, Not Optional

Right now, encrypting patient data is technically "addressable." Under the proposal, encrypting ePHI both at rest and in transit would be required outright, with very limited exceptions.

Multi-Factor Authentication Across the Board

MFA would move from a best practice to a baseline requirement for accessing systems that touch patient data — not just email or remote access, but the systems your staff use every day.

Annual Risk Assessments, Documented

A single risk assessment from a few years ago wouldn't satisfy the proposed rule. Practices would need a current, documented risk analysis on an annual cadence, not just "when we get around to it."

Regular Vulnerability Scanning and Testing

The proposal calls for routine vulnerability scanning and periodic penetration testing of the systems that store or transmit patient data, along with tested incident response and disaster recovery plans.

Why Houston Practices Shouldn't Wait for the Final Rule

Three things make waiting a bad bet. First, cyber insurance underwriters are already requiring MFA, encryption, and documented risk assessments before they'll quote a policy — that's happening today, not in 2027. Second, a delayed federal deadline doesn't reduce your current HIPAA exposure; the existing Security Rule and its breach notification requirements are fully enforceable right now. Third, retrofitting these controls under deadline pressure, once the rule is final, will cost more and take longer than building them into your environment gradually over the next year or two.

We'd rather see a Houston practice spread this work out over 12 months than compress it into a 90-day scramble because a compliance date finally landed on the calendar.

What Getting Ahead of This Actually Looks Like

A  14 provider dermatology group in Houston came to us wanting to know where they stood against the proposed rule before it became mandatory. We ran a full risk assessment, found  100 gaps against the proposed requirements, and closed the highest-priority ones — encryption on remaining endpoints and MFA enforcement across their practice management system — within3 weeks weeks. When their cyber insurance renewal came up, their premium held flat instead of increasing 30%

How Scorpion Helps Houston Practices Get Ready

Every managed plan we offer starts with visibility: a documented Monthly Backup Health Report and ongoing endpoint monitoring, so you're never guessing what shape your environment is in. On our Assured and Complete plans, that expands to Managed EDR with 24x7 SOC Response, Cloud Account Security Monitoring, encrypted Microsoft 365 or Google Workspace backup with one-year retention, and Managed DMARC, SPF, and DKIM — the kind of controls the proposed rule is pointing toward, already built into how we run your environment today.

We also run a HIPAA Security Risk Assessment that maps directly to the current Security Rule and flags where the proposed changes would add new obligations, so you know exactly where you stand and what to prioritize — not a generic checklist, but a plan specific to your practice.

We're based in Houston, not answering calls from a script three states away, and every managed client gets our 15-minute guaranteed response time if something needs attention while you're getting ready for what's coming.

A Practical Starting Checklist for Houston Practices

You don't need to solve all of this in one quarter. Here's the order we'd tackle it in if you're starting from scratch:

• Get a current, documented risk assessment. If yours is more than a year old, it won't hold up under the proposed standard — and it may already be thin under the current one.
• Confirm encryption on every device that touches patient data. Laptops, workstations, and any device staff use remotely all need to be covered, not just your servers.
• Enforce MFA everywhere it's available. Email, remote access, practice management software, and any cloud tools — MFA should be the default, not the exception.
• Put vulnerability scanning on a schedule. A one-time scan tells you about today. Recurring scans tell you when something changes.
• Write down your incident response plan and actually test it. A plan nobody has walked through is a plan that won't work under real pressure.

Working through that list now, at a manageable pace, puts you ahead of both the proposed HIPAA rule and most cyber insurance underwriting checklists — which is really the same list stated two different ways.

One more thing worth writing down as you go: who's responsible for each item, and where the documentation lives. When OCR investigates a breach, or an insurer asks for proof during underwriting, "we take security seriously" isn't an answer — a dated risk assessment, a signed incident response plan, and scan reports are. Practices that keep this documentation current, rather than recreating it under pressure, consistently have an easier time with both audits and renewals.

Questions Houston Practices Ask Us About This

"If it's not final, why should I spend money now?" Because the controls being proposed are largely the same controls insurers and OCR investigators already expect informally. Building them in now is cheaper than a rushed retrofit later, and it protects you under the current Security Rule in the meantime.

"Will my current IT setup already cover most of this?" Sometimes. We've seen practices that were 70% of the way there without knowing it, and others with real gaps in encryption or MFA coverage. A risk assessment is the only way to know which one describes you.

"What happens if the final rule changes before 2027?" It might, in the details. But annual risk assessments, encryption, MFA, and tested incident response plans aren't likely to disappear from the final version — they're the direction every major healthcare security framework has been moving for years.

Scorpion Technology has served small businesses and healthcare practices across Houston, Dallas, Austin, and San Antonio for over 19 years. We specialize in HIPAA-compliant IT for medical practices and professional services firms, with a 15-minute guaranteed response time for all managed clients. Our team is local, responsive, and built around keeping your practice running — not just fixing problems when they break. Learn more at ScorpionITSupport.com or call 713-623-1266.