Important HIPAA Changes You Should Know About

Recent updates to the Health Insurance Portability and Accountability Act (HIPAA) represent the most significant shift in healthcare privacy and security requirements in over a decade. Driven by the rise in cyberthreats, increased data sharing, and legislative mandates under the Coronavirus Aid, Relief, and Economic Security Act (CARES), many of the changes came with a Feb. 16, 2026 compliance deadline.

A central development is the alignment of HIPAA with 42 CFR Part 2, which governs the confidentiality of substance use disorder (SUD) treatment records.

The 2024 Final Rule significantly changes this framework by allowing a single patient consent for uses and disclosures related to treatment, payment, and healthcare operations.

This alignment is intended to improve care coordination while reducing administrative burden. It also allows HIPAA-covered entities and business associates to redisclose SUD records in accordance with HIPAA rules, effectively integrating these records into broader clinical workflows. However, this flexibility comes with new compliance obligations, including stricter documentation guidelines, updated consent language, and enhanced enforcement authority by the Office for Civil Rights (OCR).

Another major requirement is the mandatory update to Notices of Privacy Practices (NPPs). As of Feb. 16, 2026, covered entities must explicitly address how SUD records are used and disclosed under the revised rules. Organizations that handle Part 2 data must also issue new patient-facing notices aligned with HIPAA standards.

Beyond privacy, HIPAA is undergoing a substantial transformation on the security side, particularly in response to escalating cyberattacks on healthcare systems. Proposed updates to the HIPAA Security Rule, expected to be finalized later this year, would introduce more prescriptive cybersecurity requirements. These include mandatory multi-factor authentication (MFA), encryption of electronic protected health information (ePHI), and stricter risk analysis and incident response protocols.

The Proposed Rule also emphasizes operational discipline. Covered entities would need to maintain formal data inventories and mapping of ePHI flows, conduct regular vulnerability testing, and implement detailed incident response and disaster recovery plans. In addition, organizations may be required to restore critical systems within defined timeframes (e.g., 72 hours) and perform annual compliance audits. These changes reflect a shift from flexible, “addressable” standards to more mandatory, auditable controls.

Another emerging requirement would involve enhanced oversight of business associates. Under the new framework, vendors handling ePHI may face faster breach notification timelines and stricter contractual obligations.

HIPAA is also evolving to address sensitive categories of health data, including behavioral health – and, more recently, reproductive health information. While some proposed rules in this area remain subject to legal challenges, the broader trend is clear: regulators are placing greater emphasis on limiting inappropriate disclosures and requiring attestations for certain data requests.

The focus is no longer just on protecting patient privacy in isolation, but on enabling secure, coordinated care in a highly digital and interconnected healthcare system. For healthcare organizations, this means moving toward a unified compliance model that integrates privacy, security, and operational workflows, rather than treating them as separate silos.

For RACmonitor readers, the key takeaway is that HIPAA is becoming both more flexible in data sharing and more rigorous in enforcement.