2026 HIPAA Security Rule Updates: Where a Dental Practice Should Start

What Would Actually Change Under the Proposed 2026 HIPAA Security Rule

The proposed rule, still pending final approval, would update the HIPAA Security Rule for the first time since 2013. The core structure — Administrative, Physical, and Technical safeguards — would stay the same. What would change is the specificity of requirements and the elimination of most 'addressable' (optional) implementation specifications.

Under the current rule, many requirements are labeled 'addressable,' meaning practices can document a reason for not implementing them. The proposed rule would convert most of these to 'required' — you'd either have them or be non-compliant, once it finalizes.

• Multi-factor authentication (MFA): Would become required for all systems accessing ePHI. Currently addressable. This would affect your practice management software, email, and any cloud-based systems.
• Encryption: Would become required for all ePHI at rest and in transit, no longer addressable. If patient data on your server or in your software is not encrypted today, treat this as a gap worth closing regardless.
• Annual Security Risk Analysis: Already required today — the proposed rule would additionally specify that it must be documented, include your specific technology inventory, and be reviewed when your systems change.
• Network segmentation: Would become required for practices with wireless networks accessible to patients. Your patient Wi-Fi should be separated from the network where ePHI lives.
• Incident response planning: Would need to be documented and tested — not just 'we'd call our IT guy.' A written plan with defined roles and timelines.
• Business Associate Agreement updates: Existing BAAs would likely need updates to reference the new requirements once finalized. Vendors would need to contractually confirm their compliance with the new specifications.

Step 1: Find Out Where You Actually Stand (The 10-Minute Self-Check)

Before doing anything else, answer these five questions. Your answers determine which steps are urgent and which can wait.

• Do you have a completed Security Risk Analysis from the last 12 months?: If no — this is your first task. Everything else in HIPAA compliance flows from the SRA. OCR requests it first in every audit.
• Does your practice management software require a login with multi-factor authentication?: If no — contact your software vendor. MFA is expected to become an explicit requirement once the proposed 2026 Security Rule update finalizes, and most major dental software platforms (Dentrix, Eaglesoft, Open Dental) already support it.
• Do you have signed Business Associate Agreements with all vendors who touch patient data?: If unsure — you probably have gaps. Vendors include billing companies, IT support, cloud backup, dental labs that receive digital files, shredding services, and more.
• Is your patient data backed up and encrypted?: If unsure — ask your IT person. Cloud backups via major platforms (Backblaze, Wasabi, AWS) are typically encrypted by default. Local backups on USB drives or external hard drives are usually not.
• Do you have a written breach response plan?: If no — this is a quick fix. A written checklist with the 60-day OCR notification requirement and staff contact assignments takes about 30 minutes to complete with a template.

Step 2: Complete the Security Risk Analysis First

OCR's own guidance is unambiguous: the Security Risk Analysis is the foundation of HIPAA compliance. Every other requirement — MFA, encryption, BAAs, training — should be scoped based on what your SRA reveals about your specific practice.

An SRA for a dental practice documents: every device and system that stores or transmits ePHI, every person who can access that data, every external vendor who receives that data, and the risks associated with each. It does not need to be long. It needs to be accurate and current.

Practices that have a completed, current SRA on file at the time of an OCR investigation almost universally receive better outcomes than those that cannot produce one — regardless of what other gaps the investigation reveals.

Step 3: Address the Technical Requirements in Order of OCR Priority

Once your SRA is complete, it will identify specific technical gaps. Here is the order OCR prioritizes them:

• 1. Multi-factor authentication: Enable MFA on your practice management software, email accounts, and any cloud system storing patient records. Most systems support this in settings — it takes 15 minutes per system.
• 2. Encryption: Confirm your practice management software encrypts data at rest (ask your vendor directly). Ensure any data sent outside your office — to labs, billing companies, specialists — goes over encrypted channels, not regular email.
• 3. Access controls: Each staff member should have their own login — shared passwords are already a HIPAA violation under current law, and a specific gap the proposed 2026 rule would address further. Front desk, hygienists, and clinical staff should have role-appropriate access — not all access.
• 4. Automatic logoff: Workstations accessing patient data must lock after a period of inactivity. Most practice management systems have this setting. OCR checks it.
• 5. Audit logs: Your software should log who accessed which patient records and when. Enable and retain these logs. OCR uses them during breach investigations.

Step 4: Update Your Business Associate Agreements

The proposed 2026 Security Rule update would require Business Associate Agreements to reflect the new requirements once finalized. If your existing BAAs predate 2024, it's worth reviewing them now regardless of the rule's final status.

Start with your highest-risk vendors: your billing company or billing software, your IT support provider, your practice management software company, and any cloud storage or backup service.

For dental practices, the most commonly missing BAAs are with dental labs receiving digital impressions or X-rays, transcription services, and patient communication platforms (appointment reminders, recall systems). These are Business Associates under HIPAA — and many practices don't have BAAs with them.

Step 5: Document Everything and Set a Review Date

OCR does not expect perfection. It expects documentation and good faith. A practice that completed its SRA, addressed its gaps, signed its BAAs, and has staff training records on file — even if minor issues remain — is in a fundamentally different position than a practice that can't produce any documentation.

Once you've completed steps 1–4: file everything in a dedicated HIPAA compliance folder (physical or digital). Set a calendar reminder for 12 months from today to review and update. Note your software versions, vendor names, and any changes in your technology setup.

That folder is what you hand to an OCR investigator. It's also what your malpractice insurance carrier will ask for if a breach claim is filed.