HIPAA News: Latest Rule Changes, Enforcement Actions, and Compliance Updates

Updated October 21, 2026: HIPAA news today is mostly about enforcement and a rule that still isn't final. OCR's latest settlements include Ambry Genetics ($700,000 after a phishing attack) and Shen Smiles ($140,000, its 56th right-of-access action). The proposed Security Rule overhaul is still only a proposal, with final action now projected for July 2027, so the current Security Rule still applies.

Top HIPAA headlines at a glance

These are the items compliance teams should know about right now, starting with the most important.

• Security Rule NPRM: Published January 6, 2025. It is still proposed, and the 2026 Unified Agenda moved final action to July 2027.
• Phishing settlement: Ambry Genetics agreed to pay $700,000 after a phishing attack exposed the health data of about 225,000 patients (announced September 17, 2026).
• Right of access: Shen Smiles, P.C. paid $140,000 in OCR's 56th right-of-access enforcement action (announced October 8, 2026), and Azul Vision paid $50,000 (August 27, 2026).
• 42 CFR Part 2: The compliance date for the Part 2 final rule was February 16, 2026, and covered entities that hold Part 2 records had to update their Notices of Privacy Practices by then.
• Penalty amounts: Under 45 CFR 102.3, the inflation-adjusted maximum is $73,011 per violation for most tiers, with a calendar-year cap of $2,190,294.
• Risk analysis: OCR cited potential risk analysis failures in the Ambry Genetics settlement.

Where does the HIPAA Security Rule update stand?

The Notice of Proposed Rulemaking titled "HIPAA Security Rule to Strengthen the Cybersecurity of ePHI" was published January 6, 2025. The comment period closed March 7, 2025, after more than 4,700 comments were filed. According to McDermott's July 2026 analysis, the 2026 Unified Agenda lists it as a "long-term action" and projects final action for July 2027. The previous agenda had projected May 2026.

What would the proposed rule change?

If it is finalized as proposed, the rule would modernize the HIPAA Security Rule in these ways:

• Encryption: Encryption of ePHI would become a requirement.
• Multi-factor authentication: MFA would become a requirement.
• Asset inventory and network map: You would have to document your technology assets and how ePHI moves through your systems.
• Required vs. addressable: The distinction between required and addressable implementation specifications would be removed.
• Testing cadence: Penetration tests would be required every year and vulnerability scans every six months.
• Oversight: You would have to review your risk analysis every year, verify business associates every 12 months, and run a compliance audit every year.

What does it mean for you today?

None of these proposed items is law yet. Until a final rule is published and takes effect, the current Security Rule applies. Its administrative, physical, and technical safeguards cover covered entities and also business associates, which HITECH section 13401 made directly liable. Under today's rule, "addressable" does not mean "optional." You must assess whether each addressable specification is reasonable and appropriate. If it is, you implement it. If it is not, you document why and implement an equivalent alternative if one is reasonable and appropriate. Adopting MFA, encryption, and asset inventories now can also lower breach risk under the current rule.

Recent OCR enforcement actions (2026)

HHS publishes its resolution agreements and civil money penalties on a single page, last reviewed October 9, 2026. These are the 2026 entries, newest first:

• September 17, 2026: Ambry Genetics agreed to pay $700,000 after a phishing attack exposed the health data of 225,000 patients.
• August 27, 2026: OCR settled a right-of-access investigation with Azul Vision, Inc. for $50,000.
• August 10, 2026 (announced October 8, 2026): OCR settled a Privacy Rule investigation with Dr. Linda L. Shen d/b/a Shen Smiles, P.C. for $140,000.
• July 29, 2026: OCR settled a ransomware investigation with a healthcare system.
• May 20, 2026: Spencer Gifts LLC resolution agreement.
• March 5, 2026: OCR settled its investigation of a breach at MMG Fusion, LLC.
• January 22, 2026: SG Health Plan resolution agreement and corrective action plan.
• June 6, 2025 (announced February 19, 2026): Top of the World Ranch Treatment Center, LLC resolution agreement.

Ambry Genetics: phishing and basic safeguards

In the Ambry Genetics settlement, an attacker used phishing in January 2020 to compromise an employee's email account, exposing the PHI of about 225,370 people. OCR identified potential failures in three areas: risk analysis, ending access when it was no longer needed, and assigning unique user IDs. Ambry agreed to pay $700,000 and to follow a two-year corrective action plan monitored by OCR. The case shows that an investigation can surface failures in basic safeguards years after the original incident.

Why does OCR keep settling right-of-access cases?

Patients must get timely access to their records: within 30 days, with one possible 30-day extension. In the Shen Smiles settlement, a Pennsylvania dental practice said a workforce member had stolen the records. OCR found that the practice had no right-of-access policies and procedures and had not reasonably safeguarded PHI. OCR issued a Notice of Proposed Determination on July 31, 2024, before the matter was resolved for $140,000. It was OCR's 56th action under its Right of Access initiative. In the Azul Vision settlement, a California eye care provider received a patient's records request in January 2023 and did not fulfill it until January 2025. Azul Vision paid $50,000 and agreed to a two-year corrective action plan.

The 2026 actions show two broad patterns. One is cybersecurity investigations that follow breaches. The other is patient-access cases, which can start with a single complaint. As the Shen Smiles case shows, small practices are not exempt from the second category.

Is OCR's audit program changing?

TechSignal reported on October 21, 2026, that an HHS Office of Inspector General report dated October 2, 2026, recommends that OCR strengthen its HIPAA audit program to better protect ePHI. We have not confirmed the report on the OIG's own site. If it is accurate, expect more attention on proactive audits as well as complaint- and breach-driven investigations.

Why does risk analysis matter for OCR enforcement?

Risk analysis is a core Security Rule requirement. The Ambry settlement named potential risk analysis failures, and HHS guidance says you must conduct a risk analysis under 45 CFR 164.308(a)(1)(ii)(A), followed by risk management. The HHS cloud computing guidance applies the same rule to cloud services. A cloud provider that creates, receives, maintains, or transmits ePHI is a business associate, even if it stores only encrypted data and has no key. Keeping ePHI with such a provider without a business associate agreement (BAA) violates 45 CFR 164.308(b)(1) and 164.502(e).

A defensible risk analysis covers every system that touches ePHI, including email, cloud services, and vendor connections. It also ties each risk you find to a documented remediation step. OCR does not endorse or certify specific products, so buying a tool does not replace doing the analysis.

How much are HIPAA penalties in 2026?

HITECH section 13410(d) created four tiers of violations based on increasing culpability, with a statutory cap of $1.5 million for all violations of an identical provision, as summarized in the HHS HITECH enforcement rule overview. That cap is adjusted every year for inflation. The current figures listed in 45 CFR 102.3 for 45 CFR 160.404 are:

• Did not know: $145 to $73,011 per violation; calendar-year cap of $2,190,294.
• Reasonable cause: $1,461 to $73,011 per violation; calendar-year cap of $2,190,294.
• Willful neglect, corrected within 30 days: $14,602 to $73,011 per violation; calendar-year cap of $2,190,294.
• Willful neglect, not corrected: $73,011 to $2,190,294 per violation; calendar-year cap of $2,190,294.

In a 2019 notice of enforcement discretion, issued while rulemaking was pending, HHS said it would apply a different cumulative annual cap to each of the four tiers. HITECH also bars penalties for violations corrected within 30 days that were not caused by willful neglect. Separately, state attorneys general can sue on behalf of their residents for Privacy and Security Rule violations, after giving HHS notice. For more on how fines are set, see our guide to HIPAA violation penalties and fines.

Part 2 and Notice of Privacy Practices updates

The 42 CFR Part 2 final rule, published February 16, 2024, aligns confidentiality protections for substance use disorder records more closely with HIPAA. The compliance date was February 16, 2026. HIPAA covered entities that receive or maintain Part 2 records had to update their Notice of Privacy Practices (NPP) by that date. HHS posts model notices of privacy practices you can use as a reference. If you missed the deadline, update your NPP, internal policies, consent forms, and workforce training now.

Breach notification: what hasn't changed

HIPAA breach timelines

Under the HIPAA Breach Notification Rule (45 CFR 164.400-414), any impermissible use or disclosure of PHI that does not fall under one of three exceptions is presumed to be a breach. That presumption holds unless a four-factor risk assessment shows a low probability that the PHI was compromised. Only unsecured PHI triggers notification, and PHI encrypted or destroyed according to HHS guidance counts as secured. Covered entities must notify:

• Individuals: Without unreasonable delay and no later than 60 days after discovering the breach.
• Media: When a breach affects more than 500 residents of a state or jurisdiction.
• HHS, 500 or more people: Within 60 days of discovery.
• HHS, fewer than 500 people: In an annual log, due within 60 days after the end of the calendar year.

See the basics of the Breach Notification Rule for a step-by-step walkthrough.

What do business associates have to do?

Business associates notify the covered entity, not individuals or the media, without unreasonable delay and no later than 60 days after discovery. The exception is when the covered entity has delegated notification to them. HHS confirms that business associates are directly liable for failing to notify the covered entity, failing to comply with the Security Rule, and failing to sign BAAs with their subcontractors.

Health apps and the FTC

Vendors of personal health records that HIPAA does not cover fall under the FTC's own breach rule, which is authorized by HITECH section 13407. For details, see our post on FTC breach notification for health apps.

What to do now

1. Refresh your risk analysis: Cover every system, vendor, and cloud service that touches ePHI, and record a remediation step for each risk you find.
2. Close the Ambry gaps: Confirm that every user has a unique user ID and that access ends promptly when employment ends. As a further phishing defense, protect email accounts with MFA.
3. Audit right-of-access handling: Write down your process, track each request against the 30-day deadline, and train front-desk staff.
4. Check Part 2 readiness: If you hold substance use disorder records, confirm that your NPP and consent forms reflect the final rule.
5. Review your BAAs: Make sure every cloud provider and other vendor with ePHI has a signed BAA that matches its service agreement.
6. Test your incident response plan: Include breach risk assessments and the HHS reporting timelines.
7. Track the Security Rule NPRM: Plan for encryption, MFA, asset inventories, and testing schedules, but don't treat these proposals as current requirements.

FAQs.

What is the latest HIPAA news today?

As of October 21, 2026, the main stories are OCR settlements and the delayed Security Rule update. OCR announced a $140,000 right-of-access settlement with Shen Smiles on October 8, 2026, which followed a $700,000 settlement with Ambry Genetics in September. Final action on the proposed Security Rule is now projected for July 2027.

Is the new HIPAA Security Rule in effect?

No. The NPRM published January 6, 2025, is still a proposal and is listed as a long-term action. The current Security Rule stays fully in effect, including the requirement to assess every addressable implementation specification.

What HIPAA enforcement actions has OCR announced in 2026?

They include the $700,000 Ambry Genetics settlement over a phishing attack that affected about 225,000 people, Shen Smiles ($140,000), Azul Vision ($50,000), a ransomware settlement with a healthcare system, and resolution agreements with Spencer Gifts, MMG Fusion, and SG Health Plan.

Where can I find HIPAA enforcement news from November 2025 or other past months?

HHS lists every resolution agreement and civil money penalty by date on its official enforcement page. That page is the most reliable record of past months' actions, and this page tracks the 2026 entries and what they mean for compliance.

How long do providers have to respond to a patient's records request?

Providers must give patients access within 30 days and may take one 30-day extension. OCR's right-of-access enforcement actions reached 56 with the Shen Smiles case.

What is the maximum HIPAA penalty right now?

Under 45 CFR 102.3, the highest per-violation amount is $2,190,294, for uncorrected willful neglect. That is also the calendar-year cap listed for each tier. Most tiers have a per-violation maximum of $73,011.