Blog · Compliance · October 14, 2026 · By Mike Parker

HIPAA Security for Orange County Medical and Dental Practices in 2026

The Security Rule your practice must meet is the one in force now, not the update HHS proposed in January 2025. Here is what the current rule requires, where the proposal stands, and the risk analysis OCR keeps citing, plus vendor agreements and backups that survive ransomware.

This is not legal advice. We are an IT and security provider, not a law firm. Every source below is linked so you can read it yourself, and your own health care counsel has the final word on how it applies to your practice.

Who this covers: HHS lists doctors, clinics, psychologists, dentists and chiropractors among the providers that are HIPAA covered entities, “but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard,” such as an electronic insurance claim. Most practices that bill insurance meet it.

1. What the Security Rule requires today

The Security Rule (45 CFR Part 164, Subpart C) protects electronic protected health information, or ePHI (any patient health information your systems create, receive, keep or send). It is flexible: a practice may use any security measures that reasonably and appropriately meet its standards.

Required specifications must be implemented. Addressable ones are not optional: if the practice decides one is not reasonable and appropriate, it must document why and put an equivalent alternative in place where that is reasonable. The core of what applies today:

Risk analysis (required): “an accurate and thorough assessment of the potential risks and vulnerabilities” to the confidentiality, integrity and availability of ePHI.
Risk management (required): security measures that bring those risks down to a reasonable and appropriate level.
Activity review (required): regularly reviewing audit logs and access reports.
Training: a security awareness and training program for the whole workforce, “including management.”
Contingency plan: a data backup plan, a disaster recovery plan and an emergency mode operation plan, all three required. Testing those plans and ranking which systems matter most are addressable.
Technical safeguards: audit controls that record activity in systems holding ePHI, verification that each person signing in is who they claim to be, and encryption (addressable).
Documentation: policies and records kept six years and reviewed periodically.

2. The proposed update: where it actually stands

On January 6, 2025, HHS published a proposed rule, “HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information” (90 FR 898). Comments closed on March 7, 2025. In the most recent federal regulatory agenda, HHS lists the rule under long-term actions, with final action estimated for July 2027. It is not final or enforceable.

It still shows where HHS is heading. HHS’s fact sheet says the proposal would, among other things:

remove the distinction between required and addressable specifications;
require a technology asset inventory and a network map, updated on an ongoing basis and at least once every 12 months;
require multi-factor authentication (a second proof of identity beyond a password) and encryption of ePHI at rest and in transit, each with limited exceptions;
require written procedures to restore certain systems and data within 72 hours;
require vulnerability scanning at least every six months and penetration testing (an authorized simulated attack) at least once every 12 months;
require network segmentation, anti-malware protection and a compliance audit at least once every 12 months;
require business associates to verify their safeguards to covered entities at least once every 12 months.

Final rules often differ from proposals, so treat this as a direction, not a deadline.

Read the proposed rule in the Federal Register → · Check its status at reginfo.gov →

3. The risk analysis is OCR’s top enforcement focus

The HHS Office for Civil Rights (OCR), which enforces the HIPAA Privacy, Security and Breach Notification Rules, runs an enforcement effort it calls the Risk Analysis Initiative. OCR labeled its June 18, 2026 settlement the 14th enforcement action under that initiative. The first step these announcements recommend: identify where ePHI is and how it moves through your systems.

HHS does not prescribe a method. Its guidance lists the elements: scope (all ePHI, on every device and medium), threats and vulnerabilities, current safeguards, likelihood, impact, risk level, documentation and periodic review. The rule sets no frequency; HHS gives annual and as-needed reviews as examples.

For smaller practices, HHS offers the Security Risk Assessment Tool, designed for “medium and small providers.” Its own disclaimer: “Use of this tool is neither required by nor guarantees compliance with federal, state or local laws.”

HHS guidance on risk analysis → · Security Risk Assessment Tool → · OCR, June 18, 2026 →

4. Business associate agreements: every vendor that touches patient data

A business associate is a person or company that creates, receives, maintains or transmits PHI on your behalf. HHS’s examples include a CPA firm with access to PHI, a cloud service provider that stores ePHI, and an IT contractor or vendor, explicitly including a “Managed Services Provider,” whose maintenance or support work requires it to create, receive, maintain or transmit ePHI.

Before any of them handles your patients’ data, HIPAA requires satisfactory assurances in a contract or other written arrangement, the business associate agreement (BAA). Business associates need their own agreements with subcontractors that touch the data. Keep a list of every vendor with access to patient data, with a signed BAA on file for each.

HHS on business associates →

5. Backups that survive ransomware

HHS’s ransomware fact sheet is direct. The presence of ransomware is a security incident under the Security Rule. When ransomware encrypts ePHI, “a breach has occurred because the ePHI encrypted by the ransomware was acquired,” unless the practice can show a low probability that the information was compromised, using the four-factor assessment in the Breach Notification Rule.

The same fact sheet says frequent backups and the ability to recover from them are “crucial to recovering from a ransomware attack,” that entities should consider keeping backups offline and unreachable from their networks, and that test restorations should be run periodically.

If a breach does happen, the Breach Notification Rule sets the clock: patients must be told without unreasonable delay and no later than 60 calendar days after discovery. A breach affecting 500 or more people is reported to HHS at the same time; smaller ones go in a log reported to HHS within 60 days after the end of the calendar year.

HHS ransomware fact sheet → · Breach Notification Rule →

6. Why a year of good practice counts

A 2021 amendment to the HITECH Act (Public Law 116-⁠321) requires HHS to consider whether a practice can show it had “recognized security practices” in place for “not less than the previous 12 months” when it sets fines, decides the length and extent of an audit, or agrees on remedies. These include NIST standards and the approaches promulgated under section 405(d) of the Cybersecurity Act of 2015, such as the 405(d) program’s Technical Volume 1: Cybersecurity Practices for Small Healthcare Organizations (2023). The law does not punish a practice that lacks them; it requires HHS to weigh them in favor of a practice that can show at least a year of use.

Public Law 116-⁠321 → · Technical Volume 1 (PDF) →

What it adds up to: a checklist for a practice

A written, current risk analysis covering every device, system and vendor holding ePHI, with a plan that answers it.
An inventory and map of where patient data lives and how it moves.
Multi-factor sign-in and encryption on email, the practice-management system, laptops and remote access.
Audit logs that someone reviews.
A signed BAA for every vendor with access to patient data.
Offline or isolated backups, with restores tested on a schedule.
Training for everyone, including the doctors, with completion records.
A breach response plan that names who investigates, decides and notifies.

Some items, such as the inventory, map and multi-factor sign-in, are proposed requirements or HHS recommendations rather than current mandates. For the safeguard-by-safeguard version, see our free HIPAA Security Rule checklist.

Where we fit

We run the technical side of that list for medical and dental practices across Orange County and Southern California, under a signed BAA. A practice under HIPAA starts on Secure IT at $250 per user per month, or $287.50 with the published 15% HIPAA uplift when we operate your safeguards program. There is no HIPAA certificate, and we never issue one: we build the controls and the evidence; your compliance lead keeps the sign-off. Details are on our healthcare and dental IT page, our HIPAA compliance page and the pricing page.

Sources: HHS, covered entities · 45 CFR Part 164, Subpart C · 45 CFR Part 164, Subpart D · 90 FR 898 · HHS proposed-rule fact sheet · RIN 0945-AA22. Enforcement and risk analysis: OCR, June 18, 2026 · OCR, February 19, 2026 · HHS risk analysis guidance · SRA Tool. Guidance: HHS, business associates · HHS ransomware fact sheet · Public Law 116-⁠321 · 405(d) Technical Volume 1. Checked October 14, 2026.

Quick answers

HIPAA security for practices, answered plainly

Is the new HIPAA Security Rule final?

No. HHS published the proposed update in the Federal Register on January 6, 2025, and the comment period closed on March 7, 2025. In the most recent federal regulatory agenda, HHS lists the rule under long-term actions, with final action estimated for July 2027. Until a final rule is published and its compliance date arrives, the current Security Rule is the one in force.

Does HIPAA apply to a small dental office?

Usually, yes. HHS lists dentists among the health care providers that are covered entities, with one condition: the provider transmits health information electronically in connection with a transaction for which HHS has adopted a standard, such as an electronic insurance claim. Size is no exemption.

How often does a practice have to do a HIPAA risk analysis?

The Security Rule does not set a frequency. HHS guidance gives annual and as-needed reviews as examples and says events such as a security incident, a change of ownership, turnover in key staff or management, or new technology should prompt a fresh look.

Is a ransomware attack automatically a HIPAA breach?

Not automatically: HHS calls it a fact-specific determination. But HHS says that when ransomware encrypts electronic protected health information, a breach has occurred because the data was acquired, and the breach is presumed unless the practice can show a low probability that the information was compromised, using the four-factor risk assessment in the Breach Notification Rule. Data the practice had already encrypted to HHS’s standard may not count as unsecured.

Do we need a business associate agreement with our IT company?

If the IT company creates, receives, maintains or transmits protected health information for you, yes. HHS’s own list of business associate examples includes a cloud service provider and an IT contractor or vendor, naming a “Managed Services Provider,” whose maintenance or support work requires it to create, receive, maintain or transmit ePHI. HIPAA requires satisfactory assurances, in a contract or other written arrangement, before that vendor handles the data.

Keep reading Cloud-Native vs Traditional Backup: What Actually Changed → Your Business Just Got Hacked. Now What? →