AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
Last Update: 10/27/2026 at 6:00 AM EST
HIPAA Privacy and Security
Coverage from Inside Privacy, The HIPAA Journal, and others
HIPAA privacy and security rules shape how healthcare providers, health plans, and business associates handle protected health information.
The subject spans patient access rights, Notices of Privacy Practices, risk assessments, encryption, multifactor authentication, vendor oversight, breach response, and workforce training, as well as enforcement by HHS’s Office for Civil Rights. It also includes related developments such as the alignment of 42 CFR Part 2 requirements, oversight of health apps and tracking technologies, and proposed security controls addressing ransomware and operational resilience. Together, these rules and enforcement actions define the practical obligations of organizations handling sensitive health data.
Looking Back
2313 Day Timeline
Mar '20
Mar '21
Mar '22
May '23
May '24
May '25
May '26
All Articles50 articles
Important
HHS and CMS listed 2026 Unified Agenda actions, including August 2026 HIPAA Privacy Rule changes and November 2026 ONC API and information-blocking updates.
7/20/2026 • Regulation, Law & Enforcement • General
HIPAA Journal explains how U.S. covered entities and business associates should use NIST-aligned encryption to protect electronic health data and influence breach notification and federal enforcement outcomes.
1/3/2026 • Regulation, Law & Enforcement • General
Healthcare organizations are urged to evaluate cloud infrastructure under HIPAA requirements, citing compliance costs versus long-term breach enforcement and litigation risks.
6/17/2026 • Regulation, Law & Enforcement • General
HHS Office of Civil Rights announced an OCR reorganization in the 2020s that adds religious discrimination enforcement units and may slow HIPAA breach and complaint investigations.
5/19/2026 • Regulation, Law & Enforcement • General
HHS OCR enforces HIPAA encryption as an addressable safeguard in 2026 to protect ePHI across US healthcare systems.
3/14/2026 • Regulation, Law & Enforcement • General
US Department of Health and Human Services finalizes 42 CFR Part 2 confidentiality rule in the United States to strengthen privacy protections for substance use disorder records.
2/26/2026 • Regulation, Law & Enforcement • General
HIPAA regulated entities implement encryption safeguards and risk analyses in the United States on an ongoing basis.
2/23/2026 • Regulation, Law & Enforcement • General
HIPAA covered entities and Part 2 Programs in the United States must update notices by February 16, 2026.
2/23/2026 • Regulation, Law & Enforcement • General
Healthcare software projects in the United States adopt HIPAA driven privacy and security controls with 2026 encryption and MFA requirements.
2/22/2026 • Regulation, Law & Enforcement • General
Health plans and insurers in the United States must align notices with Part 2 confidentiality rules by February 16 2026 to reflect stricter substance use disorder record protections.
2/19/2026 • Regulation, Law & Enforcement • General
Healthcare entities must update privacy notices by the regulatory deadline to reflect new SUD protections and patient rights.
2/18/2026 • Regulation, Law & Enforcement • General
HHS updates HIPAA privacy notices to reflect Part 2 rules for US health plans in 2026.
2/17/2026 • Regulation, Law & Enforcement • General
Penn Medicine published a February 16, 2026 privacy notice supplement in Pennsylvania detailing HIPAA and Part 2 protections for substance use disorder treatment records.
2/16/2026 • Regulation, Law & Enforcement • General
Health plans governed by ERISA must comply with HIPAA privacy obligations for PHI and implement vendor safeguards.
2/16/2026 • Regulation, Law & Enforcement • General
HIPAA covered entities and Part 2 programs must update notices by February 16 2026 in the United States to reflect Part 2 confidentiality alignment.
2/16/2026 • Regulation, Law & Enforcement • General
U.S. healthcare providers, health plans, and business associates receive 2026-oriented guidance on meeting HIPAA privacy, security, and breach notification requirements for protected health information.
2/16/2026 • Regulation, Law & Enforcement • General
HHS Office for Civil Rights begins civil enforcement of 42 CFR Part 2 confidentiality in the United States on February 16, 2026 to safeguard substance use disorder records.
2/16/2026 • Regulation, Law & Enforcement • General
On February 16, 2026, Massachusetts Department of Developmental Services issued a revised HIPAA privacy notice in Massachusetts detailing client health information uses, disclosures, rights, and retention.
2/16/2026 • Personal Data & Identity • General
HIPAA covered practices update notices by February 16 2026 to reflect Part 2 confidentiality for substance use disorder records in medical and dental settings in the United States.
2/16/2026 • Regulation, Law & Enforcement • General
Group health plan sponsors must update HIPAA Privacy Notices by February 16 2026 to reflect Part 2 confidentiality rules and remove vacated reproductive health language.
2/16/2026 • Regulation, Law & Enforcement • General
Healthcare entities must update HIPAA notices by February 16 2026 to reflect Part 2 confidentiality changes affecting SUD records nationwide.
2/16/2026 • Regulation, Law & Enforcement • General
HHS OCR enforces Part 2 confidentiality rules for federally assisted substance use disorder programs in the United States, with updates effective by 2026.
2/13/2026 • Regulation, Law & Enforcement • General
HHS and OIG escalated information blocking enforcement under the Cures Act from 2023 to 2026, targeting health IT developers and exchanges across the United States.
2/13/2026 • Regulation, Law & Enforcement • General
US health data processors must implement encryption MFA audit logs and updated business associate agreements by February 16 2026 to comply with HIPAA security rule updates.
2/11/2026 • Regulation, Law & Enforcement • General
HHS expects final HIPAA Security Rule by 2026 affecting U.S. healthcare organizations.
2/4/2026 • Regulation, Law & Enforcement • General
Regulators in the United States tighten HIPAA standards and expand enforcement in 2025, affecting healthcare providers and vendors.
2/4/2026 • Regulation, Law & Enforcement • General
US health care providers and Part 2 programs must update notices by February 16 2026 as OCR enforcement begins under the HIPAA Privacy Rule in the United States.
2/3/2026 • Regulation, Law & Enforcement • General
HHS Office for Civil Rights and HIPAA require covered entities in the USA to implement safeguarded PHI destruction practices, prompting enforcement actions and settlements.
1/16/2026 • Regulation, Law & Enforcement • General
OCR enforces HIPAA penalties against health care entities in the United States from 2020 through 2026.
1/15/2026 • Regulation, Law & Enforcement • General
Healthcare entities in the United States face HIPAA privacy obligations in the 2020s as data breach notifications to OCR prompt enforcement actions.
1/13/2026 • Regulation, Law & Enforcement • General
When subpoenas issue, healthcare providers must comply with HIPAA and court orders governing medical records disclosures across jurisdictions.
1/3/2026 • Regulation, Law & Enforcement • General
HHS proposed HIPAA Security Rule upgrades on December 27, 2024 while OCR enforcement and court rulings continue to drive 2025-2026 HIPAA Privacy and breach-notification compliance timelines in the United States.
6/28/2025 • Regulation, Law & Enforcement • General
During the COVID-19 emergency in the United States, the Department of Health and Human Services issued interoperability rules and HIPAA waivers that expand electronic health data sharing and shift privacy risks to consumer apps.
3/30/2020 • Regulation, Law & Enforcement • General
New York lawmakers debate NYHIPA to tighten processing of regulated health information after a veto, with enforcement by the state attorney general.
3/16/2026 • Regulation, Law & Enforcement • General
US health privacy regulators are setting a 2026 enforcement agenda that tightens HIPAA-related cybersecurity, vendor oversight, tracking-technology, and AI governance across the United States healthcare sector.
2/16/2026 • Regulation, Law & Enforcement • General
U.S. covered health care entities must, by February 16, 2026, update HIPAA Notices of Privacy Practices nationwide to incorporate applicable more stringent state health privacy standards.
2/6/2026 • Regulation, Law & Enforcement • General
Evexia Health Nursing Corp. issued a HIPAA Notice of Privacy Practices for substance use disorder records covering consent, permitted disclosures, breach notification, and OCR complaint options.
7/22/2026 • Consumer Privacy & Digital Rights • General
HIPAA guidance outlines privacy permissions, ePHI safeguards, business associate obligations, breach risk assessment, and notification steps for chronic kidney disease care.
6/13/2026 • Regulation, Law & Enforcement • General
HIPAA preemption generally controls conflicting state health privacy laws, but state rules frequently add stronger protections and shape minor and sensitive health data access.
5/24/2026 • Regulation, Law & Enforcement • General
Therapists must balance HIPAA and state confidentiality protections against legal exceptions for imminent danger, suspected abuse, and court-ordered disclosures.
4/16/2026 • Consumer Privacy & Digital Rights • General
Interesting
U.S. Department of Health and Human Services proposes HIPAA Security Rule updates to be finalized by May 2026 in the United States, strengthening protection of electronic protected health information.
3/6/2026 • Regulation, Law & Enforcement • General
Health privacy and security developments address HIPAA rule changes and state law developments in the United States in 2026.
2/20/2026 • Regulation, Law & Enforcement • General
U.S. HIPAA 2026 Security Rule tightens identity and access controls, requiring MFA, mandatory encryption, and auditable evidence for ePHI, effective across covered entities and business associates.
2/10/2026 • Regulation, Law & Enforcement • General
Healthcare organizations adopt HIPAA based programs today to protect patient data and avoid penalties in evolving regulatory environments.
2/3/2026 • Regulation, Law & Enforcement • General
UMass Memorial Health issues a joint HIPAA privacy practices notice explaining how patient medical information is used, shared, and protected across its Massachusetts health care entities.
1/1/1900 • Personal Data & Identity • General
Who: U.S. Department of Health and Human Services and SAMHSA; What: finalize rule updates to confidential SUD information; When: by February 16 2026; Where: United States federal health system.
2/25/2026 • Regulation, Law & Enforcement • General
Meritus Health publishes a HIPAA Notice of Privacy Practices detailing patient rights and permitted uses of medical records across its Maryland service locations.
2/11/2026 • Consumer Privacy & Digital Rights • General
HIPAA compliance guidance outlines workforce training, documentation, and operational procedures to reduce HIPAA violations and privacy-impacting security failures.
5/20/2026 • Regulation, Law & Enforcement • General
Healthcare providers in the United States are reviewing HIPAA obligations and response procedures after law enforcement agencies, including ICE, seek access to patients or medical information.
5/25/2026 • Regulation, Law & Enforcement • General
Healthcare payers and aggregators use centralized policy enforcement to maintain auditable access controls for PHI across Snowflake and Databricks as regulations evolve.
7/10/2026 • Corporate Data Practices & Accountability • General