New HIPAA Rules 2026: What Is Final, Proposed and Pending

The new HIPAA rules in 2026 are updated notice of privacy practices requirements and, for substance use disorder records, a 42 CFR Part 2 rule aligned with HIPAA, both required by February 16, 2026, while HHS's Security Rule overhaul is still a proposed rule, its Privacy Rule changes are a draft final rule still under OIRA review, not yet in effect, and a federal court vacated most of the 2024 reproductive health privacy rule (HHS; HHS; reginfo.gov). HHS also finalized claims attachment standards in March 2026 (Federal Register). Curve Compliance, which signs a BAA on every plan, checked each status on HHS, the Federal Register and reginfo.gov on October 26, 2026.

Book a call. HHS's guidance on tracking technologies still applies in 2026. Curve Compliance sends conversions to your ad platforms server-side, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup. Book a call with Curve.

The 2026 HIPAA changes at a glance

Each row gives the status as the primary source states it on October 26, 2026.

Change	Status on October 26, 2026	Key date	Source
Notice of privacy practices updates (45 CFR 164.520)	Final and in effect, except three provisions a court vacated	Compliance required by February 16, 2026	HHS; eCFR
42 CFR Part 2 alignment with HIPAA	Final and in effect	Compliance required by February 16, 2026	HHS; 89 FR 12472
Claims attachments and electronic signature standards	Final	Effective May 26, 2026; compliance by May 26, 2028	91 FR 14350
Security Rule update (RIN 0945-AA22)	Proposed rule, not final	Proposed January 6, 2025; agenda target July 2027	90 FR 898; agenda
Privacy Rule changes on access and care coordination (RIN 0945-AA00)	Draft final rule under OIRA review; not published or in effect	Received by OIRA April 2, 2026	OIRA list; agenda
2024 reproductive health care privacy rule	Mostly vacated by a federal court	Order of June 18, 2025	Purl v. HHS; HHS

What took effect in 2026

Notice of privacy practices changes

The 2024 reproductive health rule also rewrote parts of the notice of privacy practices (NPP) rule at 45 CFR 164.520. HHS says the court that struck down most of that rule "vacated only the provisions that were deemed unlawful, namely 164.520(b)(1)(ii)(F), (G), and (H)." The rest stand: "The remaining modifications to the NPP requirements are undisturbed and remain in effect," and "Compliance with the remaining NPP modifications is required by February 16, 2026" (HHS).

The remaining changes include statements about substance use disorder records. Where they apply, the notice must say that records from programs subject to 42 CFR part 2 "shall not be used or disclosed in civil, criminal, administrative, or legislative proceedings against the individual unless based on written consent, or a court order after notice and an opportunity to be heard is provided to the individual or the holder of the record." Before such records are used for fundraising, "the individual must first be provided with a clear and conspicuous opportunity to elect not to receive any fundraising communications." The same section says a covered entity with a web site about its services "must prominently post its notice on the web site" (45 CFR 164.520). The notice of privacy practices guide covers the rest of what an NPP must say.

42 CFR Part 2 alignment

The Part 2 final rule was published February 16, 2024 (89 FR 12472). HHS's fact sheet, updated January 30, 2026, says: "Persons subject to the regulation must comply with the applicable requirements of the final rule by February 16, 2026." Among other changes, it "Allows a single consent for all future uses and disclosures for treatment, payment, and health care operations," "Aligns Part 2 Patient Notice requirements with the requirements of the HIPAA Notice of Privacy Practices" and "Applies the same requirements of the HIPAA Breach Notification Rule" to Part 2 records. One piece waits: "the compliance date for the accounting of disclosures will be set when the same right is revised in the HIPAA Privacy Rule" (HHS). Behavioral health marketers can read what changed after the February 2026 deadline.

Claims attachment standards

On March 24, 2026, HHS published a HIPAA Administrative Simplification final rule that "adopts standards for health care claims attachments transactions" and "a standard for electronic signatures" used with them. It took effect May 26, 2026, and "Compliance with these regulations is required by May 26, 2028" (91 FR 14350). It amends the transaction standards in 45 CFR parts 160 and 162, not the Privacy Rule.

What is still proposed: the Security Rule update

HHS says that on December 27, 2024, its Office for Civil Rights (OCR) "issued a proposed rule to improve cybersecurity" (HHS). The Federal Register published it on January 6, 2025 as a proposed rule, with comments due "on or before March 7, 2025" (90 FR 898). HHS's current regulatory agenda lists it under "Long-Term Actions" with "Final Action 07/00/2027," that is July 2027, and "Legal Deadline: None" (reginfo.gov). Until a final rule publishes, HHS says "the current Security Rule remains in effect" (HHS).

Among other things, the proposal would (HHS fact sheet):

• Multi-factor authentication. "Require the use of multi-factor authentication, with limited exceptions."
• Encryption. "Require encryption of ePHI at rest and in transit, with limited exceptions."
• An asset inventory and network map. A network map "that illustrates the movement of ePHI throughout the regulated entity's electronic information system(s)," kept current and reviewed at least once every 12 months. The network map guide shows where pixels, forms and ad vendors fit.
• Recovery. Written procedures to restore certain systems and data "within 72 hours."
• Yearly audits. A "compliance audit at least once every 12 months."
• No more optional specifications. An end to the split between "required" and "addressable" implementation specifications, with limited exceptions.

For the marketing side, see the proposed Security Rule changes for marketers.

What is pending: the Privacy Rule changes

HHS proposed these Privacy Rule changes on January 21, 2021 (86 FR 6446) and scheduled a Tribal consultation on them for February 6, 2026. The proposals would, among other things, "Strengthen individuals' rights to access their own protected health information, including electronic information" and "Improve information sharing for care coordination and case management for individuals" (91 FR 1481). HHS's agenda places the rule at the "Final Rule Stage" with "Final Action 08/00/2026" (reginfo.gov).

That month passed without a final rule. OIRA's list of rules under review, run October 26, 2026, still shows "HIPAA Privacy Rule: Changes to Support Coordinated Care and Individual Engagement and Reduce Regulatory Burdens" as a "Final Rule" received April 2, 2026 (reginfo.gov). Until HHS publishes it in the Federal Register, it is not in effect.

What a court struck down: the 2024 reproductive health rule

HHS published the HIPAA Privacy Rule to Support Reproductive Health Care Privacy on April 26, 2024 (89 FR 32976). On June 18, 2025, in Purl v. HHS, No. 2:24-cv-00228-Z, the U.S. District Court for the Northern District of Texas held that the rule is "VACATED except its modifications to 45 C.F.R. Section 164.520," and that "The modifications to 45 C.F.R. Section 164.520 are severed and shall stand," apart from the three NPP provisions above (opinion).

HHS describes it as "an order declaring unlawful and vacating most of the HIPAA Privacy Rule to Support Reproductive Health Care Privacy" and says "HHS will determine next steps after a thorough review of the court's decision" (HHS). See tracking for reproductive health data.

What it means for marketing data

None of the 2026 changes rewrote HHS's guidance on online tracking. HHS still says "Regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures" of PHI to tracking technology vendors, and notes a June 20, 2024 court order that vacated the part about unauthenticated public pages (HHS; annotated bulletin). HHS also tells patients that without their authorization a provider generally cannot "Use or share your information for marketing or advertising purposes or sell your information" (HHS). See when ad tracking needs a HIPAA authorization.

Three checks follow from 2026. Confirm the notice posted on your website is the version updated for February 16, 2026. If you run substance use disorder services, keep Part 2 records out of tags, forms and ad audiences. And treat the Security Rule proposal as a planning list, not a rule. Which rules apply to you depends on your setup, so talk to your counsel. The 2027 compliance calendar tracks the dates ahead.

How Curve Compliance helps

The 2026 changes leave the core ad tracking question where it was: what leaves your website for an ad platform. Curve Compliance replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, contact identifiers are off by default on Meta, Google Ads and TikTok, and Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform. Event Logs show what Curve sent to each platform and what the platform accepted.

Curve signs a BAA on every plan, is SOC 2 Type II, and Curve's team does the setup, typically live in about a week. To see which trackers your site loads today, run the free website scan.

Sources, checked October 26, 2026: HHS regulatory initiatives; HHS Security Rule NPRM; NPRM fact sheet; HHS Part 2 fact sheet; Your Rights Under HIPAA; HHS online tracking guidance; Summary of the HIPAA Security Rule; HIPAA combined regulation text; 90 FR 898; 89 FR 12472; 89 FR 32976; 91 FR 1481; 91 FR 14350; RIN 0945-AA22; RIN 0945-AA00; OIRA rules under review; Purl v. HHS opinion; 45 CFR 164.520; 45 CFR 164.312.

Frequently Asked Questions

What is the new HIPAA rule in 2026?

There is no single new rule: updated notices of privacy practices and the 42 CFR Part 2 alignment became mandatory on February 16, 2026, while the Security Rule update is still a proposal and the Privacy Rule changes are a draft final rule still under OIRA review, not in effect (HHS; HHS; reginfo.gov; OIRA).

Is there still HIPAA?

Yes. HHS lists the Privacy, Security, Enforcement and Breach Notification Rules among the HIPAA regulations at 45 CFR Parts 160, 162 and 164 (HHS), and while it works on the Security Rule update, HHS says "the current Security Rule remains in effect" (HHS).

What are the HIPAA Multi-Factor Authentication (MFA) requirements?

Today's Security Rule does not name MFA. It requires procedures "to verify that a person or entity seeking access to electronic protected health information is the one claimed" (45 CFR 164.312(d)). HHS's proposed update would "Require the use of multi-factor authentication, with limited exceptions," but that is not final (HHS).

What are patient rights under HIPAA?

HHS lists the right to see and get a copy of your health records, have corrections added, receive a notice of how your information may be used and shared, decide on permission for uses such as marketing, ask for restrictions, get a report on certain disclosures, and file a complaint with your provider, insurer or HHS (HHS).

What are the three main rules of HIPAA?

The Privacy Rule, the Security Rule and the Breach Notification Rule. HHS says "Together, the Privacy, Security, and Breach Notification Rules help to protect the privacy and security of protected health information (PHI)" (HHS). The HIPAA rules guide also covers the Enforcement and Omnibus Rules.

What are the new HIPAA requirements for 2026?

Updated notices of privacy practices and Part 2 compliance, both by February 16, 2026, plus claims attachment standards that took effect May 26, 2026, with compliance due May 26, 2028 (HHS; HHS; Federal Register). Items such as MFA and encryption come from the Security Rule proposal and are not final (HHS).

Is the HIPAA Security Rule update final?

No. It was published as a proposed rule on January 6, 2025, and HHS's agenda lists a final action for July 2027 under long-term actions (Federal Register; reginfo.gov).

Is the 2024 reproductive health HIPAA rule still in effect?

Mostly not. A federal court vacated it on June 18, 2025, except its notice of privacy practices changes, and it vacated three of those provisions too (Purl v. HHS; HHS).

Talk to Curve Compliance

Book a call. HIPAA's rules keep moving, and your ad tracking has to keep up. Curve Compliance sends conversions server-side, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.