A HIPAA Privacy Rule Update Could Arrive as Early as August 2026. Here’s What Covered Entities and Business Associates Should Know

In January 2021, the U.S. Department of Health and Human Services (HHS) published a Notice of Proposed Rulemaking (NPRM) proposing updates to the HIPAA Privacy Rule. The proposal was intended to remove barriers to coordinated care, improve individuals’ access to their health information, reduce unnecessary administrative burden, and strengthen certain patient rights while continuing to protect the privacy of protected health information (PHI).

The proposal has remained under federal review for several years. If a final rule is published, it may adopt some, all, or none of the originally proposed changes. 

When Could This Happen? 

While HHS has not announced an official publication date, the final rule is widely expected to be published as early as August 2026 based on the federal regulatory agenda.

If finalized, organizations will not be expected to comply immediately. Historically, HIPAA rules have become effective 60 days after publication, with compliance required approximately 180 days later. The final rule will establish the official effective and compliance dates. 

What Was Included in the Proposal? 

The proposed rule included several notable changes, including but not limited to: 

Patient Access and Individual Rights 

• Proposing to reduce the time to respond to an individual’s request for access to PHI from 30 calendar days to 15 calendar days  

• Proposing to strengthen an individual’s right to inspect PHI in person, including the ability to take notes and photographs  

• Proposing changes to certain fees for copies of PHI, including additional transparency through website fee schedules, individualized fee estimates, and itemized bills  

• Creating a pathway for individuals to direct electronic PHI maintained in an electronic health record (EHR) to another covered healthcare provider or health plan  

Care Coordination and Permitted Disclosures 

• Expanding and clarifying certain permitted uses and disclosures of PHI to improve care coordination and case management  

• Proposing changes affecting disclosures to social service agencies and community-based organizations involved in an individual’s care  

• Proposing updates to certain standards governing disclosures to family members and caregivers in specific situations  

• Proposing to replace the current “serious and imminent threat” standard with a “serious and reasonably foreseeable threat” standard for certain disclosures made to prevent or lessen a threat to health or safety. 

• Clarifying the application of the minimum necessary standard for certain disclosures and requests for PHI to reduce unnecessary barriers to care while maintaining privacy protections  

Notice of Privacy Practices (NPP) 

• Proposing revisions to the Notice of Privacy Practices (NPP), including eliminating the requirement to obtain a patient’s written acknowledgment of receipt while retaining the requirement to provide the notice  

• Proposing changes to the required content and format of the NPP to better inform individuals of their privacy rights  

Administrative and Operational Changes 

• Clarifying several administrative provisions intended to reduce unnecessary regulatory burden while maintaining privacy protections 

While the proposal covers many topics, its primary focus is improving patient access, supporting care coordination, reducing administrative burden, and updating the Notice of Privacy Practices. These changes remain proposals until a final rule is published.
 

What Could This Mean for Covered Entities and Business Associates and What Should They Do Now? 

Covered entities are expected to be most directly affected by many of the proposed operational changes. Business associates should also review the final rule to determine whether any contractual, operational, or policy updates may be necessary.

Depending on the final rule, organizations may need to evaluate: 

• HIPAA policies and procedures 

• Patient access request workflows 

• Notice of Privacy Practices 

• Workforce training 

• Forms and documentation 

• Business associate agreements and operational processes that support HIPAA compliance 

The final requirements, effective date, and compliance deadlines will not be known until HHS publishes the final rule.

Now is a good time to: 

• Stay informed about the publication of the final rule 

• Begin identifying policies and workflows that could be affected if the proposed changes are adopted 

• Plan time and resources to review and implement any new requirements once the final rule is published