2026 HIPAA Security Rule: What Florida Practices Must Do
The proposed HIPAA Security Rule would end addressable safeguards and require MFA, encryption and 72-hour recovery. Where it stands now, and how Florida practices should prepare.
Updated October 30, 2026
The average healthcare data breach now costs $9.8 million. Florida ranks among the worst-hit states for healthcare breaches year after year. And the federal government has proposed rewriting the rules for how every medical practice in the country must protect patient data.
The proposed HIPAA Security Rule update is the most significant overhaul of healthcare cybersecurity requirements in over a decade. It would remove the word “addressable” — the loophole that let practices skip safeguards they deemed too expensive or complex — and make nearly every security control mandatory.
Status as of October 2026: the update is still a proposal. HHS published it in the Federal Register on January 6, 2025. The May 2026 target on the federal regulatory agenda passed without a final rule, and the agenda now lists it as a long-term action with final action projected for July 2027. Until a final rule is published, the current Security Rule (45 CFR Part 164, Subpart C) is what OCR enforces. Everything below marked “would” describes the proposal.
If you run a medical practice, dental office, surgical center, or any organization that handles protected health information (PHI) in South Florida, this affects you directly. Here is what the proposal would change, where the timeline stands, and what is worth doing now regardless.
Key Takeaways
- Still proposed. No final rule has been published; today’s Security Rule remains in force. The federal agenda projects final action for July 2027.
- All safeguards would become mandatory. The proposal removes the “required” vs “addressable” distinction, so encryption, MFA and network segmentation would no longer be optional.
- 72-hour system recovery would become a regulatory requirement, not a best practice.
- Business associates would have to notify you within 24 hours of activating their contingency plan, and verify their technical safeguards annually.
- Violation penalties increased in January 2026, with small practice settlements ranging from $182,000 to $800,000.
- There is no compliance deadline yet. It would fall roughly 240 days after a final rule is published. Start now anyway: insurers and auditors already ask for most of these controls, and they cannot be implemented overnight.
What the Proposed HIPAA Security Rule Would Change
HHS released the Notice of Proposed Rulemaking (NPRM) in late December 2024 and published it in the Federal Register on January 6, 2025. The comment period closed in March 2025. A final rule was targeted for May 2026 and did not appear; the regulatory agenda now projects July 2027. If it is finalized as proposed, it would take effect 60 days after publication, with roughly 180 days more to comply.
The core shift: everything would be required. The current framework lets organizations evaluate whether a safeguard is “addressable”, meaning they can document why it isn’t reasonable for their situation and implement an alternative. The proposal removes that flexibility. Here are the specific requirements it proposes.
Mandatory Encryption of All ePHI
Under the proposal, every piece of electronic protected health information would have to be encrypted at rest and in transit, with only narrow exceptions. No “we use password protection instead” workarounds.
This means:
- Full-disk encryption on every workstation, laptop, and server storing patient data
- TLS encryption for all data transmitted over networks, including internal traffic
- Encrypted email for any communications containing PHI
- Encrypted backups — unencrypted backup tapes or drives are already a breach-notification problem if lost, and would be a violation outright
For practices still running unencrypted laptops or sending PHI over standard email, this is a significant infrastructure change.
Multi-Factor Authentication — No Exceptions
MFA would become mandatory for all users accessing systems that contain ePHI. Not just remote access. Not just administrators. Everyone — front desk staff, nurses, physicians, billing teams.
This applies to:
- EHR systems (Epic, Cerner, athenahealth, eClinicalWorks)
- Practice management software
- Email accounts that handle patient communications
- Cloud storage and file-sharing platforms
- Remote desktop and VPN connections
The days of a shared password taped to a monitor in the back office are numbered. Practices will need to deploy MFA solutions that balance security with clinical workflow efficiency — because a physician who can’t log in during a patient visit is a real problem.
72-Hour System Recovery Mandate
Here’s where it gets interesting for Florida practices specifically.
The proposed rule would require covered entities to demonstrate the ability to restore critical systems within 72 hours of any incident — ransomware, hardware failure, natural disaster, or anything else.
For South Florida, this intersects directly with hurricane season. A Category 4 storm that floods your server room, kills power for days, and displaces your staff wouldn’t exempt you from this requirement. You need tested, documented disaster recovery procedures that can bring your EHR, billing, and scheduling systems back online within three days regardless of what caused the outage.
This means:
- Cloud-based or geo-redundant backups stored outside your facility (and outside the hurricane zone)
- Tested recovery procedures — not just backups that exist, but backups you’ve actually restored from
- Documented recovery time objectives (RTOs) for every critical system
- A business continuity plan that accounts for facility loss, staff displacement, and extended power outages
In our experience working with South Florida healthcare organizations, fewer than 20% have actually tested a full system recovery. The ones who have often discover their backups don’t work the way they expected. Test now, not during a crisis.
Biannual Vulnerability Scans and Annual Penetration Testing
The proposal would require vulnerability scanning every six months and full penetration testing every twelve months — not recommended, not best practice, but auditable compliance requirements.
This is a significant lift for practices that have never performed either. A vulnerability scan identifies known security weaknesses across your network, applications, and devices. A penetration test simulates an actual attack to see if those weaknesses can be exploited.
Both must be documented with findings, remediation plans, and evidence of follow-through.
24-Hour Business Associate Notification
Business associates — including IT providers, billing companies, cloud vendors, and EHR hosts — would have to report activation of their contingency plans to covered entities within 24 hours.
This is a dramatic tightening. Today the only federal clock on a business associate is the breach notification rule’s 60 days. The proposal puts your vendors on the clock.
What this means for your practice: you need to know who your business associates are, confirm they can meet this requirement, and have a documented process for what happens when you receive a notification.
Annual Written Verification of BA Safeguards
Once a year, covered entities would have to obtain written verification from every business associate confirming that required technical safeguards are in place. A signed BAA would no longer be enough. You need documented proof that your vendors are actually implementing what the agreement requires.
This is vendor management at a level most practices have never done. It means auditing your BA relationships, collecting compliance attestations, and maintaining records that demonstrate due diligence.
The Timeline — When You Need to Be Ready
Here’s the calendar as it stands in October 2026:
| Date | What Happened / What’s Coming |
|---|---|
| Feb 16, 2026 | Notice of Privacy Practices updates for substance use disorder (Part 2) records took effect |
| Jan 28, 2026 | Updated HIPAA violation penalty amounts took effect |
| May 2026 | Target date for the final Security Rule. Passed without publication |
| July 2027 | Final action now projected on the federal regulatory agenda (a planning date, not a commitment) |
| Final rule + ~240 days | Compliance deadline, if finalized as proposed (60 days to effect, then 180 to comply) |
One important note: The regulatory freeze in January 2025 and roughly 4,700 public comments have pushed the timeline back, and it is genuinely open whether the rule is finalized as proposed, scaled back, or dropped. However, every compliance expert and legal advisory we’ve seen recommends preparing for the full scope of requirements as proposed. Waiting for the final text to start preparing is a losing strategy — these changes are too substantial to implement in 180 days if you’re starting from scratch.
What This Means for South Florida Medical Practices
Florida has unique risk factors that make these changes especially urgent:
Florida is a top target for healthcare breaches. The state consistently ranks among the worst-affected for healthcare data breaches nationwide. In recent years, Florida-based organizations including Medusind (a billing company with 700,000+ individuals affected) and multiple practice management companies have experienced significant breaches.
Hurricane season meets the proposed 72-hour recovery requirement. South Florida’s annual hurricane threat makes the disaster recovery requirement more than a compliance checkbox. Practices in Miami-Dade, Broward, and Palm Beach counties need recovery plans that assume facility damage, prolonged power loss, and staff unable to reach the office. This likely means cloud-based infrastructure rather than on-premises servers that can be destroyed by storm surge.
A large elderly and Medicare population means more PHI at risk. South Florida’s disproportionately large senior population means practices here handle higher volumes of sensitive health data per capita. More PHI means more exposure, more audit scrutiny, and higher penalties when something goes wrong.
Practice size doesn’t matter. HHS has been explicit: the size of your practice is irrelevant to your compliance obligations. A solo practitioner in Coral Gables faces the same requirements as a 200-physician health system. The difference is resources — which is exactly why smaller practices need an experienced healthcare IT partner to share the burden.
Updated HIPAA Violation Penalties in 2026
As of January 28, 2026, penalty amounts increased across all tiers:
| Tier | Culpability | Minimum Per Violation | Maximum Annual |
|---|---|---|---|
| 1 | Did Not Know | $145 | $36,505 |
| 2 | Reasonable Cause | $1,461 | $146,053 |
| 3 | Willful Neglect (Corrected) | $14,601 | $365,052 |
| 4 | Willful Neglect (Not Corrected) | $73,014 | $2,190,294 |
These are per-violation amounts. A single breach can involve thousands of individual violations.
Real-world context: Small practice settlements in recent enforcement actions have ranged from $182,000 to $800,000. For a five-physician practice doing $3 million in annual revenue, an $800,000 penalty is potentially fatal. And that’s before you factor in breach notification costs, legal fees, patient lawsuits, and reputational damage.
The cost of compliance is a fraction of the cost of non-compliance. Every time.
How to Prepare Your Practice Now
You don’t need to wait for the final rule to start getting ready. Here’s the action plan we walk through with our compliance clients:
1. Conduct a Formal Risk Assessment If you haven’t done a documented HIPAA risk assessment in the past 12 months, start here. Map every system that touches ePHI, identify vulnerabilities, and document your findings. This is the foundation everything else builds on.
2. Deploy MFA Across All Systems Start with your EHR and email, then expand to practice management software, cloud platforms, and remote access. Choose solutions that minimize disruption to clinical workflows — your physicians need to authenticate quickly between patient rooms.
3. Encrypt Everything Audit every device and system for encryption status. Full-disk encryption on all endpoints, TLS for all network traffic, encrypted email for PHI communications, and encrypted backups. No gaps.
4. Test Your Disaster Recovery Don’t just have backups — test them. Run a full recovery drill. Can you restore your EHR within 72 hours? Can you do it if your building is inaccessible? If the answer is no, your backup strategy needs work. Consider HIPAA-compliant cloud infrastructure with geo-redundant replication outside the hurricane zone.
5. Audit Your Business Associates List every vendor with access to PHI. Verify BAAs are current. Confirm each vendor could meet the proposed 24-hour notification requirement. Start collecting written verification of their security controls.
6. Schedule Vulnerability Scans Engage a qualified security firm or your cybersecurity provider to conduct vulnerability scans now and plan for biannual recurrence. Budget for annual penetration testing.
7. Document Everything The proposal emphasizes documentation at every turn, and the current rule already requires it. Risk assessments, policies, training records, recovery test results, BA verifications — if it’s not documented, it didn’t happen as far as HHS is concerned.
Why Small Practices Can’t Afford to Wait
We hear it from practices every week: “We’re too small to be a target.” The data says otherwise. 43% of cyberattacks target small and mid-size organizations. And HHS has made it clear that enforcement applies equally regardless of practice size.
Meanwhile, threats keep evolving. Supply chain attacks and AI agent vulnerabilities are adding new attack vectors that HIPAA’s technical safeguards are designed to address.
The real challenge for small practices isn’t willingness — it’s resources. A five-person medical office doesn’t have a CISO, a compliance team, or an IT department. But neither the current rule nor the proposal scales by size. The requirements are the same whether you have 5 employees or 5,000.
This is exactly where a managed IT partner with healthcare expertise makes the difference. Instead of hiring a full-time compliance officer ($120,000+), a security analyst ($95,000+), and an IT director ($140,000+), you get all of those capabilities through a single healthcare IT partnership at a fraction of the cost.
Here’s what we tell our South Florida healthcare clients: the practices that start preparing now will have a smooth compliance transition when the final rule drops. The ones that wait will be scrambling — and scrambling is when mistakes happen, shortcuts get taken, and auditors find gaps.
Don’t wait for the final rule to start preparing. The proposed requirements are clear enough to act on today, and the current rule already expects a documented risk analysis behind every safeguard you skip. If your practice needs help understanding where you stand and what it will take to get compliant, schedule a healthcare IT assessment with our team. No cost, no pressure — just a clear picture of your compliance posture and a roadmap for what comes next.
Local coverage: Coverage by market: Miami, Fort Lauderdale, Orlando, Tampa, and Jacksonville.
Related reading: HIPAA-compliant file sharing and document storage · is OneDrive HIPAA compliant — the storage and sharing configuration the Security Rule expects.
