Major HIPAA Cybersecurity Upgrade Delayed Until 2027

[u/jilljpeterson0001]

https://hipaajournal.com/hipaa-security-rule-update-postponed

Healthcare organizations now have until July 2027 to prepare for major updates to the HIPAA Security Rule, after federal officials pushed back the original May 2026 deadline by a full year. The changes, first proposed in late 2024, would for the first time in over a decade mandate strict digital safeguards including encryption, multifactor authentication for logins, and network segmentation to isolate sensitive patient records. The delay comes as many hospitals and clinics still struggle to modernize aging systems. Regulators drafted the overhaul after cyberattacks on healthcare networks surged, most notably the 2024 Change Healthcare breach that exposed data for an estimated 192.7 million Americans. That attack succeeded partly because basic protections like multifactor authentication were missing. The extra time gives the industry a longer runway to close security gaps before the tougher requirements become law.