Alston & Bird reported HHS has pushed the HIPAA Security Rule final rule to July 2027

What happened

Alston & Bird, in an advisory dated July 10, 2026, reported that the HHS Office for Civil Rights has delayed finalizing the HIPAA Security Rule until July 2027. The firm attributed this to the federal regulatory agenda on reginfo.gov, under RIN 0945-AA22. The same advisory reported that a separate Privacy Rule item focused on coordinated care and individual engagement, RIN 0945-AA00, was then slated for August 2026.

What we have not verified

We have not read the reginfo.gov agenda entry, which was not available to us in this session. We have not checked whether the agenda has changed since the advisory was written, and we have not checked whether the Privacy Rule item was published in August 2026. We are watching the official sources for both and will update this desk when we have read them.

Analysis: A reported delay is a change to when a new rule might arrive, not a change to what applies today. The Security Rule as it currently stands remains the standard OCR enforces, and the settlements covered elsewhere on this desk show OCR applying the existing risk analysis requirement. For an ABA clinic, waiting for a final rule to start a real risk analysis is not a plan, because the existing requirement does not depend on it. A current, clinic specific analysis is also the best preparation for whatever the final rule contains. This is reporting, not legal advice.