HIPAA BinderGet my forms

HIPAA changes: what’s new and what it means for small practices

The current state, in one paragraph: the only 2026 change now in effect is the Part 2 (substance use disorder) NPP update, and it binds only practices that touch Part 2 records. The reproductive-health NPP amendments were vacated in court in 2025. The big Security Rule overhaul is still a proposal. Penalty amounts got their annual inflation bump in January. Everything else you have seen advertised is one of those four, repackaged.

Last verified: July 15, 2026 · every entry linked to its Federal Register or HHS source

How this page works

We keep this changelog updated when a rule actually moves: a final rule publishes, a compliance date arrives, a court vacates something, or the penalty table adjusts. Proposals stay labeled as proposals. It is the same monitoring that powers the binder’s Always-Current tier, where a change like these arrives as updated documents with a note explaining what changed and why, not as a page you have to remember to check.

Get an email when a rule change affects your documents.

The changelog

In effect

Part 2 (substance use disorder) NPP changes take effect

What changed: The compliance date arrived for the Notice of Privacy Practices amendments in the 2024 final rule aligning 42 CFR Part 2 (confidentiality of substance use disorder patient records) with HIPAA. Affected notices must now include Part 2 statements, including that Part 2 records cannot be used against the patient in legal proceedings without consent or a court order. OCR refreshed its model notices alongside this date, including a model Part 2 patient notice.

Who it affects: Conditional, and narrower than the marketing around it: covered entities that are Part 2 programs, or that create, receive, or maintain Part 2 records. A typical dental, chiropractic, PT, or outpatient therapy practice that never touches Part 2 program records is not affected.

What to do: If you are a Part 2 program or handle Part 2 records, update your NPP; everyone else should leave Part 2 boilerplate out.

89 FR 12472 (final rule, Feb. 16, 2024), federalregister.govWho actually needs the 2026 NPP update
In effect

Civil penalty amounts adjusted for inflation

What changed: HHS published its annual civil monetary penalty inflation adjustment (91 FR 3665), updating the codified penalty table at 45 CFR 102.3. The four HIPAA tiers now run from a $145 minimum per violation at the lowest culpability tier to a $2,190,294 annual cap.

Who it affects: Every covered entity and business associate; the figures apply regardless of practice size.

What to do: Nothing to change in your documents; know the numbers when someone quotes you 2020-era fine amounts.

91 FR 3665 (Jan. 28, 2026), federalregister.govThe current penalty tiers, in full
Vacated

Reproductive-health privacy amendments vacated in Purl v. HHS

What changed: A federal court vacated the 2024 HIPAA Privacy Rule to Support Reproductive Health Care Privacy nationwide (Purl v. HHS, N.D. Tex.), including its requirement that every NPP add reproductive-health language by February 16, 2026. HHS let the appeal window lapse and the Fifth Circuit dismissed the remaining appeal in September 2025. The Part 2 NPP provisions survived. One wrinkle: the printed CFR text has not been conformed, so the struck language still appears in the raw regulation; omitting it is the court-aware reading.

Who it affects: All covered entities. The reproductive-health NPP requirement no longer exists for anyone.

What to do: Do not add reproductive-health attestation language; if a vendor sold you a mandatory 2026 update on this basis, that claim is outdated.

89 FR 32976 (the vacated 2024 rule), federalregister.govWhat got struck down, in plain terms
Proposed, not final

Security Rule overhaul proposed. Proposed, not final

What changed: HHS published a notice of proposed rulemaking to strengthen the Security Rule's protections for electronic PHI (90 FR 898), citing the growth in breaches and cyberattacks and deficiencies OCR sees in investigations. Comments closed March 7, 2025. As of our last verification, no final rule has been published: nothing in it binds anyone yet.

Who it affects: If finalized, every covered entity and business associate that handles electronic PHI, small practices included.

What to do: Nothing yet; ignore anyone selling compliance with the new Security Rule today. Keep your current risk analysis honest and revisit when a final rule exists.

90 FR 898 (NPRM, Jan. 6, 2025), federalregister.gov
In effect

Part 2 alignment rule published

What changed: HHS finalized the rule aligning 42 CFR Part 2 with HIPAA, implementing the CARES Act: one patient consent for future uses and disclosures for treatment, payment, and operations, new patient rights around Part 2 records, and the NPP changes that later took effect on February 16, 2026.

Who it affects: Part 2 programs and covered entities that receive Part 2 records; the same conditional scope as the 2026 compliance-date entry above.

What to do: Part 2 practices should have folded these changes into their consent and notice workflow by the 2026 date.

89 FR 12472 (Feb. 16, 2024), federalregister.gov

Working from the free HHS model notice instead? It is current for these changes; see what the model covers and what it leaves you to build.

Do I need to update my HIPAA documents for 2026?

For most small practices, no 2026 rule change forces an update. The reproductive-health NPP amendments were vacated in June 2025, and the February 16, 2026 Part 2 changes bind only practices that are substance use disorder programs or handle Part 2 records. The updates most practices actually need are older: notices still on pre-2013 templates, missing Business Associate Agreements, and risk analyses that were never documented. A rule-change headline is the wrong trigger; an annual review is the right one.

How often do HIPAA rules actually change?

The binding rules change slowly; the numbers change yearly. The last broad rewrite of the Privacy and Security Rules was the 2013 Omnibus Rule, and the biggest pending change, the Security Rule overhaul proposed in January 2025, is still not final. What does change every year is the civil penalty table at 45 CFR 102.3, which HHS adjusts for inflation. Most of the churn you see in ads is repackaging of proposals, vacated rules, or changes that apply to someone else.

How do I find out if a change affects my practice?

Check three things about any claimed change: is it final (a Federal Register final rule, not an NPRM or a headline), is it in effect (compliance dates often lag publication by months or years), and does its scope include a practice like yours (many changes are conditional, like the Part 2 amendments). Every entry on this page answers those three questions with a primary-source link so you can verify rather than take our word.

Sources

Last verified July 15, 2026. Educational self-help information about HIPAA rulemaking, not legal advice; whether any change binds your practice depends on your facts, starting with the covered-entity test. Court decisions summarized here (Purl v. HHS, N.D. Tex., June 18, 2025) are described as of our last verification; check the primary sources before relying on any entry. State law may add stronger requirements. For advice specific to your situation, consult a qualified attorney.

Or never check this page again

Binder + Always-Current: when a cited rule changes, we update the affected documents and send them to you, with a note on what changed and why. $129 one-time, $99/yr after the first 30 days.

See the binder and pricing