The HIPAA Security Rule Overhaul Was Pushed to 2027. Here Is What That Changes for a Practice Running Voice AI.

General information for practice owners, not medical, legal or tax advice.

A regulatory deadline moved. Nothing about your phone line did.

In the Unified Agenda of Federal Regulatory and Deregulatory Actions, the Department of Health and Human Services moved its proposed overhaul of the HIPAA Security Rule (RIN 0945-AA22) onto the Long-Term Actions list, with an anticipated final action date of July 2027. The rule had previously carried a working target of May 2026. The law firm Clark Hill reported the change on 13 July 2026, and The HIPAA Journal reported it on 8 July 2026, linking directly to the entry on reginfo.gov, the site the Office of Management and Budget uses to publish the agenda. The Office for Civil Rights published the underlying Notice of Proposed Rulemaking in the Federal Register on 6 January 2025.

For a medical spa, cosmetic surgery group, longevity clinic or behavioral health practice that is currently evaluating an AI voice agent for the front desk, the delay is easy to misread. It is not permission to wait.

The overhaul is not dead. It has a July 2027 target and no binding deadline.

Placement on the Long-Term Actions agenda generally signals that an agency does not expect to issue a final rule within the next twelve months. Clark Hill notes that Unified Agenda dates "are planning estimates rather than binding deadlines," which cuts both ways: the rule could slip further, or the Office for Civil Rights could publish ahead of the date.

HHS has not explained the move. The plausible pressures are documented, though. The proposal drew close to 5,000 public comments, and more than 100 hospital systems and provider associations formally asked the Department to withdraw it. HHS itself estimated a first-year industry cost of 9 billion dollars, and 6 billion dollars annually in years two through five. A proposal carrying that price tag and that volume of objection is a candidate for narrowing, not just for scheduling.

The existing Security Rule is still fully enforceable, and it is what your deployment is judged against today.

This is the part that gets lost. The current HIPAA Security Rule, in force since 2003 and last substantially amended by the 2013 Omnibus Final Rule, remains the operative standard. Clark Hill puts the point plainly: the Office for Civil Rights "continues to expect covered entities and business associates to implement reasonable and appropriate administrative, physical, and technical safeguards to protect electronic protected health information," and its recent enforcement has focused on the basics - accurate and thorough risk analysis, vendor risk management, workforce training, and remediation of known vulnerabilities.

Nothing in a delayed rulemaking changes what happens if a voice agent at your front desk mishandles protected health information next Tuesday. You are measured against the rule that exists.

Most of what the proposal would require is already the buying question for an AI voice vendor.

The January 2025 Notice of Proposed Rulemaking would be the largest revision to the Security Rule in more than a decade. Among its provisions: eliminating the distinction between "required" and "addressable" implementation specifications, mandating encryption and multi-factor authentication, requiring network segmentation and anti-malware protection, requiring a comprehensive technology asset inventory and a network map showing how electronic protected health information flows, annual penetration testing, vulnerability scanning every six months, annual Security Rule compliance audits, dedicated backup and recovery controls, and stronger verification of business associates' technical safeguards.

Read that list as a vendor questionnaire rather than as a compliance calendar and it stops being a 2027 problem. Every item is a question you can ask a voice AI provider this week. The short version sits on our Discretion page, and a longer form in the ten-question vendor security questionnaire.

Multi-factor authentication is the item the Change Healthcare breach turned into a settled expectation.

The ALPHV/BlackCat ransomware attack on Change Healthcare in February 2024 reached the electronic protected health information of an estimated 192.7 million people. The attackers entered through a Citrix remote access portal using stolen credentials, and multi-factor authentication was not enabled on it. Multi-factor authentication and network segmentation are both requirements in the proposed update.

A practice does not need a final rule to act on that. If your scheduling system, your electronic medical record, or the vendor console that holds your call recordings can be reached with a password alone, the gap is not theoretical and it is not waiting for 2027.

Business associate verification is the provision that reaches your AI vendor directly.

The proposed Security Rule update would shorten timelines for business associates and require covered entities to verify their business associates' technical safeguards rather than accept a signed attestation. That is a meaningful shift for anyone buying conversational AI, because the vendor stack behind a single voice agent is rarely one company. There is usually a telephony carrier, a speech provider, a model provider, and an orchestration layer, and a Business Associate Agreement with the one you signed with does not automatically extend down the chain. We wrote that out in detail in the piece on the BAA chain behind a voice agent stack.

Verification is also where the difference between architectural and policy compliance shows up. A vendor that cannot show you where protected health information rests, who can reach it, and what is logged is describing a policy, not a boundary. That distinction is the subject of an earlier piece on architectural versus policy compliance.

The Privacy Rule is moving faster than the Security Rule.

The delay is not a general slowdown at the Office for Civil Rights. The HIPAA Journal reported that the HHS 2026 regulatory agenda targeted an August 2026 release for the final rule implementing proposed changes to the HIPAA Privacy Rule; as of our last review (October 2026) we had not seen it published, so check the Federal Register for its current status. Those proposed changes address individuals' rights of access to their protected health information, information sharing for care coordination, family and caregiver involvement, and administrative burden.

For a practice, that matters operationally. Right-of-access obligations touch the front desk directly, because the front desk is where the request usually arrives. If an automated intake layer takes the call, it needs a defined path for a records request rather than a best guess.

Use the extra year to build the asset inventory, turn on multi-factor authentication, and verify your vendors.

Consider the version of next spring where the final rule lands early. Your asset inventory already exists because you built it to evaluate a vendor. Your network map already shows where call audio and transcripts go. Your Business Associate Agreements already name every layer of the stack. The rule arrives as a document to file, not a project to start. That is an illustrative model of a well-prepared practice, not a guarantee and not a client result.

Four things are worth doing regardless of what the final rule says, because the current rule already contemplates them and because OCR enforcement already focuses there:

• Refresh the risk analysis, and make it specific to the systems that actually touch patient data, including any voice or SMS automation.

• Build the technology asset inventory. It is the precondition for every other item in the proposal, and it is the artifact most practices do not have.

• Turn on multi-factor authentication everywhere a credential can reach protected health information.

• Ask each vendor to demonstrate its technical safeguards rather than attest to them, and get the Business Associate Agreements executed down the chain.

The checklist a medical director can work through before signing is laid out in the agentic AI compliance checklist, and the specifics of keeping voice and SMS intake inside a compliant boundary are in the piece on HIPAA-Compliant voice and SMS intake.

Frequently asked questions

Has the HIPAA Security Rule been updated for 2026? No. The proposed update has not been finalized. The Office for Civil Rights published the Notice of Proposed Rulemaking on 6 January 2025, and HHS has since moved final action to a July 2027 target on the Long-Term Actions agenda. The existing Security Rule remains in force.

Does the delay mean multi-factor authentication is optional? No. Multi-factor authentication is a requirement in the proposed rule, not in the current one, but the current rule's requirement to implement reasonable and appropriate technical safeguards is enforceable now, and OCR enforcement has focused on exactly this class of control.

Is July 2027 a deadline? No. Unified Agenda dates are planning estimates. The rule could be delayed again, narrowed, or published earlier.

Does any of this make an AI receptionist non-compliant? Not on its own. Nothing in HIPAA prohibits automated intake. What the rule governs is how protected health information is safeguarded, who has access, what is logged, and whether the vendors handling it are under a Business Associate Agreement. A voice agent designed inside those constraints is a covered entity's tool like any other. The term "HIPAA-Certified" does not exist; the correct standard is HIPAA-Compliant, with a signed BAA.

What changed in the proposal that most affects a small practice? The elimination of "addressable" implementation specifications. Under the current rule, a small practice can document why an addressable safeguard is not reasonable in its environment. The proposal would remove that flexibility, which is the core of the industry objection about cost and feasibility for smaller and rural providers.

The same call is also a revenue event. The Thinking Robot builds Revenue Recovery Infrastructure around the first of the Four Revenue Recovery Pillars, Zero-Miss Intake, which addresses a structural fact rather than a sized loss: inquiries arrive outside staffed hours and reach nobody. The safeguards question and the answered-call question are asked of the same system, on the same day, by the same buyer.

Your practice already takes calls it cannot always answer. Those calls already carry protected health information the moment a caller says why they are calling. And the rule that governs how that information is handled is already in force, whatever the Unified Agenda says about 2027. When you see your first structured measurement of where those calls go, the compliance question and the revenue question turn out to have been the same question.

References

• Clark Hill PLC, "HHS Moves HIPAA Security Rule Overhaul to Long-Term Agenda: What the Delay May Mean for Healthcare Organizations," 13 July 2026: clarkhill.com

• The HIPAA Journal, "HIPAA Security Rule Update Postponed," 8 July 2026: hipaajournal.com

• Office of Management and Budget, Unified Agenda entry for RIN 0945-AA22, reginfo.gov.

• HHS Office for Civil Rights, HIPAA Security Rule Notice of Proposed Rulemaking, Federal Register, 6 January 2025.

Zero-Miss Intake is the name of a design goal, not a guarantee that every call will be answered.

Next Step

If your premium practice runs more than 100 inbound consult inquiries a month and has no structured measurement of how many never reach a scheduled consultation, your pipeline may be leaking revenue you cannot see. The Line Audit shows you what actually happens: we call your line at the hours you're least likely to answer and send you the recordings with a written breakdown.

• Request The Line Audit: expand@thethinkingrobot.com

• Audit Real-Time Conversational Velocity: Talk to Rosey, our AI receptionist, at +1 (720) 776-1664 (an AI demo line; calls are recorded).