HIPAA Security Rule Overhaul Delayed to July 2027: What Genetic Testing Labs Should Do Now
Short answer: HHS has pushed final action on its proposed HIPAA Security Rule overhaul from May 2026 to July 2027, per the 2026 Unified Agenda. The January 6, 2025 proposal is not in effect, so today's Security Rule still applies. Genetic testing labs should not pause security work, because OCR keeps enforcing risk analysis failures in the meantime.
What Changed: A One-Year Slip
The proposed rule, titled "HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information," was published on January 6, 2025. According to a July 16, 2026 McDermott+ client alert, the 2026 Unified Agenda released by OMB's Office of Information and Regulatory Affairs now lists the rule as a "long-term action" with projected final action in July 2027. The September 2025 agenda had pointed to May 2026.
Fierce Healthcare reported that the delay pushes final action back by a year and noted that the Security Rule is 23 years old, with this proposal representing its first major update in more than 10 years. The same report said HHS is moving ahead separately on a Privacy Rule final rule aimed at patient access and care coordination, so the two tracks should not be conflated.
For molecular labs, the practical reading is simple: a delay in rulemaking is not a delay in obligation. A proposed rule creates no new legal duty, but it signals where regulators expect mature programs to be heading.
Why the Proposal Stalled
The proposal runs 125 pages, and OCR received nearly 5,000 comments, according to Fierce Healthcare. In a December letter, the College of Healthcare Information Management Executives and more than 100 health systems and provider organizations urged HHS to withdraw the changes, writing that the update would place "substantial new financial burdens" on HIPAA-regulated entities.
That opposition is relevant to labs because the cost argument is not hypothetical for small and mid-sized molecular laboratories. Many run lean IT teams and rely on outside billing, LIS, and cloud vendors. The proposal would apply equally to covered entities and, through contracts, to the business associates they depend on. Whether the final text is narrowed, phased in, or finalized as proposed remains unknown, and nothing in the sources reviewed for this article answers that.
What the Proposal Would Require
Per the McDermott+ summary, the proposed rule would, if finalized:
- Expand encryption and multi-factor authentication requirements.
- Require technology asset inventories and network maps.
- Revise business associate agreements, with written verification of technical safeguards at least every 12 months.
- Eliminate the "required" versus "addressable" distinction for implementation specifications.
- Require ongoing risk analysis reviews at least every 12 months.
- Require penetration tests at least every 12 months and vulnerability scans at least every six months.
- Add backup, recovery, and testing controls.
- Require Security Rule compliance audits at least every 12 months.
Fierce Healthcare also described written security incident response plans, tested at least annually, and more prescriptive risk analyses. Network segmentation was cited among the technical standards.
The cadence chart makes the shift clear. Many labs perform some of these activities informally or only after an incident. The proposal would convert them into scheduled, documented controls that an auditor could request.
OCR Is Enforcing the Current Rule Anyway
The strongest argument against waiting is OCR's enforcement record. On April 23, 2026, HHS OCR announced settlements with four HIPAA-regulated entities over separate ransomware investigations, according to a Nixon Peabody analysis published April 30, 2026. The four settlements totaled more than $1 million, affected over 427,000 individuals, and each entity agreed to a corrective action plan with two years of OCR monitoring.
The announcement brought the total to 13 completed investigations under OCR's Risk Analysis Initiative and 19 completed ransomware investigations. Each of the four entities was cited for failing to conduct an accurate and thorough security risk analysis. One of them, Assured Imaging, involved 244,813 individuals and also an impermissible disclosure of ePHI and late notification. OCR Director Paula M. Stannard said that "hacking and ransomware are the most frequent type of large breach reported to OCR."
The lesson is that the existing risk analysis requirement, which has been part of the Security Rule for two decades, is the enforcement lever OCR is pulling today. A lab with a stale or generic risk analysis is exposed now, not in 2027.
Why Genetic Testing Labs Carry Extra Exposure
Genomic data is uniquely identifying and cannot be changed after a breach. Labs also sit at the intersection of several oversight efforts: HHS-OIG reported that genetic tests made up 43 percent of the $8.4 billion Medicare Part B spent on lab tests in 2024, and CMS has asked for public input on tools to curb lab fraud. For related coverage, see our analysis of the OIG Work Plan item on Part B genetic testing and the current status of the FDA LDT rule. A security incident that invites an OCR investigation can also draw attention to the same lab's billing and documentation practices.
Billing and claims workflows add another layer. Denial management, prior authorization, and eligibility checks move PHI between labs, clearinghouses, and portals. Our guide to genetic testing denials shows how many handoffs a single claim can involve, and each handoff is a business associate relationship to document.
A Practical Action Plan for 2026 and 2027
None of the following is legal advice, but each step aligns with both the current rule and the direction of the proposal.
- Refresh the risk analysis. Make sure it is accurate, thorough, enterprise-wide, and dated. Include the LIS, sequencing instruments' data stores, cloud storage, and billing systems.
- Build an asset inventory and data-flow map. This is a proposed requirement and also the foundation of a defensible risk analysis.
- Inventory business associates. Start collecting security documentation from billing, LIS, and cloud vendors, and review agreement language.
- Turn on multi-factor authentication for remote access and for systems holding ePHI, where not already enabled.
- Test your incident response and recovery plan. Run a tabletop exercise and confirm that backups can actually be restored.
- Document decisions. If you choose not to adopt a safeguard, record the reasoning in the risk analysis.
For executive teams, the simplest framing is that the proposed rule is a preview of an audit checklist. Meeting parts of it early costs less than building a program under a compliance deadline.
What to Watch Next
Watch the next Unified Agenda for any movement of the July 2027 date, and watch OCR press releases for further Risk Analysis Initiative resolutions. Also monitor whether any final rule includes phase-in periods for smaller entities, since the sources reviewed here do not describe transition provisions. Labs that follow national coverage developments, such as the MolDX expansion, should add HIPAA rulemaking to the same regulatory calendar. For more resources, visit the ScreenMyGene homepage.
Frequently Asked Questions
Is the HIPAA Security Rule overhaul in effect for my lab?
No. The proposal was published January 6, 2025, and the 2026 Unified Agenda projects final action in July 2027. Until a final rule is issued, the current Security Rule applies, including the existing risk analysis requirement that OCR continues to enforce.
What did HHS change about the timeline?
The September 2025 Unified Agenda targeted May 2026 for final action. The 2026 agenda, per a July 16, 2026 McDermott+ alert, lists the rule as a long-term action with projected final action in July 2027, roughly a year later.
Why did industry oppose the proposal?
Nearly 5,000 comments were filed. In a December letter, CHIME and more than 100 health systems and provider organizations urged HHS to withdraw the changes, arguing they would place substantial new financial burdens on HIPAA-regulated entities, according to Fierce Healthcare.
Should genetic labs wait to invest in security upgrades?
Waiting carries enforcement risk. OCR has completed 13 Risk Analysis Initiative investigations, and its April 2026 settlements cited failures to conduct accurate and thorough risk analyses. Labs can adopt proposed practices voluntarily where they already fit their risk analysis.
How does this affect business associates like billing and software vendors?
The proposal would require covered entities to obtain written verification of business associates' technical safeguards at least every 12 months. Labs can begin collecting security attestations and updating vendor agreements now to avoid a compliance scramble later.
Educational disclaimer: This article is provided for general educational purposes only and is not legal, compliance, or medical advice. Regulatory timelines can change. Consult qualified counsel and your compliance officer about your organization's obligations.
Sources: McDermott+ client alert, "Final action on HIPAA Security Rule modifications now projected for July 2027" (July 16, 2026); Fierce Healthcare, "Feds push back HIPAA security rule overhaul to July 2027"; Nixon Peabody, "Ransomware Enforcement Update" (April 30, 2026) summarizing HHS OCR's April 23, 2026 announcement; HHS-OIG report OEI-09-25-00330 (January 2026); MedTech Dive, "Genetic tests come under scrutiny in Trump administration's fraud crackdown" (March 12, 2026).