HIPAA security update · Reviewed September 12, 2026
2026 HIPAA Security Rule Update: What Medical Billing Companies Should Prepare For
Medical billing and revenue cycle management companies often sit between providers, clearinghouses, payers, remote workforces and multiple software platforms. That makes proposed changes to the HIPAA Security Rule especially relevant to billing organizations that function as business associates.
The most important point first
As of September 12, 2026, HHS still states that the current HIPAA Security Rule remains in effect. The cybersecurity changes discussed below come from the Notice of Proposed Rulemaking issued in December 2024. They are not presented here as final requirements.
Why medical billing companies should pay attention now
HHS explains that the HIPAA Security Rule applies to covered entities and to business associates that create, receive, maintain or transmit electronic protected health information. Medical billing and claims-processing services can fall within business-associate activities when they handle PHI on behalf of covered entities.
The proposal is notable because it would move the Security Rule toward more explicit, measurable cybersecurity expectations. For billing companies, that would place greater emphasis on proving that security controls exist, are documented and continue to work across provider portals, employee devices, Microsoft 365, remote access, billing applications and third-party services.
That direction closely matches a practical security operating model: identify the exposure, implement the control, retain evidence and verify effectiveness over time.
Eight proposed changes billing leaders should understand
Asset inventory and network mapping
The proposal would require an ongoing technology asset inventory and a network map showing the movement of ePHI, reviewed at least annually and after relevant environmental changes.
More specific risk analysis
Risk analysis would explicitly incorporate the asset inventory, network map, threats, vulnerabilities and risk levels rather than relying on a generic checklist.
Multi-factor authentication
The proposal would require MFA with limited exceptions. Billing companies should know where MFA is enforced today and where provider or payer platforms limit available options.
Encryption
The proposal would require encryption of ePHI at rest and in transit, subject to limited exceptions. That makes device, file-transfer and cloud-storage evidence increasingly important.
Vulnerability scanning and penetration testing
HHS proposes vulnerability scanning at least every six months and penetration testing at least annually.
Annual compliance audit
The proposal would require a Security Rule compliance audit at least once every 12 months.
Incident and recovery readiness
Proposed changes include written incident-response procedures, testing requirements, criticality analysis and procedures to restore certain systems and data within defined timeframes.
Business-associate verification
The proposal would create additional annual verification and certification expectations around business-associate technical safeguards.
Source: HHS, HIPAA Security Rule NPRM Fact Sheet. The proposal also addresses network segmentation, anti-malware, configuration controls, backup and recovery, access changes and other requirements.
What this means for an RCM or billing company in practice
| Area | Question to answer now | Useful evidence |
|---|---|---|
| Assets | Can you identify every company-controlled system and device that creates, receives, maintains or transmits ePHI? | Asset inventory, ownership, system purpose, data classification |
| Access | Can you show who has access to internal and client-controlled systems? | Account lists, role exports, approval records, termination records |
| MFA | Where is MFA enforced and where is it not available? | MFA coverage report, documented exceptions, compensating controls |
| Encryption | Can you verify encryption rather than rely on policy statements? | Device encryption reports, storage configuration, secure-transfer settings |
| Vulnerabilities | Are vulnerabilities found, assigned, remediated and verified? | Scan results, remediation tickets, exception approvals, closure evidence |
| Recovery | Can critical billing workflows recover after an outage or ransomware event? | Backup scope, restore-test records, dependency map, recovery exercises |
| Vendors | Do you know which subcontractors handle ePHI and what controls they own? | Vendor inventory, BAAs, security reviews, responsibility matrix |
| Governance | Can leadership see unresolved risks and control effectiveness? | Risk register, metrics, review minutes, remediation status |
Do not wait for a final rule to fix obvious gaps
The proposal is not final, but many of the practices it emphasizes are already sensible ways to reduce security risk. The currently effective Security Rule already requires regulated entities to assess risks to ePHI, implement reasonable and appropriate safeguards, control access, maintain audit controls, protect transmission and periodically evaluate security measures.
HHS also publishes voluntary Healthcare and Public Health Cybersecurity Performance Goals that prioritize controls such as vulnerability management, endpoint protection, asset inventory and other high-impact practices.
Current HIPAA Security Rule summary · HHS Healthcare Cybersecurity Performance Goals
A practical preparation plan for medical billing companies
1. Establish your current-state evidence
Collect what your organization can actually prove today: device inventory, encryption coverage, MFA coverage, vulnerability results, backup tests, access reviews and key policies. Missing evidence is not automatically proof that a control is absent, but it is a signal that verification needs improvement.
2. Map client-controlled dependencies
A billing company may not administer every EHR, payer portal or provider-managed system it uses. Document the difference between controls your organization owns and controls that depend on clients or vendors. Shared responsibility should be explicit.
3. Build a remediation backlog
Prioritize issues based on risk rather than trying to “become compliant” through one large project. Assign each item an owner, target date, affected system, evidence requirement and verification step.
4. Review the program periodically
Security drifts. New employees, client relationships, portals, devices and vendors can change risk faster than policies are updated. Use recurring metrics and evidence reviews to keep the program current.
Start with an external Cyber Risk Snapshot
NCB Cyber’s free Medical Billing Cyber Risk Snapshot reviews publicly observable security conditions such as domain and email-security posture, external exposure indicators and other signals that can help determine where a deeper internal review may be useful.
No agents. No passwords. No system access.
Get the Free Medical Billing Risk Snapshot →Explore Medical Billing Cybersecurity →
Related NCB Cyber resources
- HIPAA Risk Analysis for Medical Billing Companies
- Remote Medical Billing Security: Access and Device Checklist
- Cyber Compliance
- CyberGuard Managed Cybersecurity
Frequently asked questions
Is the proposed HIPAA Security Rule final in 2026?
No. HHS currently states that the existing Security Rule remains in effect while rulemaking continues. Organizations should distinguish current requirements from proposed changes.
Would medical billing companies be affected?
Potentially yes when the billing organization is a HIPAA business associate that creates, receives, maintains or transmits ePHI on behalf of a covered entity. Applicability depends on the organization’s role and activities.
Should a company buy tools now because of the proposal?
Start with risk and evidence, not a shopping list. Determine which controls are already effective, where gaps exist, which systems are client-controlled and what remediation provides the greatest reduction in risk.
This article provides general cybersecurity and operational information and is not legal advice. Organizations should review their obligations with qualified legal and compliance professionals.