The proposed HIPAA Security Rule update may be delayed until 2027, but protecting patient information cannot wait. For dental practices, this is an opportunity to get ahead of potential requirements rather than scramble to respond after a final rule is announced.
What Has Changed?
The U.S. Department of Health and Human Services proposed significant updates to the HIPAA Security Rule to strengthen safeguards for electronic protected health information (ePHI). The federal regulatory agenda now projects final action in July 2027. That date is a planning estimate—not a final rule, an effective date, or a compliance deadline. Existing HIPAA Security Rule obligations remain in effect today.
The proposal points toward more specific expectations for cybersecurity measures such as multifactor authentication, encryption, asset inventories, network visibility, vulnerability management, backup and recovery testing, and documented security oversight. The final requirements could change before adoption.
TaaSPAK Has Been Preparing for 18 Months
At TaaSPAK, we have not been waiting for a deadline. For the past 18 months, our team has been working from the proposed rule to create, update, and innovate reporting capabilities, cybersecurity safeguards, and service offerings designed to help dental and healthcare offices align with the direction of these proposed changes—well ahead of time.
That work reflects a simple belief: strong cybersecurity should be built into a practice’s everyday technology environment, not rushed into place when a new regulation takes effect.
What Should Your Practice Review Now?
Dental practices can use this time to better understand where patient information lives, who can access it, how it is protected, and how quickly operations could recover from an incident. Important areas to evaluate include:
- Identity and access: User permissions, account security, and multifactor authentication.
- Data protection: Encryption and safeguards for sensitive patient information.
- Network and endpoint security: Firewalls, device protection, network visibility, and segmentation opportunities.
- Backup and recovery: Backup integrity, recovery procedures, and testing.
- Documentation and reporting: Asset inventories, security findings, and evidence that safeguards are operating as intended.
These are valuable security practices regardless of when—or in what form—the proposed HIPAA changes are finalized.
Let Us Show You—At No Cost
We would welcome the opportunity to show your office what we have been building and where your current technology and security environment stands.
Through TaaSPAK’s Complimentary HIPAA Security Analysis, we review key areas of your practice’s cybersecurity and HIPAA security safeguards, identify potential gaps, and provide useful findings to help guide next steps. There is no cost or obligation.
Request Your Complimentary HIPAA Security Analysis Today →
A security analysis supports readiness planning; it does not guarantee HIPAA compliance or replace a comprehensive risk analysis where required.