# What should healthcare GRC buyers distinguish between final rules and proposals?

**Treat Part 2 implementation as a current obligation, the HIPAA Security Rule overhaul as proposed, and the newly announced HTI-5 rule as a separate certification-programme change.** These developments should not share one undifferentiated “HIPAA 2026” project.

### What is already required under 42 CFR Part 2?

Compliance with the 2024 Part 2 final rule was required by **16 February 2026**. HHS also launched its civil enforcement programme from that date. Part 2 applies to federally assisted substance-use-disorder programmes, with some requirements also extending to recipients and holders of Part 2 records. ([hhs.gov](https://www.hhs.gov/hipaa/part-2/index.html?utm_source=openai))

The changes include closer alignment with certain HIPAA permissions, breach notification and patient-rights provisions, while retaining particular protections concerning use of records in proceedings against patients. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html?utm_source=openai))

**Recommended platform review:** examine whether audit evidence, incident attachments, complaints and investigation records can contain Part 2 information. Test restricted access, redaction, disclosure approvals and evidence reuse using synthetic records—not real patient data.

An enterprise evidence repository should not receive patient-level material simply because it supports an audit. Prefer references or appropriately minimised evidence where that can satisfy the assurance objective.

### Is the strengthened HIPAA Security Rule final?

**No final replacement was established by the official sources reviewed.** HHS continues to describe the overhaul as a proposed rule. The current regulatory-agenda entry places it in long-term actions and lists **July 2027** for final action; that is an agency planning target, not a compliance deadline or guarantee of publication. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html?utm_source=openai))

The proposal includes more prescriptive security measures, such as MFA, encryption and compliance-audit provisions. Those proposed changes must remain distinguishable from the Security Rule currently in effect. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet/index.html))

**Recommended procurement approach:** specify adaptable inventories, evidence, testing and remediation now, but place proposal-dependent configuration in an optional phase. Require a change-control mechanism if the final text differs. Do not accept a vendor’s asserted “2026 HIPAA deadline” without the applicable official rule and date.

### What is new in HTI-5?

On **26 October 2026**, HHS announced the HTI-5 final rule, reducing administrative requirements for developers participating in the ONC Health IT Certification Program. The announcement expressly says the proposed information-blocking changes remain under consideration. ([hhs.gov](https://www.hhs.gov/press-room/hhs-finalizes-hti-5-deregulatory-rule.html?utm_source=openai))

**Recommended action:** healthcare technology buyers should request an updated certification and contractual-control impact assessment from affected suppliers. Do not retire privacy, security or AI-assurance controls solely because a certification requirement changes. This research does not establish HTI-5’s provision-level effective and transition dates; confirm those before changing an implementation schedule.