Treat Part 2 implementation as a current obligation, the HIPAA Security Rule overhaul as proposed, and the newly announced HTI-5 rule as a separate certification-programme change. These developments should not share one undifferentiated “HIPAA 2026” project.
What is already required under 42 CFR Part 2?
Compliance with the 2024 Part 2 final rule was required by 16 February 2026. HHS also launched its civil enforcement programme from that date. Part 2 applies to federally assisted substance-use-disorder programmes, with some requirements also extending to recipients and holders of Part 2 records. (hhs.gov)
The changes include closer alignment with certain HIPAA permissions, breach notification and patient-rights provisions, while retaining particular protections concerning use of records in proceedings against patients. (hhs.gov)
Recommended platform review: examine whether audit evidence, incident attachments, complaints and investigation records can contain Part 2 information. Test restricted access, redaction, disclosure approvals and evidence reuse using synthetic records—not real patient data.
An enterprise evidence repository should not receive patient-level material simply because it supports an audit. Prefer references or appropriately minimised evidence where that can satisfy the assurance objective.
Is the strengthened HIPAA Security Rule final?
No final replacement was established by the official sources reviewed. HHS continues to describe the overhaul as a proposed rule. The current regulatory-agenda entry places it in long-term actions and lists July 2027 for final action; that is an agency planning target, not a compliance deadline or guarantee of publication. (hhs.gov)
The proposal includes more prescriptive security measures, such as MFA, encryption and compliance-audit provisions. Those proposed changes must remain distinguishable from the Security Rule currently in effect. (hhs.gov)
Recommended procurement approach: specify adaptable inventories, evidence, testing and remediation now, but place proposal-dependent configuration in an optional phase. Require a change-control mechanism if the final text differs. Do not accept a vendor’s asserted “2026 HIPAA deadline” without the applicable official rule and date.
What is new in HTI-5?
On 26 October 2026, HHS announced the HTI-5 final rule, reducing administrative requirements for developers participating in the ONC Health IT Certification Program. The announcement expressly says the proposed information-blocking changes remain under consideration. (hhs.gov)
Recommended action: healthcare technology buyers should request an updated certification and contractual-control impact assessment from affected suppliers. Do not retire privacy, security or AI-assurance controls solely because a certification requirement changes. This research does not establish HTI-5’s provision-level effective and transition dates; confirm those before changing an implementation schedule.