HIPAA Rulemaking Delays: Trends, Causes, and the Future of the Pending Security Rule Update

Ashley Golden, a 2026 summer associate with Troutman Pepper Locke who is not admitted to practice law in any jurisdiction, also contributed to this article.

Key Points

• OCR’s proposed 2025 HIPAA Security Rule update has a projected finalization date of July 2027, moved from the original May 2026 target and classified as a “long-term action” in the OMB Unified Agenda.
• The 2024 Change Healthcare ransomware attack — the largest protected health care data breach in U.S. history — has renewed pressure on OCR to modernize the HIPAA Security Rule’s cybersecurity requirements.
• A coalition of more than 100 health care organizations, led by CHIME, sent a December 2025 letter to HHS Secretary Robert F. Kennedy Jr. urging full withdrawal of the proposed Security Rule update, citing its deregulatory inconsistency and compliance burden.
• Prior HIPAA rulemaking history — including the 2013 Omnibus Rule and the court-vacated 2024 Reproductive Health Care Privacy Rule — suggests finalization in revised or consolidated form is more likely than adoption of the proposed rule as written.

Since enacting HIPAA’s Privacy and Security Rules, the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has seen repeated delays in finalizing proposed rule updates. The 2025 Security Rule is the latest example. This update is poised to create sweeping changes that would be materially time-consuming and costly for covered entities and business associates to implement, which is why all eyes have been on the status of its implementation. While delays may be more likely absent a binding deadline, the underlying causes reveal more about whether, when, and in what form a rule may be finalized.

Previous HIPAA Rule Update Delays

Historically, HIPAA rule updates have been subject to delays due to external pressures, such as political drivers, enhanced cybersecurity threats, or simply poor timing. The first major update to HIPAA came after the HITECH Act passed in 2009, directing HHS to implement significant amendments. OCR published the proposed rule in July 2010, but only finalized it in the January 2013 HIPAA Omnibus Rule.[1] Although the final rule publication was delayed, the HITECH Act updates were finalized under a single president’s administration, unlike the current scenario for the present proposed Security Rule update.

The next largest proposed Privacy Rule modification, the 2021 Coordinated Care update, was created at the end of President Donald Trump’s first administration and lay dormant throughout President Joe Biden’s term.[2] However, since the commencement of Trump’s second administration, the proposed rule has shown meaningful signs of revival with its submission to the Office of Information and Regulatory Affairs (OIRA)[3] and the OCR’s tribal consultation, both occurring in 2026.[4]

Conversely, the 2024 Reproductive Health Care updates to the Privacy Rule were finalized in just one year, serving as an outlier driven by political factors following Dobbs v. Jackson Women’s Health Organization.[5] Nevertheless, a Texas federal court vacated most of the final rule in June 2025,[6] illustrating that timely finalization does not guarantee survival.

The 2025 Security Rule Update’s Future

The proposed 2025 Security Rule update represents a substantive revision with widespread backlash and critique. Published 14 days before Trump’s second term began,[7] the incoming administration inherited a freshly proposed and harshly criticized rule it did not create, raising speculation about cross-administration delays.

The proposed rule generated nearly 5,000 comments by March 2025. The original May 2026 finalization target has since passed, with a new projected goal for finalization set for July 2027.[8]

While numerous factors impact finalization of the Security Rule update, the tension between mounting pressure for stronger and more modern cybersecurity standards and widespread opposition to the onerous compliance burden is at the forefront.

The Change Healthcare breach in 2024, the largest health care data breach in U.S. history, renewed urgency to address the gaps that the proposed Security Rule update purports to target. Notwithstanding such pressure, industry opposition has been broad and organized. A coalition of 100 health care organizations wrote to Secretary Robert F. Kennedy in December 2025 urging full withdrawal of the proposed rule, citing inconsistencies with the administration’s deregulatory priorities.[9] This level of organized pushback against an already cross-administration proposed rule suggests that revision or prolonged delay would be more likely than finalization in its current form.

Another key consideration is whether the Security Rule update will be finalized independently or consolidated with the pending Privacy Rule update, resembling the 2013 Omnibus Rule. While the Privacy Rule’s 2026 OIRA submission has renewed consolidation speculation, the updated Security Rule’s July 2027 finalization date may signal a stronger likelihood of independent finalization. Whether an omnibus approach would accelerate finalization or result in further delay is uncertain but raises the possibility that both updates could ultimately come to fruition.

Ultimately, the future of the Security Rule update is uncertain. Nevertheless, we present the following scenarios in the order we view as the most likely to least likely:

• We may see the Security Rule update released in July 2027 in materially revised form, signaling a response to unrealistic and/or onerous operational aspects of the proposed rule and the pushback from industry stakeholders.
• We may see the Security Rule released in July 2027 combined with the Privacy Rule updates as one omnibus rule update.
• We may see an option that we cannot predict. However, based on past trends, that is quite unlikely.
• Although also unlikely, any updates could be delayed beyond 2027 or abandoned.
• We believe it is even more unlikely that the Security Rule update will be released in July 2027 in the exact same form as it was in the proposed rule.

The Troutman Pepper Locke team is ready to assist with your HIPAA, privacy, cybersecurity, and compliance needs. We will keep you up to date on any updates surrounding the proposed Security Rule. Please contact Brent Hoard at brent.hoard@troutman.com or Emma Trivax at emma.trivax@troutman.com for more information.

[1] Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules, 78 Fed. Reg. 5566 (Jan. 25, 2013) (codified at 45 C.F.R. pts. 160, 164).

[2] Modifications to the HIPAA Privacy Rule to Support and Remove Barriers to Coordinated Care and Individual Engagement, 86 Fed. Reg. 6446 (proposed Jan. 21, 2021) (to be codified at 45 C.F.R. pts. 160, 164).

[3] HIPAA Privacy Rule: Changes to Support Coordinated Care and Individual Engagement and Reduce Regulatory Burdens Pending EO 12866 Regulatory Review, Off. of Info. & Regul. Affs. (Apr. 2, 2026), https://www.reginfo.gov/public/do/eoDetails?rrid=1334515.

[4] Tribal Consultation on Proposed Modifications to the HIPAA Privacy Rule, 91 Fed. Reg. 1481 (Jan. 14, 2026).

[5] HIPAA Privacy Rule Final Rule to Support Reproductive Health Care Privacy: Fact Sheet, U.S. Department of Health and Human Services (July 1, 2025), https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/final-rule-fact-sheet/index.html.

[6] Id.

[7] HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, 90 Fed. Reg. 898 (proposed Jan. 6, 2025) (to be codified at 45 C.F.R. pts. 160, 164).

[8] HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information, Off. of Info. & Regul. Affs. (July 2026), https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0945-AA22.

[9] Letter from 100 Healthcare Organizations to Robert F. Kennedy, Sec’y, Dep’t of Health & Hum Servs. (Dec. 8, 2025).