The 2026 HIPAA Security Rule Overhaul: What Multi-Location Dental Groups Need to Know

In January 2025, the HHS Office for Civil Rights (OCR) proposed the biggest rewrite of the HIPAA Security Rule since it was first written in 2003. If finalized as written, it would end the long-standing distinction between “required” and “addressable” safeguards — meaning things like encryption and multi-factor authentication, which practices could previously justify skipping, would become mandatory for nearly every covered entity, dental groups included.

The rule isn’t final yet, and its timeline has already slipped once. But for a multi-location dental group, that’s not a reason to wait — it’s a head start.

What’s Actually Changing

The proposed rule is dense, but the changes that matter most to a dental group’s day-to-day operations come down to a handful of items:

• Mandatory encryption of electronic protected health information (ePHI), both at rest and in transit, with only limited exceptions — no more treating encryption as optional.
• Multi-factor authentication required across systems that touch ePHI, not just recommended.
• Same-day access revocation — proposed rules would require cutting off a terminated employee’s access within roughly one hour, not whenever IT gets around to it.
• Regular technical testing, including penetration testing on a set schedule, for covered entities and business associates alike.
• Network segmentation and expanded incident response requirements, raising the bar for how practices detect and contain a breach.

Individually, none of these are exotic. Most are already best practice, and most cyber insurers already ask about them on renewal applications. What changes is that they’d no longer be a judgment call — they’d be the law.

The Real Timeline: Delayed, Not Dead

Here’s the part that gets lost in a lot of the 2026 compliance content circulating right now: the rule has been pushed back. OCR’s Notice of Proposed Rulemaking closed its public comment period in March 2025 with roughly 4,745 comments to work through. A final rule was originally targeted for May 2026. That date came and went, and HHS’s Fall 2026 Unified Agenda now lists July 2027 as the anticipated timeframe for final action — with an effective compliance date likely landing sometime in early 2028, roughly 180 days after that.

The American Dental Association joined a coalition of more than 100 provider organizations, including major health systems, in formally asking HHS to withdraw or significantly scale back the rule, arguing the compliance costs are underestimated, especially for smaller and mid-sized providers.

So it’s reasonable to expect more delay, and possibly more revision, before this becomes enforceable. What’s not reasonable is treating that as a green light to ignore it. OCR still actively enforces the current Security Rule, and a growing body of enforcement activity already treats things like a ransomware incident as a presumed breach of PHI — regardless of what the new rule ultimately requires.

Why This Matters More for Multi-Location Groups

A single-location practice can roll out MFA or renegotiate a vendor contract in an afternoon. A group running compliance across eight, twelve, or thirty locations doesn’t have that luxury — every new safeguard has to be standardized, documented, and verified location by location, often across different practice management systems, different IT vendors, and different staff who were trained (or not) at different times.

That’s exactly the kind of gap OCR investigations tend to find first: not a single catastrophic failure, but inconsistent application of the same policy across sites. A Security Risk Analysis that was thorough at your flagship location but never repeated at the three practices you acquired last year. A business associate agreement signed with your imaging vendor at HQ, but never extended to the software a satellite office picked up on its own.

Waiting for a final rule — especially one that may not land until 2027 or 2028 — means retrofitting all of that under real deadline pressure, across every location at once. Phasing it in now, while there’s no clock running, is the easier path.

Five Things to Start Now

Regardless of when or whether this specific rule is finalized, these are the safeguards examiners, insurers, and increasingly the plaintiffs’ bar already expect. They’re also the foundation the proposed rule is built on:

1. Run a Security Risk Analysis at every location, not just headquarters, and put a recurring schedule around it rather than treating it as a one-time project.
2. Turn on multi-factor authentication everywhere ePHI lives — practice management software, email, cloud storage, remote access.
3. Encrypt ePHI at rest and in transit across every system, including any older hardware or legacy software still in use at recently acquired locations.
4. Get signed Business Associate Agreements with every vendor that touches patient data, including the smaller SaaS tools individual locations may have signed up for on their own.
5. Build an access-revocation process that works the same day, at every location, regardless of which manager is handling the termination.

None of these require waiting on Washington. They’re also difficult to do with spreadsheets and email once you’re coordinating them across more than a handful of sites — which is where having a single system of record for compliance across every location stops being a nice-to-have.

Effex’s Compliance Management module was built for exactly this: standardizing safeguards, tracking documentation, and giving every location the same playbook, so you’re not reconstructing your compliance posture from scratch the day a final rule actually lands.

This article is for informational purposes and isn’t legal advice. Talk to your healthcare attorney or compliance counsel about how the proposed rule and current HIPAA requirements apply to your specific organization.