The 2026 HIPAA Security Rule update removes the old "addressable vs. required" distinction — encryption and multi-factor authentication for anything touching ePHI are now effectively mandatory, not optional best practices. If your application handles patient data, this checklist gives you a working readiness assessment against where the bar actually sits now, not where it was in 2013.

Who this is for

Healthtech product and engineering leaders, CISOs, and compliance officers preparing a new healthcare application for launch, or auditing an existing one against 2026 requirements.

Access controls

  • [ ] Unique user IDs for every workforce member with system access — no shared logins, anywhere, including for testing or support accounts.
  • [ ] Role-based access control (RBAC) implemented and enforced at the data layer, not just the UI.
  • [ ] Periodic access reviews scheduled (quarterly minimum) to remove over-privileged or stale accounts.
  • [ ] Multi-factor authentication enforced on every access point to ePHI — this is no longer addressable under the 2026 rule update; document any narrow exception in your risk analysis if one genuinely applies.
  • [ ] Session timeout and automatic logoff configured for all clinical and admin interfaces.

Encryption

  • [ ] ePHI encrypted at rest using current, non-deprecated algorithms (AES-256 or equivalent) — audit any legacy encryption still in use.
  • [ ] ePHI encrypted in transit (TLS 1.2 minimum, TLS 1.3 preferred) across every endpoint, including internal service-to-service calls.
  • [ ] Encryption key management documented and reviewed — who holds keys, how they're rotated, and what happens on employee offboarding.
  • [ ] Backups encrypted to the same standard as production data, not treated as a lower-risk copy.

Risk analysis and monitoring

  • [ ] Annual Security Risk Assessment (SRA) scheduled and documented — the 2026 update moves this from a general expectation to a mandated cadence.
  • [ ] Risk analysis documents specific threat-vulnerability pairs, not a generic checklist pass.
  • [ ] Centralized audit logging across every system touching ePHI, with logs retained per your compliance policy.
  • [ ] Active monitoring and alerting on anomalous access patterns — not logs that are only reviewed after an incident.

Administrative and physical safeguards

  • [ ] A designated security officer with clear authority and documented responsibilities.
  • [ ] Workforce security training completed and tracked, including for contractors and temporary staff.
  • [ ] Signed Business Associate Agreements (BAAs) in place with every vendor that touches ePHI — cloud hosting, analytics, email, support tooling included.
  • [ ] Physical access controls documented for any on-premises infrastructure or data center, even when most workloads are cloud-hosted.

Incident response

  • [ ] A written incident response plan specific to a PHI breach scenario, not a generic IT security plan.
  • [ ] Breach notification timelines and responsibilities documented against current HHS requirements.
  • [ ] The plan tested at least annually with a tabletop exercise, not just filed and forgotten.
  • [ ] Asset inventory current enough that you can actually scope a breach quickly — you can't contain what you can't enumerate.

Red flags to watch for

  • [ ] Any system storing or transmitting ePHI without MFA, citing "addressable" status — that exception is closing under the 2026 update.
  • [ ] A vendor handling PHI without a signed BAA.
  • [ ] Encryption applied inconsistently — production covered, but staging, backups, or logs left in plaintext.
  • [ ] A risk analysis that hasn't been updated since the application's initial launch.

How to use this

Treat the access control and encryption sections as your immediate priority — they're the areas most directly reclassified from optional to required under the 2026 update. Use the incident response and risk analysis sections to structure your next audit cycle rather than waiting for a regulator or breach to force the review.