Updated on September 15, 2026 by Anthony Landolfo
A Bigger Compliance Bar Is Headed for Healthcare, Dental, and Pharmacy Practices
If you run a medical practice, dental office, or independent pharmacy in the Philadelphia area, you’ve probably heard rumblings about “new HIPAA rules” coming down from Washington. Here’s the honest, up-to-date picture: the Department of Health and Human Services proposed a major overhaul of the HIPAA Security Rule back in January 2025, and as of this writing, it still hasn’t been finalized. HHS has pushed its target date for a final rule out to roughly July 2027, with an actual compliance deadline likely landing sometime in 2028.
That delay is exactly why so many small healthcare, dental, and pharmacy practices are tuning this out — and exactly why that’s a mistake. The current HIPAA Security Rule is still fully in effect and actively enforced by HHS’s Office for Civil Rights (OCR). And the proposed changes describe, in plain language, what a “reasonable” security posture already looks like to regulators, auditors, cyber insurance underwriters, and the larger health systems your practice partners with. Waiting for the ink to dry on a final rule means waiting two more years to fix problems you already have.
What’s Actually in the Proposal
The draft rule would tighten several requirements that are currently optional (“addressable,” in HIPAA-speak) into flat mandates. The headline items:
Mandatory encryption. Protected health information (PHI) would have to be encrypted both at rest and in transit, across every system, device, and storage location — no exceptions for “we didn’t get around to it yet.”
Multi-factor authentication everywhere. MFA would be required for any system that touches ePHI, not just email or remote access. That includes your EHR, practice management software, imaging systems, and cloud storage.
Network segmentation and a real asset inventory. Practices would need a documented, current map of every device and system that creates, stores, or transmits patient data — and technical separation between clinical systems and everything else on the network.
Regular vulnerability scanning and annual penetration testing. A one-time risk analysis from three years ago wouldn’t cut it. The proposal calls for ongoing automated scanning plus a real annual pen test, with fixed remediation windows (15 days for critical findings, 30 for high-risk ones).
A documented annual risk assessment and a demonstrated ability to restore critical systems within 72 hours of an incident.
Why This Matters More for Small Practices, Not Less
The instinct among many small practice owners is “we’re too small to be a target, and too small to worry about federal rulemaking timelines.” Both assumptions are backwards. Smaller healthcare and pharmacy operations are frequently targeted precisely because they tend to have thinner security than a hospital system — while carrying the exact same breach notification obligations and OCR enforcement exposure per patient record. A ransomware incident that locks up patient charts for a two-provider dental office is every bit as disruptive, and every bit as reportable, as one at a large health network.
On top of that, the pressure is already showing up outside of HIPAA enforcement itself. Cyber insurance applications increasingly ask point-blank whether you have MFA and encryption deployed — and can deny or reprice a claim if you’ve represented that you do and you don’t. Larger health systems and payers are pushing security requirements down through Business Associate Agreements. And patients themselves have gotten far more attentive to how their data is handled since 2020. The proposed rule isn’t creating these expectations; it’s catching up to them.
What to Do Right Now, Regardless of the Final Rule’s Timeline
You don’t need to wait for a final rule to close these gaps. A practical starting checklist:
Get an honest inventory of every system that touches patient data — your EHR, practice management platform, imaging software, e-fax, email, and any cloud storage or backup service. Turn on multi-factor authentication everywhere you can today; this alone closes the door on the majority of the credential-theft attacks we see. Confirm with your IT provider, in writing, that PHI is encrypted at rest and in transit — don’t assume it, verify it. Schedule (or update) a documented annual risk assessment rather than treating it as a one-time compliance checkbox. Ask whether vulnerability scanning and penetration testing are already part of your security program, and if not, get them on the calendar. Finally, actually test your backups against a real recovery-time target — “we have backups” and “we can restore critical systems within 72 hours” are not the same claim.
How Whole Technology Can Help
This is exactly the intersection Whole Technology works in every day: managed IT and cybersecurity built for the healthcare, dental, and pharmacy practices that make up a big part of our Main Line and greater Philadelphia client base. We can run a straightforward readiness assessment that maps your current environment against both the existing HIPAA Security Rule and the direction the proposed rule is heading — so you know exactly where the gaps are before an auditor, an insurance carrier, or an incident finds them for you.
This article is general information, not legal advice — for guidance on your specific compliance obligations, talk with qualified compliance counsel. But for the technical side of the equation — encryption, MFA, backups, monitoring, and testing — that’s ours to handle.
Ready to see where your practice stands? Contact Whole Technology today to schedule a HIPAA security readiness assessment.
