HIPAA for ABA agencies in 2026: what is required now and what is only proposed

Set aside the headlines about new cybersecurity rules. The text that measures your agency right now is 45 CFR part 164 subpart C, and it is short enough to read in an afternoon. These are the items marked “Required”, which leave no judgment call about whether to do them¹:

Three more are standards rather than specifications, which means they are mandatory at the standard level: a security awareness and training program for the whole workforce, including management¹; audit controls, meaning mechanisms that record and examine activity in systems holding ePHI¹; and a periodic technical and nontechnical evaluation of whether your policies still meet the subpart¹.

For an ABA agency, that last one is the item most often missing. Adding a telehealth platform, a new data collection app or a contracted biller all count as operational changes that should trigger it.

This is the single most expensive misreading of HIPAA in small practices. Some specifications say “Addressable” rather than “Required”, and people hear “we can skip it”. The rule says something different: you assess whether it is a reasonable and appropriate safeguard, and if implementing it is not, you must document why and implement an equivalent alternative measure if reasonable and appropriate¹.

Encryption in transmission is one of those addressable specifications today¹. So the lawful position is not “we do not encrypt”. It is “we assessed it, here is the written reasoning, and here is what we do instead”.

HHS said the quiet part out loud in its own proposal: it is concerned that some regulated entities proceed as if compliance with an addressable implementation specification is optional, and it states flatly that “that interpretation is incorrect”³.

The business associate agreement is not paperwork hygiene; it is a required implementation specification. You must document the satisfactory assurances through a written contract or other arrangement with the business associate¹, and that contract has to obligate them to report to you any security incident they become aware of, including breaches of unsecured PHI¹.

For agreements with artificial intelligence vendors specifically, which plan tiers include a BAA and which do not, see the guide on BCBAs and AI reports. This article does not repeat it.

1. A use or disclosure not permitted under the Privacy Rule is presumed to be a breach unless you demonstrate a low probability that the information was compromised, through a risk assessment².
2. Affected individuals: without unreasonable delay, and never later than 60 calendar days after discovery².
3. 500 or more individuals: HHS is notified at the same time as the individuals².
4. Fewer than 500: keep a log and report no later than 60 days after the end of the calendar year².
5. More than 500 residents of one state: notify prominent media outlets serving that state².
6. If you are the business associate: notify the covered entity after discovering the breach².

Read the 60 days correctly. It is a ceiling, not a grace period: the rule first says “without unreasonable delay” and only then sets the outer limit².

Enforcement is where the documentation pays for itself. Civil money penalties are tiered by what the entity knew and whether it corrected the violation during the 30-day period after it knew or should have known⁵. The dollar figures printed in the regulation are the unadjusted statutory ones: the amounts in force are updated annually and published at 45 CFR part 102⁵. And for a continuing violation, a separate violation occurs each day⁵.

On January 6, 2025, HHS Office for Civil Rights issued a notice of proposed rulemaking to modify the Security Rule³. If it were finalized as written, the main shifts for a small agency would be:

• A written technology asset inventory and a network map of the systems and assets that can affect ePHI³.
• Encryption of all ePHI at rest and in transit, with limited exceptions³.
• Multi-factor authentication deployed to all technology assets in the relevant systems³.
• The end of the required versus addressable split: all implementation specifications would become required, with specific, limited exceptions³.
• Review and update of controls at least once every 12 months, or sooner on environmental or operational change³.

As of October 15, 2026, this is a proposal. The Unified Agenda entry for RIN 0945-AA22, in the edition with Publication ID 2026, classifies it under “Long-Term Actions” and lists the timetable as the NPRM of 01/06/2025 at 90 FR 898 and a final action of 07/00/2027⁴. The same entry lists no legal deadline⁴.

The practical reading for an owner: do not buy a product today because of a rule that is not final. Do close the gaps the current rule already requires, because most of what the proposal would mandate (encryption, MFA, an asset list) is also the cheapest way to satisfy the risk analysis and risk management you already owe¹.

In force today: 45 CFR part 164 subpart C for security, subpart D for breach notification, and 45 CFR part 160 subpart D for penalties¹²⁵. Proposed only: the January 2025 Security Rule modifications, filed as a long-term action with a projected final action of 07/2027³⁴. Nothing in that proposal obligates you yet, and HHS may change it before any final rule.

This is not legal advice. HIPAA interacts with state law, and the analysis for a specific incident depends on facts this article cannot see. Bring in a health care privacy attorney when a breach may have occurred, when a vendor refuses a BAA, or when you receive a letter from the Office for Civil Rights.