The 2026 HIPAA Compliance Checklist for Medical Practices
The 2026 HIPAA Security Rule NPRM is the biggest change to HIPAA in a decade. Here's what medical practices in Northeast Houston must do to stay compliant.
What changed in 2026
HHS proposed removing the 'addressable' vs 'required' distinction — every Security Rule specification is now required. That single change reclassifies encryption, MFA, and audit logging from optional to mandatory for every Covered Entity.
The 2026 core checklist
Atascocita IT uses this list on every audit engagement. Print it and walk your practice through each item.
- →Annual Security Risk Analysis on file, dated within 12 months
- →Multi-factor authentication on every account that touches ePHI
- →Encryption of ePHI at rest (full-disk) and in transit (TLS 1.2+)
- →Network segmentation: medical devices isolated from workstations
- →Annual penetration test and vulnerability scan on file
- →Business Associate Agreement (BAA) with every vendor touching ePHI
- →Documented incident response plan tested at least annually
- →Workforce training completed within 90 days of hire, then every 2 years
- →Audit logs retained for 6 years, reviewed monthly
- →Contingency plan with tested backups (immutable, offline copy)
Texas HB300 add-ons
Texas practices have extra state-level obligations beyond federal HIPAA: expanded workforce training, electronic access requests fulfilled within 15 business days, and mandatory breach notification to the Texas Attorney General for breaches affecting 250+ Texans.