HIPAA Security Rule 2026: The Complete Compliance Checklist for Home Health Agencies
The proposed 2026 HIPAA Security Rule update is the most significant proposed change to federal healthcare data security law since 2013. Previously "addressable" specifications — meaning agencies could implement reasonable alternatives — would be converted into hard mandatory requirements if the rule is finalized. For home health agencies, this means no more flexibility on MFA, encryption, or annual penetration testing — once the rule takes effect.
This checklist covers every requirement, organized by implementation priority.
What the Proposed Rule Would Require: The Six New Requirements
The proposed 2026 rule would add six requirements that did not exist as mandates in the original framework:
- Multi-factor authentication (MFA) — proposed to be mandatory for all accounts with ePHI access, no exceptions, no bypass allowed
- Encryption at rest — every device and every cloud storage bucket containing ePHI would be required to be encrypted
- Encryption in transit — TLS 1.2 minimum for all ePHI transmissions
- Biannual vulnerability scanning — with documented findings and remediation tracking
- Annual penetration testing — by a qualified party, with a written report and remediation documentation
- Technology asset inventory and network map — documenting all hardware, software, and ePHI data flows
Administrative Safeguards Checklist
Risk Analysis and Management
- [ ] HIPAA Security Rule risk analysis completed within the past 12 months
- [ ] Analysis covers the full remote and BYOD environment, not just office infrastructure
- [ ] Risk management plan documents controls for every High and Critical finding
- [ ] Each risk management item has a named owner and a completion date
Security Officer and Governance
- [ ] HIPAA Security Officer designated in writing with title documented
- [ ] Security Officer can produce all compliance documentation within 5 minutes of a request
- [ ] Board or governing body receives annual cybersecurity briefing — documented in minutes
Workforce Training
- [ ] All staff with ePHI access trained in the past 12 months — 100% completion, field staff included
- [ ] Training records include individual name, date, content, and completion confirmation
- [ ] New staff training completed before ePHI access is granted
Policies and Business Associate Agreements
- [ ] Written Information Security Program exists, dated, and signed by senior leadership
- [ ] Sanctions policy documents specific consequences for violations — not vague language
- [ ] Complete vendor inventory — every vendor with ePHI access identified
- [ ] Signed BAA on file for every vendor on the inventory — zero gaps