Is the proposed HIPAA Security Rule overhaul already law?
The material verified for this report still identifies it as a proposal, not a final compliance rule. HHS published the Security Rule proposal in January 2025; the current regulatory-agenda entry places final action in July 2027. An agenda date is a planning signal, not a guaranteed publication or compliance deadline. (hhs.gov)
This matters when a supplier says that a particular control “became mandatory under the new 2026 HIPAA rule”. Ask for the final rule, effective date and applicable provision. Do not confuse a sensible security requirement with an inaccurately described legal deadline.
What remains necessary for dental scheduling and patient access?
HHS’s business-associate guidance addresses entities that create, receive, maintain or transmit protected health information on behalf of a covered entity, including qualifying subcontractors. A covered entity does not ordinarily need a separate direct BAA with every subcontractor of its business associate, but the required contractual protections must extend through the relevant relationships. (hhs.gov)
HHS’s cloud guidance also makes clear that outsourcing storage or processing does not remove the need for appropriate HIPAA arrangements and risk analysis. (hhs.gov)
Recommended evidence pack for a dental AI receptionist:
| Evidence | What the buyer should establish |
|---|---|
| End-to-end data map | Which telephony, speech-recognition, model, speech-generation, integration, logging and support services handle patient information. |
| Contract chain | Which supplier is the business associate and how relevant subcontractor obligations are covered. |
| Configuration schedule | Retention settings, support access, permitted processing and whether training use is disabled contractually and technically. |
| Permission matrix | Which appointment and patient-record fields the agent may read or change. |
| Identity and disclosure procedure | What can be disclosed before the caller’s authority has been established. |
| Failure runbook | What happens when the appointment system, identity check or human transfer fails. |
| Evidence export | How the buyer receives event logs, configuration history and incident records. |
These are recommended diligence artefacts. A signed BAA is necessary where applicable, but should not be used as a substitute for assessing the deployed configuration.
What is the specific 2026 change for substance-use-disorder records?
Compliance with the revised 42 CFR Part 2 rule was required by 16 February 2026. HHS identifies complaint handling, enforcement and breach reporting within the regime. It is relevant to records within Part 2’s scope, not automatically to every healthcare conversation. (hhs.gov)
For affected patient-access services, our recommendation is to establish whether Part 2 information can enter recordings, summaries, support tickets or model logs. Do not assume that an ordinary HIPAA procurement checklist resolves every consent and disclosure question.