Jul 28, 2026
The anticipated updates to the HIPAA Security Rule are delayed until July 2027
This decision is according to the Office of Information and Regulatory Affairs (reginfo.gov).
The proposed rule, introduced on January 6, 2025 through the Notice of Proposed Rulemaking (NPRM), HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, was originally anticipated for final action in May 2026. If finalized, the proposal would represent the first major update to the HIPAA Security Rule since 2013 and would establish more prescriptive cybersecurity requirements for regulated entities.
The delay provides healthcare organizations additional time to prepare for potential new compliance obligations and strengthen cybersecurity programs.
Proposed Changes Outlined in the NPRM:
• Comprehensive and accurate technology asset inventory and network map showing where electronic protected health information (ePHI) is created, stored, processed, and transmitted
• New and expanded requirements for implementing encryption
• Multifactor authentication
• Network segmentation
• Anti-malware protection
• Annual penetration tests
• Vulnerability scans every 6 months
• Annual audits of Security Rule compliance
• Annual risk analyses
• Additional data backup and recovery controls and testing requirements
• Revised business associate agreements and annual written verification that business associates deploy certain technical safeguards
• Extensive documentation requirements
• Treat all implementation specifications as mandatory, eliminating the distinction between “required” and “addressable” implementation specifications
While the delay may offer some breathing room, it should not be viewed as a reason to pause security efforts.
Healthcare organizations should continue conducting annual Security Risk Assessments (SRAs), addressing identified vulnerabilities, strengthening technical safeguards, and maintaining compliance with the current HIPAA Security Rule requirements. Cyber threats continue to evolve, and proactive risk management remains essential for protecting (ePHI) and supporting patient care.
Have Questions?
Our trusted advisors at the Kentucky REC assist healthcare organizations with strengthening HIPAA Security compliance and cybersecurity readiness by offering specialized services to help organizations identify vulnerabilities, address compliance gaps, and prepare for future regulatory requirements.
Contact YOUR experts at Kentucky REC if you have any questions or need assistance with HIPAA security risk assessments, internal vulnerability network scanning, and project management support. We’re here to help: 859-323-3090.
Jul 21, 2026
Don’t Miss Our Aug 27 Webinar:
2027 CMS NOTICE OF PROPOSED RULE-MAKING: QPP and BEYOND
The Centers for Medicaid and Medicare Services (CMS) issued the notice for proposed rule-making for the 2027 Physician Fee Schedule and Quality Payment Program (QPP) on Tuesday, August 14th, 2026.
CMS is proposing transformational changes to several programs within this rule, including:
- the sunset date for the MIPS track of the QPP
- a further increase in available MIPS Value Pathways (MVPs)
- significant APM incentive payment reforms
- expansion of the Medicare Shared Savings Program
- further clarification of the new Ambulatory Specialty Model
- the introduction of core measures and other substantial changes to QPP performance categories
Stay in the know with the Kentucky REC – Register today and be prepared for 2027 and beyond!
2027 CMS NOTICE OF PROPOSED RULE-MAKING: QPP and BEYOND
THURSDAY AUG 27 12:00 – 1:00 PM ET
CMS encourages providers, healthcare organizations, vendors, and professional organizations to submit comments on the proposed rule.
How to comment:
The proposed rule includes directions for submitting comments within the 60-day comment period. CMS must receive comments by Monday, September 14, 2026.
When commenting, refer to file code: CMS-1848-P.
CMS does NOT accept FAX transmissions.
Use 1 of the 3 following ways to officially submit your comments:
• Electronically: www.regulations.gov
• Regular mail: Centers for Medicare & Medicaid Services, Department of Health and Human Services, Attention: CMS-1848-P, P.O. Box 8016, Baltimore, MD 21244-8016.
• Express or overnight mail: Centers for Medicare & Medicaid Services, Department of Health and Human Services, Attention: CMS-1848-P, Mail Stop C4-26-05, 7500 Security Boulevard, Baltimore, MD 21244-1850.
Contact YOUR experts at Kentucky REC with all your CMS QPP, MIPS/MVP, and APM Track questions. We’re here to help: 859-323-3090.
Jul 3, 2026
Don’t Miss Our July 30 Webinar: Understanding CMS’s Mandatory Ambulatory Specialty Model (ASM)
Does your practice treat 20 or more Medicare patients with heart failure or low back pain each year? If so, CMS’s new Ambulatory Specialty Model (ASM) may directly impact your organization.
Unlike many value-based care initiatives, the ASM is a mandatory payment model for selected specialists billing under Medicare Part B who treat these conditions. Beginning in 2027, the model is designed to increase specialist accountability for chronic disease management, reduce low-value care, and strengthen coordination between specialists and primary care providers.
CMS has released the preliminary list of participating providers, with an update coming later this year. You can check your status by clicking this link.
With financial risk increasing through 2033, now is the time to understand the model and begin preparing your practice.
Join us for our webinar on Thursday, July 30, where we will provide a practical overview of:
• Core-Based Statistical Area (CBSA) selection methodology
• Participant eligibility requirements
• Cohort-specific quality measures
• Financial implications and risk timelines
• Recommended steps to prepare your organization
Whether you are a practice administrator, physician leader, or quality improvement professional, this session will equip you with the insights and action steps needed to prepare for one of the most significant mandatory specialty payment models introduced by CMS.
Register today and get ahead of the changes!
UNDERSTANDING CMS’S MANDATORY AMBULATORY SPECIALTY MODEL
THURSDAY JULY 30 12:00 – 1:00 PM ET
Contact YOUR experts at Kentucky REC with all your CMS QPP, MIPS/MVP, and APM Track questions. We’re here to help: 859-323-3090.
