2025–2026 HIPAA Updates
What Your Practice Needs to Know
HIPAA is undergoing its most significant changes in over a decade — new Security Rule mandates, Privacy Rule updates, NPP revision deadlines, and escalating enforcement. Here's the full timeline, what it means for dental practices, and how Intake.Dental keeps you compliant automatically.
HIPAA Is Changing. Here's What's Happening.
A comprehensive timeline of regulatory changes affecting dental practices, with compliance status for Intake.Dental customers.
Privacy Rule Updates — Reproductive Health & Substance Use Protections
HHS finalized changes restricting how PHI related to reproductive healthcare and substance use treatment can be shared. New attestation requirements went into effect — providers must now obtain signed confirmation that PHI requests are not for prohibited investigative purposes.
✓ Intake.Dental CompliantHIPAA Security Rule NPRM Published
The proposed Security Rule overhaul was published in the Federal Register on January 6, 2025 — the most sweeping update since 2013. The 60-day comment period attracted extensive industry feedback. Key proposals include mandatory MFA, encryption, vulnerability scanning, penetration testing, and elimination of “addressable” safeguards.
✓ Already Exceeds Proposed RequirementsOCR Phase 3 HIPAA Audits Begin
OCR confirmed the long-awaited third phase of HIPAA compliance audits is underway, initially targeting 50 covered entities and business associates. Audits focus on risk analysis and risk management requirements of the Security Rule, with expanded scope planned.
✓ Audit-Ready DocumentationNotice of Privacy Practices (NPP) Revision Deadline
All covered entities must have updated Notices of Privacy Practices by February 16, 2026. Updated NPPs must clearly explain patient rights under the reproductive health and substance use data protections. Intake.Dental's consent and privacy notice templates are already updated.
✓ Templates Updated42 CFR Part 2 / HIPAA Alignment — Full Compliance Deadline
The alignment of 42 CFR Part 2 (substance use disorder records) with HIPAA standards reaches its full compliance date on February 16, 2026. Practices handling SUD records must follow unified data handling protocols under both regulatory frameworks.
✓ Intake.Dental CompliantSecurity Rule Final Rule — Expected Publication
The finalized HIPAA Security Rule is expected to be published around May 2026. Major mandatory requirements will include:
Multi-factor authentication for all ePHI systems · Encryption at rest and in transit with no exceptions · Annual technology asset inventories and network mapping · Biannual vulnerability scans and annual penetration testing · 72-hour incident response and restoration timelines · Direct compliance liability for business associates · 24-hour BA contingency plan activation notification
Intake.Dental — Already Meets Proposed StandardsSecurity Rule Compliance Deadline (Estimated)
With a 180–240 day compliance window after publication, most organizations will need to meet the new security standards by late 2026 or early 2027. The HHS estimates industry-wide costs of $9 billion in the first year and $34 billion over five years. Practices using Intake.Dental will already be compliant.
Zero-Effort Compliance for Our PracticesThe Cost of Non-Compliance Is Rising
OCR enforcement is intensifying. In 2025 alone, fines exceeded $6.6 million — and the proposed rule eliminates the “addressable” safeguard distinction that many practices relied on.
How Intake.Dental Keeps You Ahead
As HIPAA regulations evolve, our platform updates automatically — so you never fall behind.
Auto-Updated NPP Templates
Privacy notice templates are updated as regulations change. The February 2026 NPP revisions are already live in your forms — no manual effort required.
Encryption That Exceeds 2026 Mandates
Dual-layer AES-256-GCM + TreeChain glyph encryption already surpasses the proposed mandatory encryption requirements — at rest and in transit.
MFA-Ready Infrastructure
Multi-factor authentication support for practice administrator accounts — meeting the proposed mandatory MFA requirement before it's even finalized.
72-Hour Incident Response
Our infrastructure is built for the proposed 72-hour incident response timeline. Automated monitoring, alerting, and notification systems are always active.
Comprehensive Audit Trails
Every data access, modification, and admin action is logged with timestamps and user identity — ready for OCR Phase 3 audits at any moment.
BAA Chain Maintained
We maintain executed BAAs with all subcontractors (AWS, Supabase, Sikka AI) and update them as requirements change — meeting the proposed direct BA liability rules.
Frequently Asked Questions
Common questions about HIPAA compliance for dental practices and how Intake.Dental keeps you protected.
Dental offices using digital intake forms must ensure encryption of patient data at rest and in transit, role-based access controls limiting who can view PHI, comprehensive audit trails logging every access event, signed Business Associate Agreements with any vendor handling form data, and updated Notices of Privacy Practices.
Forms must be served over HTTPS with automatic session timeouts, unique user identification for all staff, and a documented incident response plan. Intake.Dental handles all of these requirements automatically for every practice.
All covered entities must have updated Notices of Privacy Practices by February 16, 2026. Updated NPPs must clearly explain patient rights under the new reproductive health and substance use data protections enacted in the April 2024 Privacy Rule updates. Intake.Dental's consent and privacy notice templates are already updated to meet these requirements.
The proposed HIPAA Security Rule update, published January 6, 2025, is the most sweeping update since 2013. It eliminates the distinction between “required” and “addressable” safeguards — making all specifications mandatory. Key requirements include mandatory MFA, encryption at rest and in transit, annual technology asset inventories, biannual vulnerability scans, annual penetration testing, 72-hour incident response, and direct compliance liability for business associates.
The final rule is expected around May 2026, with a 180–240 day compliance window — meaning enforcement deadlines will fall in late 2026 or early 2027. Intake.Dental already meets or exceeds all proposed requirements.
Yes. The proposed rule makes MFA mandatory for all systems handling electronic protected health information (ePHI). Previously, MFA could be treated as “addressable,” allowing practices to document why they chose not to implement it. The 2026 update eliminates this flexibility — MFA will be required for EHRs, patient portals, and all administrative accounts handling PHI.
Yes. Intake.Dental automatically updates consent form templates, privacy notices, and system security configurations as HIPAA regulations change. Our encryption architecture, MFA support, audit logging, and incident response infrastructure already meet or exceed the proposed 2026 Security Rule requirements — meaning practices on Intake.Dental require zero additional effort to maintain compliance.
The HHS estimates the proposed Security Rule changes will cost the healthcare industry approximately $9 billion in the first year and $34 billion over five years. For individual dental practices, costs include technology upgrades (MFA, encryption), vulnerability assessments, penetration testing, staff training, updated BAAs, and extensive documentation.
Practices using Intake.Dental already meet the proposed technical requirements for digital patient intake, significantly reducing their compliance burden and associated costs.
HIPAA violations carry significant penalties. In 2025, OCR levied more than $6.6 million in fines, with individual penalties ranging from $80,000 to $3,000,000. The most common violations involve inadequate risk assessments, ransomware incidents, and weak technical safeguards. The proposed 2026 rules eliminate the “addressable” safeguard distinction, reducing the room for interpretation that some practices previously relied on.
Under the HIPAA Breach Notification Rule (45 CFR § 164.402), if PHI is encrypted in accordance with NIST guidelines and the encryption keys have not been compromised, an unauthorized access incident may not constitute a reportable breach. Intake.Dental's dual-layer encryption (AES-256-GCM + TreeChain glyph cipher) provides two independent encryption systems, significantly strengthening the safe harbor position compared to single-layer encryption.
Yes. Every Intake.Dental account includes an executed Business Associate Agreement at no extra cost. Dental Education, Inc. also maintains BAAs with all subcontractors in the service chain — including AWS, Supabase, Sikka AI, and payment processors — ensuring end-to-end HIPAA compliance throughout the entire data processing pipeline.
42 CFR Part 2 governs the confidentiality of substance use disorder (SUD) patient records. The February 2024 Final Rule aligned Part 2 more closely with HIPAA standards, with full compliance required by February 16, 2026. While primarily affecting behavioral health providers, dental practices that treat patients with SUD histories or who take medication-assisted treatment should ensure their intake forms and data handling follow the unified protocols. Intake.Dental's forms and consent workflows accommodate these requirements.
Stay Compliant Without the Hassle
Intake.Dental handles the technical compliance so you can focus on your patients. Start your free trial today.