HIPAA compliance · Security Rule · Client Vision by 3HUEThe rule can wait. The enforcement won’t.
Proposed Security Rule overhaul · final action targeted July 2027
Active OCR risk analysis enforcement · settlements through 2026
The HIPAA Security Rule overhaul is still a proposal. OCR isn’t waiting for it: in 2026 it settled with a treatment center, a software vendor and two employer health plans, and the finding kept coming back to the risk analysis. Client Vision maps your safeguards to the Security Rule, freezes a dated risk analysis, puts every gap on the POA&M, and keeps the record OCR asks for. Run it yourself, or with 3HUE’s HIPAA team.
Screens show the Big Venture Incorporated demo workspace. All figures are sample data. Not legal advice.
Trusted in regulated industriesA transit technology companyA large North American bankA marine services company
3 regulated industries10 business-day Snapshot100% executive-led delivery
What is HIPAA compliance?
Protecting health data, and proving that you do.
HIPAA compliance means meeting the federal rules that protect health information: the Privacy Rule, the Security Rule and the Breach Notification Rule. They apply to health plans, most healthcare providers and clearinghouses, and to the business associates that handle their data. An employer’s self-funded group health plan is a health plan under HIPAA, too.
Privacy RuleWho may use and disclose protected health information, and patients’ rights to access it.
Security RuleAdministrative, physical and technical safeguards for electronic PHI, starting with an accurate, thorough risk analysis.
Breach NotificationTell affected individuals within 60 days of discovery. For 500+ people, HHS and the media too.
Who’s coveredProviders, health plans (including self-funded employer plans), clearinghouses and their business associates.
HIPAA in 2026 · what’s law, what’s proposed
Know which rule you’re actually being measured against.
- Jan 6, 2025Proposed
Security Rule overhaul published as a proposal: MFA, encryption, asset inventory, 72-hour restore.
- Jun 2025Vacated
The 2024 reproductive-health privacy rule was struck down nationwide.
- Jan 28, 2026In effect
Penalties rose with inflation: up to $2,190,294 a year per provision violated.
- Feb 16, 2026In effect
Part 2 alignment for substance-use-disorder records, with updated privacy notices.
- Jul 2027Targeted
Final action on the Security Rule overhaul, per HHS’s regulatory agenda. Until then, the current rule is what OCR enforces.
Status as of September 2026. A Privacy Rule update (patient access within 15 days, among other changes) is also pending, targeted for August 2026 and not yet published.
OCR enforcement · 2026
Enforcement didn’t wait.
$103KSubstance-use treatment center, Feb 2026: no accurate, thorough risk analysis
15Mpeople affected at a practice-software vendor, Mar 2026: a Risk Analysis Initiative action
$1M+across four ransomware settlements, Apr 2026
$245KAn energy company’s self-funded health plan, Apr 2026
$450KA national retailer’s self-funded health plan, Jun 2026
Public HHS OCR resolution agreements. OCR has completed 50+ actions across its risk analysis and right-of-access initiatives.
HIPAA compliance software · seven words
From safeguards to proof. Every screen is the real product.
11 / 12controls cross-walked to HIPAA Security Rule citations on one import
v1.0risk analysis approved, published and frozen with its date
2High findings from the analysis on the POA&M, each with an owner and a date
97audit events verified: the hash chain is intact
Figures from the Big Venture Incorporated demo workspace (sample data), Sep 26, 2026.
Free tool · HIPAA Security Rule readiness check
Could you hand OCR these today?
Tick what you could produce, dated and current, if OCR asked tomorrow. Your answers stay in this browser. It’s a first pass, not legal advice.
0 of 12 ready
Start with the risk analysis. It’s the finding OCR cites most.
Book a HIPAA risk assessmentWays to work with 3HUE
See pricing for all three lanes →01 · Client VisionRun it yourselfFree workspace to start. Assurance adds CloudSignals, RiskOps and a governance pack; Multi adds all six. Annual or monthly.Start free →
03 · Managed by 3HUEWe run it with youA named vCISO and scoped programs (RMP, CIRP, ISP, VCP, SEA), run in the Client Vision plan you hold. Priced to your program in the builder.Book a vCISO strategy call →
HIPAA compliance services · two ways in
Your workspace. Your call on who drives.
Self-serve
Run it yourself.
- Import your baseline and cross-walk it to HIPAA Security Rule citations
- Publish a dated, enterprise-wide risk analysis and freeze each version
- Track every gap to closure on the POA&M, with an owner and a date
- Declare incidents with a timeline built for breach-notice decisions
HIPAA team by 3HUE
Or we get you there.
- A HIPAA security risk assessment across every place your ePHI lives
- A remediation plan sequenced by risk, built with you in the same workspace
- Business associate agreements inventoried and chased down
- Breach readiness: playbooks, tabletop exercises and notification workflow
Questions
What leadership asks first.
What is HIPAA compliance?
Meeting the HIPAA Privacy, Security and Breach Notification Rules: limiting how protected health information is used and disclosed, safeguarding electronic PHI, and notifying people when unsecured PHI is breached. Covered entities and their business associates must comply.
Is the new HIPAA Security Rule final?
No. HHS proposed a major update in January 2025, adding requirements such as MFA, encryption and a technology asset inventory. As of September 2026 it is still a proposal, with final action targeted for July 2027. OCR enforces the current Security Rule in the meantime.
Does HIPAA apply to employers?
An employer isn’t a covered entity just by having employee health information, but a self-funded group health plan is a health plan under HIPAA. In 2026 OCR announced its first settlements with self-funded employer plans, both after ransomware breaches and both citing the risk analysis.
What is a HIPAA risk analysis?
An accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of all the electronic PHI you hold (45 CFR 164.308(a)(1)(ii)(A)). It’s the Security Rule requirement OCR cites most, and it should be current, enterprise-wide and documented.
What are HIPAA penalties in 2026?
Civil money penalties were adjusted for inflation effective January 28, 2026. The calendar-year cap for violations of an identical provision is $2,190,294, though OCR applies lower caps to the lower penalty tiers under its 2019 enforcement discretion. Settlements usually add a two-year corrective action plan.
How fast must we report a HIPAA breach?
Notify affected individuals without unreasonable delay and no later than 60 days after discovery. For breaches affecting 500 or more people, notify HHS within the same window and, where 500+ residents of a state are affected, the media. Smaller breaches go to HHS in an annual log.
Do we need a business associate agreement?
Yes, with any vendor that creates, receives, maintains or transmits PHI on your behalf (45 CFR 164.308(b)(1)). A missing BAA is a common finding, and it’s exactly the kind of gap Client Vision puts on the POA&M with an owner and a date.
HIPAA, handled.
Start with a HIPAA risk assessment: fifteen minutes, your questions, real screens.