The January 2026 HHS OCR Newsletter made one thing crystal clear: the era of "good enough" HIPAA compliance is over. If your healthcare practice has been treating security controls as checkboxes rather than actual defenses, 2026 is the year that approach catches up with you.
Two recent breaches underscore why this matters right now. The Oracle Health incident exposed patient records across multiple healthcare systems through a compromised legacy server. The Minnesota Department of Human Services breach: affecting over 500,000 individuals: traced back to insufficient access controls and delayed threat detection. Neither organization lacked compliance documentation. Both lacked hardened systems.
The difference between compliance and security has never been more consequential.
The Death of "Addressable" Standards
For years, healthcare organizations have operated under a HIPAA Security Rule that distinguished between "required" and "addressable" implementation specifications. If a control was "addressable," you could implement an alternative: or skip it entirely: as long as you documented your reasoning.
That flexibility is disappearing.
The proposed HIPAA Security Rule updates eliminate the "addressable" designation almost entirely. Multi-factor authentication, encryption at rest and in transit, access termination procedures, vulnerability scanning: these shift from "implement if reasonable" to "implement, period."
Here's what changes:
- Multi-factor authentication (MFA) becomes mandatory for all system access, not just remote connections or privileged accounts
- Encryption of ePHI at rest and in transit moves from addressable to required, with only narrow documented exceptions
- Access revocation must occur within one hour of workforce termination
- Vulnerability scanning becomes a required activity every six months
- Annual penetration testing is no longer optional
- Compliance audits must occur at least annually with documented evidence
The message from HHS is unmistakable: documentation without implementation no longer passes muster.
What "System Hardening" Actually Means
The OCR's January newsletter emphasizes system hardening as a core defensive strategy: not a compliance exercise. But what does that look like in practice for a medical practice, dental office, or specialty clinic?
System hardening means reducing your attack surface by eliminating unnecessary access points, enforcing strict configurations, and maintaining continuous visibility into your environment. It's the difference between having a lock on your front door and having a lock, a deadbolt, motion sensors, and cameras: all monitored 24/7.
Specifically, system hardening includes:
Configuration management: Every workstation, server, and medical device should run standardized security configurations. Default passwords get changed. Unnecessary services get disabled. Administrative privileges get restricted to personnel who actually need them.
Network segmentation: Your billing system shouldn't share network space with your imaging equipment. Proper segmentation limits lateral movement when: not if: an attacker gains initial access.
Endpoint protection: Anti-malware deployment across all devices, including medical equipment running embedded operating systems that vendors rarely patch.
Port and protocol restrictions: If a port isn't essential for operations, it gets closed. If a protocol is outdated or insecure, it gets disabled.
This isn't theoretical. The Oracle Health breach exploited a legacy system that hadn't been hardened against known vulnerabilities. A properly segmented network with current configurations would have contained the damage. Instead, patient data across multiple healthcare systems was compromised.
Three Actionable Wins for 2026
You don't need to overhaul your entire IT infrastructure overnight. But you do need to start somewhere concrete. These three priorities directly address the updated HIPAA requirements while meaningfully improving your security posture.
1. Complete Your Asset Inventory (Including Medical Devices)
The updated HIPAA Security Rule requires comprehensive technology asset inventories and network maps showing exactly how ePHI flows through your environment. This inventory must be updated annually: or whenever systems change.
Most practices know what computers they have. Far fewer can account for every connected medical device, every cloud application storing patient data, every vendor with network access.
Start here:
- Document every device that touches, stores, or transmits patient information
- Include medical devices, imaging systems, IoT devices, and cloud services
- Map the data flows: where does ePHI originate, where does it travel, where does it rest?
- Identify devices running outdated operating systems that can't receive security updates
You cannot harden what you haven't inventoried. And under the new rule, you cannot claim compliance without that inventory documented and current.
2. Validate 72-Hour Recovery Readiness
When ransomware hits a healthcare organization, the question isn't whether you have backups. It's whether you can actually restore operations within a timeframe that doesn't endanger patients or destroy the business.
The updated requirements emphasize documented recovery procedures with specific timeframes. A 72-hour recovery window has emerged as the practical standard for healthcare organizations.
Test your recovery capability now:
- Can you restore critical systems: EHR, scheduling, billing: within 72 hours of a total system loss?
- Are backups stored offline or in immutable storage that ransomware cannot encrypt?
- Have you actually tested a full restoration, or are you assuming it works?
- Do staff members know their roles in a recovery scenario?
Documented backup procedures mean nothing if the actual restoration takes two weeks. The only way to know is to test it.
3. Implement Regular Vulnerability Scanning
The shift from addressable to mandatory makes vulnerability scanning every six months a baseline requirement: not a best practice recommendation.
For healthcare practices, this means:
- Automated scanning of all network-connected devices at least twice annually
- Prioritized remediation based on severity and exploitability
- Documentation of identified vulnerabilities and remediation timelines
- Inclusion of medical devices in scanning scope (coordinate with device vendors on timing and procedures)
Vulnerability scanning identifies the gaps before attackers do. Combined with annual penetration testing: now also required: you gain visibility into weaknesses that compliance checklists alone will never reveal.
Your Business Associates Are Now Your Problem
One often-overlooked element of the HIPAA updates: Business Associate Agreements must now include explicit, specific security requirements. Generic BAA language no longer suffices.
Your BAAs must specify:
- MFA requirements for your data
- Encryption standards
- 24-hour incident notification timelines
- Vulnerability scanning and penetration testing requirements
- Annual evidence of safeguard deployment: not just attestations
If your billing company, cloud EHR vendor, or IT provider cannot demonstrate these controls, they become a compliance liability and a security risk. The Minnesota DHS breach originated through a business associate relationship. Your vendor's weakness is your exposure.
The Bottom Line
The regulatory environment has caught up to the threat environment. HHS OCR is no longer accepting "we documented an alternative" as an answer when patient data gets breached. System hardening: real, verified, tested security controls: is now the expectation.
For healthcare providers, clinic administrators, and dental practices, this means moving beyond compliance paperwork toward actual defensive capability. Asset inventories, recovery testing, vulnerability scanning, and hardened configurations aren't optional extras. They're the foundation of both regulatory compliance and organizational survival.
The practices that treat 2026 as a wake-up call will navigate this transition. Those that don't will learn the hard way that documentation doesn't stop ransomware.
Need clarity on where your practice stands? B&R Computers offers HIPAA Security Gap Analyses and System Hardening Audits designed specifically for healthcare organizations navigating these changes. If you're unsure whether your current security controls meet the updated requirements, a conversation costs nothing: and could prevent a very expensive lesson.
