HIPAA 2026 Identity Controls: What the Proposed Rule Makes Mandatory and How to Get Ready

Status note (June 2026): The HIPAA Security Rule overhaul described in this post is still a proposed rule - OCR has not issued a final rule, and the finalization timeline remains unconfirmed. The NPRM was published January 6, 2025; the comment period closed March 7, 2025. ^[1] confirms that the spring 2026 finalization window has passed with nothing published. When a final rule does issue, expect a compliance window of roughly 180-240 days. Prepare now; implement precisely when the final text is in hand.

---

Healthcare has a dirty secret that every compliance leader already knows: the identity perimeter is held together with spreadsheets, manual tickets, and good intentions. The proposed HIPAA Security Rule overhaul is about to make that untenable. For the first time in over a decade, OCR is proposing to eliminate the "required vs. addressable" distinction that let organizations document their way around controls like MFA. If the rule finalizes close to its proposed form, there is no more opting out - and the hardest part won't be the technology. It will be the people.

What the Proposed Rule Actually Changes

HHS published the Notice of Proposed Rulemaking (NPRM) on January 6, 2025, representing the most significant proposed update to the HIPAA Security Rule since the original rule was enacted. The structural shift is straightforward but sweeping: ^[2] describes how the proposed revisions eliminate the "required vs. addressable" distinction, making MFA, encryption, and other safeguards required controls rather than optional, "addressable" options.

What that means in practice: organizations can no longer document an alternative approach and call it done. ^[3] puts it plainly - organizations can no longer document their way out of implementing a control; if the rule says implement it, you implement it.

The Six Controls That Matter Most for Identity

The proposed rule introduces a cluster of identity-specific mandates that compliance teams need to understand at the operational level:

1. Mandatory MFA - everywhere ePHI is touched

^[4] summarizes the three categories of access that would require MFA enforcement: privileged and administrative access (cloud consoles, EHR/EMR systems, databases); workforce access (internal tools, email, web applications); and third-party and vendor access (VPNs, patient portals, remote support tools). The proposed rule would eliminate the option to forgo MFA based on risk assessment justifications.

One important nuance: ^[5] notes that SMS-based 2FA is not acceptable under the proposed rule guidance - HHS references NIST SP 800-63B Authenticator Assurance Level 2 or higher, which excludes SMS. If your current MFA rollout relies on text messages, that's a gap to close now.

2. Technology asset and identity inventory

^[6] describes the proposed requirement: every organization must maintain an updated inventory of all technology assets that process, store, or transmit ePHI, including a network map that tracks ePHI's movement between internal systems and external partners. You cannot enforce MFA on systems you haven't catalogued, and you cannot run access reviews on users whose app access you can't see.

3. Periodic access reviews and workforce access termination

^[7] highlights one of the most operationally demanding provisions: the proposed rule includes a one-hour workforce access termination requirement. That's not a typo. One hour from termination to full deprovisioning across every ePHI-touching system - EHR, VPN, cloud portals, SaaS apps, the lot.

4. Annual compliance audits

^[2] notes that covered entities and business associates must perform and document comprehensive compliance audits at least annually, formally testing and verifying administrative, physical, and technical safeguards every 12 months.

5. Business associate parity

^[1] is direct: the updated rule's mandatory provisions apply to business associates just as they do to covered entities. If you're a BA, your compliance posture becomes a competitive differentiator - covered entities will increasingly expect you to demonstrate it.

6. Compliance timeline

^[7] explains the mechanics: once the final rule publishes, it becomes effective 60 days later, and compliance is required 180 days after that - 240 days total. ^[8] first-year compliance costs of roughly $9 billion across covered entities and business associates. That number is why organizations that start now will spend far less than those that scramble after publication.

Why Healthcare Turnover Makes This the Hardest Problem in the Room

Here's where the compliance conversation gets real. Every identity control in the proposed rule - MFA enrollment, access reviews, deprovisioning - depends on knowing who has access to what, right now. And healthcare makes that extraordinarily difficult.

Hospital turnover rates decreased to 18.3% in 2024, but the home-care sector sees turnover rates of approximately 79.2% annually. (^[9]) Even at the hospital level, that 18.3% means roughly one in five employees cycles out every year. Nurses, medical assistants, contractors, locum physicians, traveling staff - the workforce is in constant motion.

The access risk that creates is compounding. A nurse who leaves in January may still have active credentials to the EHR in March. A contractor whose engagement ended may still have VPN access. ^[10] recommends regularly reconciling HR records with active accounts in critical systems to identify orphaned accounts - but in a manual world, that reconciliation happens quarterly at best, and only covers the systems someone thought to check.

The proposed one-hour termination requirement doesn't just raise the bar - it exposes the gap. Most healthcare organizations today cannot deprovision a departing employee from all ePHI-touching systems in one hour. They don't have a complete list of those systems, and the deprovisioning process involves manual tickets across IT, HR, and department heads.

The Contractor and Clinician Coverage Problem

Contractors and traveling clinicians compound the problem further. They often access EHRs and clinical apps through non-standard paths - direct logins, shared credentials, or access granted outside the normal provisioning workflow. ^[11] notes that the joiner-mover-leaver lifecycle requires automating provisioning, role changes, and rapid deprovisioning - but that lifecycle only works if every app is in scope, including the ones without SCIM connectors or API integrations.

This is precisely where SSO-only and SCIM-only identity tools leave a dangerous gap. If your governance platform only covers the apps that support SCIM, you have a blind spot for every clinical tool, legacy system, and long-tail SaaS app that doesn't. An auditor asking for a complete access certification across all ePHI-touching systems will find that blind spot immediately.

A Practical Identity Readiness Plan

The proposed rule's compliance window - roughly 180 days after finalization - sounds like a lot of time. It isn't, for a multi-site health system or a business associate with a complex app stack. Here's how to sequence the work.

Where Iden Fits

The hardest part of HIPAA identity readiness isn't MFA on your EHR - your EHR vendor probably handles that. The hard part is everything else: the 40+ SaaS apps your clinical and administrative staff use daily, the contractor accounts provisioned outside the normal workflow, the legacy tools that don't support SCIM and therefore fall outside most governance platforms entirely.

Iden's universal connector technology covers apps whether they support SCIM, APIs, or neither - meaning your access inventory and certification campaigns extend to your entire stack, not just the well-behaved apps. Automated offboarding triggers from your HRIS fire across all connected systems simultaneously, making the one-hour termination requirement achievable rather than aspirational. And every provisioning decision, access review, and deprovisioning event is captured in an immutable audit log - the exact artifact an OCR investigator or external auditor will ask for.

For healthcare organizations navigating the intersection of high turnover and mandatory access controls, that coverage gap is the difference between a defensible compliance posture and a finding.

HIPAA 2026 Identity Readiness Checklist

Use this checklist to assess your current posture against the proposed rule's identity controls. It's also the artifact list an auditor will work through.

The Bottom Line

The proposed HIPAA Security Rule overhaul is the most consequential identity compliance event in healthcare in two decades. The "addressable" era is ending. When the final rule publishes - and the 180-day clock starts - organizations that have already built continuous access governance, automated offboarding, and a complete identity inventory will spend that window validating. Everyone else will be building from scratch under deadline pressure.

The identity controls the proposed rule mandates aren't novel security ideas. They're what a well-run identity program already does. The question is whether your current tooling covers your entire app stack - or just the easy half of it.

For more context on the regulatory backdrop, see our posts on The Biggest HIPAA Security Rule Shake-Up in Years and Navigating HIPAA & GDPR.