HIPAA Access Control in 2026: What's Required Now, What's Proposed, and What It Takes

What the rule in force actually says

HIPAA’s Security Rule does not say “implement identity and access management.” Section 164.312(a)(1) says to allow access only to those persons or software programs that have been granted access rights. One sentence. The evidence an investigator expects is considerably more than one sentence.

Note the phrase or software programs. Service accounts, integration credentials and API keys are inside the standard, not adjacent to it. A nightly job with read access to the record system is subject to the same requirement as a nurse, including unique identification. This is the clause most often overlooked, and it is the reason shared service accounts are hard to defend.

Under the rule as it stands today, access controls split into two categories. Required specifications you must implement. Addressable ones you must implement, or document why they are not reasonable and appropriate and what you did instead.

Addressable has never meant optional — that misreading is the single most common finding. The documentation burden for declining an addressable specification is higher than the burden of implementing it in most environments, which is why “we assessed it as addressable” without a written alternative fails reliably.

Under Section 164.312(a), unique user identification and emergency access are required. Automatic logoff and encryption are addressable.

The timeline, and why it matters for budgeting

The proposed rule slipping to July 2027 is not a reason to relax, but it is a reason to stop budgeting against a 2026 date.

If July 2027 holds exactly, a final rule would then start its own compliance window — commonly cited at 180 to 240 days. That puts realistic full compliance in 2028, not 2026. Any vendor quoting you an urgent 2026 deadline for the proposed requirements is either working from stale information or using it as a close.

The practical consequence: treat the proposed items as a planning horizon, not a procurement trigger. Build the things that are required today and happen to also satisfy the proposal — the asset inventory is the clearest example — and defer anything whose only justification is a rule that may still change.

Today versus what is proposed

The four artifacts that get sampled

Investigations do not begin with your policy binder. They begin with a sample and a request to trace it. Each artifact below answers a specific question an investigator will ask, and each one is produced from systems you already run.

1. Termination evidence

Section 164.308(a)(3)(ii)(C) covers termination procedures. It is addressable, which means you implement it or document an equivalent alternative, not that you can skip it. Investigators pick separated staff and trace HR separation date, to identity deactivation timestamp, to access removal in each downstream system.

Gaps measured in weeks fail. Gaps measured in hours pass. The uncomfortable part is that the trace has to hold for every system, not the directory alone — the record system, the imaging system, the VPN, the building access platform if it shares an identity. An account disabled in Entra ID while a local application account stays live is a gap, and it is the most common shape of this finding.

This one artifact justifies automating joiner-mover-leaver more than any security argument will, because the alternative is reconstructing the trace by hand under time pressure, repeatedly.

2. Access authorization mapped to reality

Not the template — the document describing how clinical roles translate to permissions in the record system, who approves exceptions, and where that mapping lives.

If it references a role model nobody maintains, that is the finding. The test an investigator applies is simple: pick a named clinician, read their actual permissions, and ask which line of the mapping produced them. A mapping that cannot answer that has documented an intention rather than a control.

3. Periodic access review records

Who reviewed, what they saw, what changed as a result.

A review that removed nothing, every quarter, reads as a rubber stamp — and it usually is one, because reviewers approving a list of 400 entitlements in a single sitting are not reading them. The reviewable artifact is not the sign-off; it is the delta. Reviews that produce no revocations over a year invite the question of whether anyone ever leaves a role.

4. Emergency access, tested

Required, not addressable. Clinicians must reach records in a crisis, so the control cannot be prevention.

The control is that emergency access expires on its own, raises an alert, and is logged — and that you have tested it, with dates. Break-glass access that technically exists but has never been exercised fails on the evidence rather than the design, because nobody can show it works. Keep the test dates; the dates are the artifact.

What it actually takes

For a hospital with four people running everything, the honest sequence looks like this. Effort assumes an existing Entra ID or Okta tenant.

1. 1

   Put multi-factor authentication in front of remote access

   1–2 weeks

   One conditional access policy covering every externally reachable system, then switch off the older authentication protocols that bypass it. This is the single change that answers the question a board asks after a neighbouring hospital is hit.

2. 2

   Wire separation into identity deactivation

   2–4 weeks

   Connect the HR record to the identity platform so a termination date disables the account rather than raising a ticket. Until this exists, termination evidence has to be assembled by hand every time.

3. 3

   Scope vendor accounts to their agreements

   2–3 weeks

   List every third-party account with access to the record system, check each against what its business associate agreement actually covers, cut it back, and set an expiry date. Most organizations find accounts belonging to vendors they no longer use.

4. 4

   Rebuild emergency access so it proves itself

   1 week

   Auto-expiring, alerting, logged, and tested with clinical staff before it counts. Then keep the test dates — the dates are the evidence.

5. 5

   Give every service account a named owner

   1–2 weeks

   Section 164.312(a)(1) covers software programs, not just people. Start with the accounts that can read the record system. An unowned credential with access to patient data is the hardest finding to explain after the fact.

6. 6

   Write the asset inventory down

   3–5 days

   Not required in a prescribed form today, and squarely in the proposal. Doing it now costs a few days and removes a scramble later.

Total, realistically: six to ten weeks of focused effort, spread across a team that also has a phone system to run. That is why it slips, and it is why sequencing matters more than completeness — step one closes the exposure the others are protecting.

What to do with the proposed requirements now

Two of the proposed items are worth doing early, because they are cheap and they pay off under the current rule anyway.

The asset inventory is the clearest. You need one to run a defensible risk analysis today, which is already required. Writing it down in a maintained form costs a few days and converts directly into a proposed-rule artifact if the rule lands.

Removing the addressable crutch on encryption is the second. If you have documented a reasoned alternative to encrypting ePHI at rest, that document is doing real work right now — but it is also an annual maintenance burden and a standing explanation. Where encryption is technically straightforward, implementing it retires both the risk and the paperwork.

Everything else in the proposal — the fixed testing cadences in particular — can wait for a final rule. Buying a penetration testing retainer today against a requirement that may change is spending budget on a forecast.

Where vaultIAM fits

We run a read-only assessment against your existing systems, using a query list published before you grant any access, and score identity risk across ten categories weighted for healthcare. You get the gaps ranked by risk reduction per hour of work, mapped to the Security Rule sections above.

If you want the work done, we take one item at a time — six to eight weeks each, fixed scope — and hand it back with the runbook. The four-person team runs it afterwards; that is the point.