HIPAA Compliance Consulting: Steps for Healthcare and IT Leaders
Executive Overview
HIPAA compliance has always been a critical responsibility for healthcare organizations, but the expectations around how organizations protect patient data are changing. The proposed HIPAA Security Rule updates anticipated for 2026 signal a shift toward more prescriptive, testable, and continuously monitored cybersecurity practices.
These changes impact more than compliance teams alone. Executive leadership, IT decision-makers, security professionals, and operational leaders all play a role in safeguarding protected health information (PHI). This playbook is designed to help covered entities of all sizes understand what is changing, why it matters, and how to take practical steps now to strengthen their HIPAA compliance posture.
Rather than focusing solely on regulatory requirements, this guide emphasizes building sustainable, real-world security practices that support compliance, operational resilience, and patient trust.
Note: The 2026 HIPAA Security Rule has not yet been finalized. All guidance in this playbook is focused on preparation and proactive measures based on proposed updates and emerging enforcement trends.
Step 1: Understand What Is Changing in the HIPAA Security Rule
While the final rule has not yet been published, recent enforcement trends, OCR guidance, and public commentary indicate a move toward clearer expectations and stronger validation of security controls.
Healthcare organizations should anticipate increased emphasis on:
Documented and defensible security governance
More frequent and formal testing of controls
Stronger access controls, including multi-factor authentication
Independent validation of risk assessments
Demonstrated evidence of ongoing oversight, not point-in-time compliance
The intent behind these updates is clear. Regulators want organizations to move beyond self-attestation and show that security controls are operating effectively in practice.
Step 2: Establish Strong Security Governance and Accountability
Effective HIPAA compliance starts with governance. Without clear ownership and accountability, even well-designed controls can fail.
Key governance practices include:
Clearly defining roles and responsibilities for HIPAA security oversight
Assigning ownership for key risk areas such as access management, third-party vendors, and cloud systems
Establishing regular review cycles for risk, incidents, and remediation efforts
Ensuring leadership visibility into security risks and decisions
Governance documentation should reflect how decisions are actually made, not just how they are described in policy. Regulators increasingly expect evidence that security oversight is active, consistent, and supported at the leadership level.
Step 3: Perform a Comprehensive HIPAA Security Risk Assessment
A HIPAA security risk assessment is the foundation of any compliant program. However, many organizations rely on outdated, infrequent, or overly technical assessments that fail to capture real-world risk.
An effective assessment should:
Evaluate administrative, technical, and physical safeguards
Include systems, applications, and workflows that handle PHI
Assess third-party and vendor risks
Identify gaps based on likelihood and impact, not just checklist completion
Produce actionable, prioritized remediation steps
Independent assessments can provide objectivity and help validate whether existing controls are working as intended.
Step 4: Strengthen Technical Safeguards and Security Testing
The proposed 2026 updates are expected to reinforce the importance of tested and measurable security controls.
Healthcare organizations should focus on:
Implementing multi-factor authentication for systems accessing PHI
Conducting regular vulnerability scans to identify weaknesses
Performing penetration testing to validate security effectiveness
Ensuring secure configuration of servers, endpoints, and cloud platforms
Monitoring logs and alerts to detect suspicious activity
Testing should be treated as an ongoing practice, not a one-time compliance exercise. Results should feed directly into remediation and governance discussions.
Step 5: Address the Human Element Through Training and Awareness
Technology alone cannot protect PHI. Employees remain one of the most significant risk factors and one of the strongest defenses when properly trained.
Effective HIPAA training programs:
Go beyond annual compliance check-the-box exercises
Use real-world scenarios relevant to employee roles
Reinforce expectations around reporting incidents or concerns
Emphasize accountability and shared responsibility for protecting PHI
Organizations that create an environment where employees feel comfortable raising concerns are better positioned to identify and address issues before they escalate.
Step 6: Measure and Monitor Compliance
Ongoing measurement is critical to sustaining HIPAA compliance, particularly as regulatory expectations, technologies, and threat landscapes evolve.
Key activities include:
Regular internal audits and control testing aligned to the anticipated updates in the HIPAA Security Rule
Continuous monitoring of access logs, system activity, and security events
Periodic updates to policies and procedures as risks and technologies change
Independent validation of safeguards following significant system or vendor changes
Organizations that treat compliance as a continuous process rather than a point-in-time exercise are better positioned to withstand audits, investigations, and security incidents.
HIPAA Compliance Checklist
Use this checklist to validate that foundational HIPAA requirements are in place and operating effectively. While many organizations believe they are prepared, gaps often emerge during formal assessments or regulatory reviews.
Note: This checklist focuses on foundational HIPAA requirements and preparatory steps for potential updates under the proposed 2026 HIPAA Security Rule. It is not exhaustive and does not replace a formal risk assessment.
Governance & Oversight
Assigned HIPAA Security and Privacy Officers
Documented HIPAA governance structure and escalation process
Current, approved HIPAA policies and procedures
Risk Analysis & Risk Management
Documented enterprise-wide HIPAA risk analysis updated within the last 12 months
Identified risks prioritized with remediation plans
Evidence of management review and approval
Administrative Safeguards
Workforce HIPAA training conducted and documented
Sanction policy enforced for violations
Incident response and breach notification procedures tested
Technical Safeguards
Role-based access controls implemented
Multi-factor authentication for systems containing ePHI
Encryption applied to ePHI at rest and in transit
Audit logs enabled and reviewed
Physical Safeguards
Facility access controls in place
Device and media controls documented
Secure disposal processes for systems containing ePHI
Third-Party & Vendor Management
Business Associate Agreements executed and current
Vendor risk assessments performed for third parties handling ePHI
Ongoing monitoring of third-party compliance
Step 7: Prepare for Regulatory Change
The HIPAA Security Rule continues to evolve, with increased emphasis on accountability, documentation, and demonstrable safeguards. Organizations should proactively assess how potential updates may affect their existing controls, technology, and operating model.
Proactive preparation helps organizations avoid reactive, costly remediation under regulatory pressure as HIPAA compliance is not a one-time effort. Regulators increasingly expect organizations to demonstrate ongoing monitoring, review, and improvement.
Sustainable compliance programs include:
Regular updates to policies and procedures
Ongoing risk tracking and remediation
Periodic reassessments as systems and threats evolve
Leadership oversight and documented follow-up
Continuous compliance reduces surprises during audits and strengthens organizational resilience.
Step 8: Partner With Experienced HIPAA and Cybersecurity Advisors
Navigating evolving HIPAA requirements can be complex, particularly as technical expectations increase. Many organizations benefit from working with experienced advisors who understand both regulatory requirements and real-world cybersecurity challenges.
Clark Schaefer Consulting has helped healthcare organizations of all sizes assess risk, strengthen governance, implement controls, and prepare for proposed regulatory changes. Our approach is practical, collaborative, and tailored to how your organization operates.
Whether you are preparing for the proposed 2026 HIPAA Security Rule or evaluating your current compliance posture, having an experienced partner can help you move forward with confidence.
Schedule a HIPAA security risk assessment
If you are unsure how prepared your organization is for the potential updates to the HIPAA Security Rule changes, now is the time to act.
Schedule a HIPAA security risk assessment or speak with a cybersecurity professional to discuss your options and develop a clear path forward.
Contact Clark Schaefer Consulting to start the conversation.
Expert Contributors
