What are the HIPAA compliance deadlines?

Jun 25, 2024: Reproductive health care privacy rule effective (later vacated). Dec 23, 2024: Reproductive health privacy compliance date (vacated). Mar 7, 2025: Security Rule NPRM comment period closed. Feb 16, 2026: Notice of Privacy Practices updates (Part 2 alignment).

When does HIPAA take effect?

HIPAA took effect on Apr 14, 2003.

Who does HIPAA apply to?

Covered entities (health plans, health care clearinghouses, and health care providers that conduct standard electronic transactions) and their business associates, including cloud and data vendors that create, receive, maintain or transmit PHI. No size threshold.

What are the penalties under HIPAA?

Civil money penalties, 2026 inflation-adjusted (91 FR 3665): tiered from $145 to $73,011 per violation, with a calendar-year cap of $2,190,294 per identical provision. Criminal penalties under 42 U.S.C. 1320d-6 up to $250,000 and 10 years' imprisonment for offenses with intent to sell or use PHI for commercial advantage or malicious harm.

HIPAA

Amended United States (Federal) · In force Apr 14, 2003 · no upcoming deadlines

Official text

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Deadlines

ComplianceFeb 16 · 8 months ago · Source

Notice of Privacy Practices updates (Part 2 alignment)Covered entities must update Notices of Privacy Practices under 45 CFR 164.520 for the 2024 Part 2 (substance use disorder records) changes; this NPP piece survived the Purl vacatur.

Transition endsMar 7, 2025 · 20 months ago · Source

Security Rule NPRM comment period closedComments closed on the proposed HIPAA Security Rule update (90 FR 898); OCR has not issued a final rule.

ComplianceDec 23, 2024 · 22 months ago · Source

Reproductive health privacy compliance date (vacated)Original compliance date for the reproductive health care privacy provisions, including the attestation requirement; these provisions no longer apply after the June 2025 vacatur.

Takes effectJun 25, 2024 · 2.3 years ago · Source

Reproductive health care privacy rule effective (later vacated)The HIPAA Privacy Rule to Support Reproductive Health Care Privacy (89 FR 32976) took effect; it was vacated nationwide on June 18, 2025 in Purl v. HHS (N.D. Tex.).

Summaries for reference, not legal advice. Check the official text.

What it does

Sets national standards for the use and disclosure of protected health information (Privacy Rule), administrative, physical and technical safeguards for electronic PHI (Security Rule), and notification of breaches of unsecured PHI. A proposed overhaul of the Security Rule (Jan. 2025 NPRM) would make most 'addressable' specifications mandatory, require asset inventories, MFA, encryption, annual compliance audits and 72-hour restoration planning, but it is not final. The 2024 reproductive health care privacy amendments were vacated nationwide in June 2025.

Who it applies to: Covered entities (health plans, health care clearinghouses, and health care providers that conduct standard electronic transactions) and their business associates, including cloud and data vendors that create, receive, maintain or transmit PHI. No size threshold.
Penalties: Civil money penalties, 2026 inflation-adjusted (91 FR 3665): tiered from $145 to $73,011 per violation, with a calendar-year cap of $2,190,294 per identical provision. Criminal penalties under 42 U.S.C. 1320d-6 up to $250,000 and 10 years' imprisonment for offenses with intent to sell or use PHI for commercial advantage or malicious harm.
Enforced by: HHS Office for Civil Rights (OCR); State Attorneys General (HITECH); DOJ for criminal violations
Official name: HIPAA Privacy, Security and Breach Notification Rules (45 CFR Parts 160 and 164)
Citation: Pub. L. 104-191; 42 U.S.C. 1320d et seq.; 45 CFR Parts 160 and 164
Topics: Privacy, Health data, Cybersecurity, Breach notification

Verified 2026-09-22 federalregister.gov federalregister.gov federalregister.gov reginfo.gov hklaw.com americanbar.org

Research notes

Security Rule NPRM (90 FR 898, Jan. 6, 2025; RIN 0945-AA22): the Unified Agenda lists final action for 07/2027 (month only, so no deadline row). The NPRM proposed a compliance date 180 days after a final rule's effective date. Reproductive health rule vacated June 18, 2025 (Purl v. HHS, N.D. Tex.), except NPP amendments tied to Part 2; the Fifth Circuit dismissed the appeal in September 2025 (per ABA/law firm reporting). Original Privacy Rule compliance date April 14, 2003 (small health plans April 14, 2004); Security Rule compliance April 20, 2005. HHS also exercises 2019 enforcement discretion capping annual penalties per tier below the statutory cap.

In forceUnited States

AI state-law preemption EODirects federal agencies to push back on state AI laws seen as onerous. It orders a DOJ AI Litigation Task Force, a Commerce list of conflicting state laws, BEAD and grant funding conditions, an FCC disclosure-standard proceeding and an FTC policy statement on AI outputs. It does not itself preempt any state law; that needs Congress or court rulings.In effect since Dec 11, 2025

EnactedUnited States

CFPB Open Banking Rule (Section 1033)Requires banks, card issuers and other data providers to give consumers and authorized third parties their transaction and account data through a secure developer interface, free of charge. Third parties must limit collection, use and retention to what the consumer requested. The CFPB is reconsidering the rule and a federal court has barred its enforcement until that reconsideration ends.Next: Apr 1, 2027 Tier 2 compliance date (original) · in 5 months

EnactedUnited States (Federal)

CIRCIADirects CISA to require covered critical infrastructure entities to report covered cyber incidents within 72 hours of reasonably believing one occurred and ransom payments within 24 hours of payment, and to preserve related data. Reporting obligations begin only once CISA's final rule takes effect.No date set

In forceUnited States (Federal)

CMMC 2.0Requires defense contractors and subcontractors that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) to meet a specified CMMC level (Level 1 self-assessment, Level 2 self- or third-party (C3PAO) assessment against NIST SP 800-171, Level 3 DIBCAC assessment against selected NIST SP 800-172 controls) as a condition of contract award. Requirements are phased into DoD solicitations over four years.Next: Nov 10 Phase 2: Level 2 C3PAO certification · in 14 days

AmendedUnited States (Federal)

COPPA RuleRequires operators of child-directed online services, or those with actual knowledge they collect personal information from children under 13, to give notice and obtain verifiable parental consent before collecting, using or disclosing that data. The 2025 amendments add separate parental consent for disclosures to third parties (including for targeted advertising), require a written data retention policy and a written information security program, expand 'personal information' to include biometric identifiers and government-issued identifiers, and tighten Safe Harbor program oversight.In effect since Apr 21, 2000

In forceUnited States (Federal)

DOJ Bulk Data RuleProhibits U.S. persons from data brokerage and genomic-data transactions with countries of concern or covered persons, and restricts vendor, employment and investment agreements involving bulk U.S. sensitive personal data or government-related data unless CISA security requirements are met. Restricted transactions require a data compliance program, due diligence, audits, recordkeeping and reporting.In effect since Apr 8, 2025

AmendedUnited States (Federal)

FCC CPNI Breach RuleThe 2023 order expands carrier breach rules from CPNI to all customer personally identifiable information, covers inadvertent disclosures, requires notice to the FCC (in addition to the Secret Service and FBI) within seven business days, and adopts a harm-based trigger for customer notice. Until the revised 64.2011 takes effect, the existing CPNI breach rule (law enforcement notice within 7 business days, customer notice after a waiting period) continues to apply.In effect since Mar 13, 2024

AmendedUnited States (Federal)

FTC Health Breach Notification RuleRequires vendors of personal health records (including health and wellness apps) and PHR related entities not covered by HIPAA to notify affected individuals, the FTC and, for 500+ residents of a state, prominent media, after a breach of unsecured PHR identifiable health information. The 2024 amendments confirm that unauthorized disclosures (not just hacks) are breaches, clarify coverage of health apps drawing data from multiple sources, allow email notice, and expand notice content.In effect since Sep 24, 2009

Questions about HIPAA

What are the HIPAA compliance deadlines?: Jun 25, 2024: Reproductive health care privacy rule effective (later vacated). Dec 23, 2024: Reproductive health privacy compliance date (vacated). Mar 7, 2025: Security Rule NPRM comment period closed. Feb 16, 2026: Notice of Privacy Practices updates (Part 2 alignment).
When does HIPAA take effect?: HIPAA took effect on Apr 14, 2003.
Who does HIPAA apply to?: Covered entities (health plans, health care clearinghouses, and health care providers that conduct standard electronic transactions) and their business associates, including cloud and data vendors that create, receive, maintain or transmit PHI. No size threshold.
What are the penalties under HIPAA?: Civil money penalties, 2026 inflation-adjusted (91 FR 3665): tiered from $145 to $73,011 per violation, with a calendar-year cap of $2,190,294 per identical provision. Criminal penalties under 42 U.S.C. 1320d-6 up to $250,000 and 10 years' imprisonment for offenses with intent to sell or use PHI for commercial advantage or malicious harm.

Deadlines

What it does

Related