Under the Office of Management and Budget, Office of Information and Regulatory Affairs’ recently published 2026 Regulatory Plan and the Unified Agenda of Federal Regulatory and Deregulatory Actions, the Department of Health and Human Services’ (HHS) Final Rule on HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information has been moved to the agency’s long-term actions.

The regulatory plan and unified agenda include regulatory priorities and planned regulatory actions over the next 12 months for approximately 60 agencies. However, a separate section lists agency long-term actions, for which an agency does not expect to have a regulatory action within the next 12 months. Included among the long-term actions is HHS’ Final Rule on HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information, which has a final action date of July 2027. While these dates are typically aspirational, the placement of the rule under long-term actions indicates that HHS will not be taking any action on the rule in the coming year.

LeadingAge had significant concerns with HHS’ Notice of Proposed Rulemaking and in March 2025 comments highlighted the heavy administrative and financial strain that the proposed compliance requirements would place on aging services providers in part because aging services providers did not receive federal Health Information Technology for Economic and Clinical Health (HITECH) incentives for the adoption of health information technology. Additionally, the rule would apply the standards and specifications equally to all HIPAA covered entities, from small providers to the largest of health systems, despite the fact that there is great variability among regulated entities when it comes to their risk for industry disruption and capacity to meet the proposed standards. LeadingAge signed on the Long Term & Post-Acute Care (LTPAC) Health IT Collaborative’s comments on the rule as well.

While this is welcome news, we will continue to monitor any new developments as HHS works to finalize the rule.