logo
Contact Us

844-740-7100

    Colington Consulting

    Helping Organizations Achieve HIPAA Compliance™

    Contact Us

    Day: November 9, 2026

    • HIPAA Security Rule Delay: Why You’re Not Off the Hook

      HIPAA Security Rule Delay: Why You’re Not Off the Hook

      Quick answer: HHS has pushed its target for finalizing the HIPAA Security Rule update from May 2026 to July 2027. But the delay only applies to the proposed new requirements— the current HIPAA Security Rule is still fully in effect, still enforced by OCR, and still carries the same penalties for noncompliance. Organizations that treat this as a compliance holiday are misreading what actually changed.

      What Actually Happened

      In January 2025, HHS’s Office for Civil Rights (OCR) published a Notice of Proposed Rulemaking (NPRM) proposing the most significant overhaul of the HIPAA Security Rule since 2013. The proposal would replace many of today’s flexible, “addressable” safeguards with hard requirements, including:

      • Mandatory encryption of ePHI at rest and in transit (no more “addressable” workaround)
      • Mandatory multi-factor authentication on all systems touching ePHI
      • 72-hour incident reporting timelines
      • Annual penetration testing
      • Tighter oversight and contractual obligations for business associates

      More than 100 hospital systems and provider associations — including Cleveland Clinic, Yale New Haven Health, Advocate Health, and the American Medical Association — formally asked HHS to withdraw or scale back the proposal, citing cost and implementation timelines.

      HHS didn’t withdraw it. Instead, the agency moved final action from its near-term regulatory agenda to its Long-Term Actions agenda, now targeting July 2027 for a final rule. That’s a one-year-plus slip from the original May 2026 estimate — and Unified Agenda dates are planning estimates, not binding deadlines, so this could move again.

      What the Delay Does Not Change

      This is the part that gets lost in the headlines:

      1. The current Security Rule is still active and enforceable. Every requirement already on the books — risk analysis, access controls, audit controls, transmission security, business associate agreements — remains fully in force. OCR investigations, audits, and civil monetary penalties for violations of the existing rule continue exactly as before.
      2. OCR enforcement priorities haven’t slowed down.Ransomware, ePHI breaches, and risk-analysis failures remain top enforcement targets, and settlements under the current rule continue to be announced regularly.
      3. State law and contractual obligations don’t pause. Many states have their own health data security and breach-notification laws that meet or exceed HIPAA. Cyber insurance underwriters, hospital system contracts, and business associate agreements increasingly bake in MFA, encryption, and incident-response expectations regardless of what the federal rule says.
      4. The direction of travel hasn’t changed, only the timing. Encryption, MFA, and faster breach reporting aren’t going away as regulatory priorities — they’re simply arriving later. Organizations that wait until the rule is finalized to start will be doing a rushed 240-day sprint (60 days to effective date + 180 days to compliance, under the current proposal) instead of a planned multi-year rollout.

      “We Have More Time” Is the Wrong Read

      The delay gives organizations breathing room to prepare well, not permission to deprioritize security. Three reasons this matters:

      • Rulemaking timelines are not compliance timelines.Nothing in HIPAA law says organizations must wait for a final rule before improving encryption or access controls. Most of what’s proposed is already considered best practice and is often expected by cyber insurers and auditors today.
      • A pushed date is not a canceled rule. HHS has reaffirmed the rulemaking is still active; it’s simply been reclassified as a longer-term project. Treating this like the Security Rule update “went away” sets organizations up for a scramble later.
      • Breaches don’t wait for regulations. Ransomware and phishing attacks against healthcare targets have continued to rise. The safeguards in the proposed rule exist because current threat activity outpaced the 2013-era requirements — that risk doesn’t disappear because the paperwork is delayed.

      What Compliance Teams Should Do With the Extra Time

      Run or refresh your risk analysis now, mapping current safeguards against the proposed rule’s requirements to identify gaps early.

      1. Move encryption and MFA from “addressable” to “implemented,” even ahead of any mandate — these are the two changes most likely to survive the rulemaking process largely intact.
      2. Review business associate agreements and vendor oversight, since expanded BA accountability is one of the more consistent themes across the NPRM comments and industry response.
      3. Stress-test your incident response plan against a 72-hour reporting window, even though the current rule doesn’t require it yet — this is the kind of internal capability that takes real time to build.
      4. Document everything. If the rule is finalized on a compressed timeline later, organizations with a documented head start will have an easier path to demonstrating good-faith compliance.

      Frequently Asked Questions

      Is the HIPAA Security Rule update dead?
      No. HHS moved the target for final action to July 2027 on its Long-Term Actions agenda; it did not withdraw the proposal.

      Do I still have to comply with HIPAA Security Rule requirements right now?
      Yes. The current HIPAA Security Rule remains fully in effect and enforceable regardless of the delay to the proposed update.

      When will the new HIPAA Security Rule requirements take effect?
      HHS currently targets July 2027 for final action, but this is an estimate, not a legal deadline, and could shift again. If finalized as proposed, the rule would take effect 60 days after publication, with a 180-day compliance window after that.

      What should healthcare organizations do now?
      Use the additional time to close gaps against the proposed requirements — especially encryption, MFA, business associate oversight, and incident response — rather than waiting for a final rule to start preparing.

      Not Sure Where Your Gaps Are? Find Out Before the Rule Forces You To

      The safest move during this delay isn’t waiting — it’s finding out now where your organization stands against encryption, MFA, business associate oversight, and incident response expectations, so you’re not scrambling later.

      Get a free HIPAA Risk Review. We’ll help you identify gaps in your current Security Rule compliance and show you exactly where to focus before the final rule lands.

      Schedule Your Free HIPAA Risk Review →

      Source

      U.S. Office of Information and Regulatory Affairs, Unified Agenda of Federal Regulatory and Deregulatory Actions — RIN 0945-AA22 (HIPAA Security Rule), reginfo.gov.

    • Does Billing Medicaid Make Schools HIPAA Covered?

      Does Billing Medicaid Make Schools HIPAA Covered?

      Schools Are Billing Medicaid for Behavioral Health Services — Does That Make Your District a HIPAA Covered Entity?

      Quick answer: In most cases, yes — technically. The moment your district (or a provider it employs) electronically bills Medicaid for a student’s mental health or behavioral health services, federal rules treat you as a HIPAA “covered entity” for that transaction. In practice, though, HIPAA’s Privacy Rule almost never governs the actual student records — FERPA does, because the information lives in an “education record.” The real compliance risk isn’t a phantom HIPAA violation; it’s assuming neither law applies and skipping the safeguards both actually require.

      Why Districts Are Asking This Question Right Now

      School-based Medicaid billing for mental and behavioral health services has expanded quickly, and much of that growth is happening outside the traditional special-education framework:

      • A growing number of states — including Arkansas, Missouri, Minnesota, Tennessee, and South Carolina — now allow districts to bill Medicaid for behavioral health services without even filing a State Plan Amendment.

      • Schools nationally receive an estimated $4–6 billion a year in Medicaid reimbursement for school-based services, and only a fraction of states have expanded reimbursement beyond students served under IDEA.

      • Students are roughly six times more likely to access mental health care when it’s offered at school, which is pushing more districts to add counselors, therapists, and telehealth partnerships — and to bill Medicaid for them.

      As behavioral health billing becomes a bigger part of how districts fund student services, the HIPAA question follows naturally: if we’re submitting health care claims, are we now a HIPAA-regulated organization?

      The Technical Answer: Electronic Medicaid Billing Makes You a Covered Entity

      HHS guidance is direct on this point: a school that employs a health care provider — a school psychologist, counselor, therapist, or nurse — who electronically submits a Medicaid claim for a covered transaction becomes a HIPAA “covered entity” for that transaction. This is true whether the district thinks of itself as a health care organization or not.

      It doesn’t matter who does the billing. A school nurse submitting a claim, a contracted mental health provider billing on the district’s behalf, or a telehealth vendor billing under the district’s Medicaid provider number can all trigger covered-entity status for the underlying transaction.

      But FERPA — Not the HIPAA Privacy Rule — Usually Still Governs the Records

      HIPAA’s own regulations carve out an exception: information maintained in “education records” as defined under FERPA is excluded from HIPAA’s definition of protected health information (45 CFR § 160.103).

      Because nearly every health-related record a K-12 school keeps on a student — nurse visit logs, counseling session notes, therapy records tied to an IEP or 504 plan — meets FERPA’s definition of an education record, HIPAA’s privacy protections generally don’t apply to it. FERPA’s do instead.

      The result is a scenario that confuses a lot of administrators: your district can be a HIPAA covered entity that, for privacy purposes, has no protected health information at all — because everything it holds is a FERPA education record instead.

      Where HIPAA Doesn’t Go Away Entirely

      Covered-entity status isn’t purely academic. Even when the Privacy Rule steps aside, a few things still apply:

      • Your district must still comply with HIPAA’s Transaction, Code Set, and Identifier Rules for the Medicaid billing itself — whoever submits the claim, and whatever software or clearinghouse touches it, has to meet those technical standards.

      • If a contracted provider bills independently under its own name — for example, an outside behavioral health agency or telehealth vendor that isn’t itself subject to FERPA — that provider may be a full HIPAA covered entity for the records it creates, privacy rule included.

      • Private and religious schools generally don’t receive federal education funding and typically aren’t subject to FERPA at all — which means a private school billing Medicaid electronically may be a HIPAA covered entity with no FERPA exclusion to fall back on.

      Why the Distinction Actually Matters for Your Compliance Program

      This isn’t just a legal technicality. It changes what your district is required to do in several concrete ways:

      1. Consent requirements differ. FERPA requires written parental (or eligible student) consent before disclosing information for Medicaid billing purposes — a separate requirement from HIPAA authorization, and the one that usually governs here.

      2. Breach response follows different rules. Education records generally trigger FERPA and state student-data-privacy breach obligations, not the HIPAA Breach Notification Rule — unless an independent, non-FERPA-covered provider’s records are involved.

      3. Vendor paperwork needs to match reality. Internal school-based providers typically need FERPA-compliant data-sharing or “school official” agreements. Outside billing vendors, clearinghouses, or telehealth partners that are themselves HIPAA covered entities need Business Associate Agreements.

      4. Security expectations are converging either way. FERPA doesn’t include HIPAA’s detailed Security Rule requirements, but cyber insurers, state privacy laws, and CMS program-integrity reviews increasingly expect HIPAA-grade safeguards around any system that touches Medicaid claims data — regardless of which privacy law technically applies to the record.

      A Compliance Checklist for Districts Billing Medicaid for Behavioral Health

      • Map every point where a district employee or contracted provider submits an electronic Medicaid claim for mental or behavioral health services.

      • For each record type, confirm the governing framework: education record → FERPA governs privacy; independent outside provider not subject to FERPA → HIPAA Privacy Rule likely governs.

      • Update consent forms so FERPA consent language explicitly covers disclosure of information for Medicaid billing purposes.

      • Audit vendor contracts: FERPA-compliant data-sharing agreements for internal providers, Business Associate Agreements for any outside billing vendor, clearinghouse, or telehealth partner that qualifies as a HIPAA covered entity.

      • Apply HIPAA-grade technical safeguards — encryption, access controls, audit logging — to whatever system actually submits the Medicaid claims, even if the broader student record system is FERPA-governed.

      • Train school health staff, counselors, and administrators on which framework governs which piece of information. This is where most real-world confusion, and risk, actually lives.

      Frequently Asked Questions

      Does billing Medicaid for a student’s counseling or therapy services make our school district a HIPAA covered entity?
      Generally, yes. If the district or a health care provider it employs submits an electronic Medicaid claim for a covered transaction, HHS treats the district as a HIPAA covered entity for that transaction — even if the district doesn’t think of itself as a health care organization.

      Does that mean the HIPAA Privacy Rule applies to our students’ behavioral health records?
      Usually not. If those records qualify as “education records” under FERPA — which most school-maintained counseling and mental health records do — HIPAA’s Privacy Rule explicitly excludes them, and FERPA governs privacy instead.

      Do we still need to worry about HIPAA at all?
      Yes. Your district still has to comply with HIPAA’s Transaction, Code Set, and Identifier Rules for the Medicaid billing itself. And if you contract with an outside provider that isn’t subject to FERPA, that provider’s records may be governed by the full HIPAA Privacy Rule.

      What’s the difference between FERPA consent and HIPAA authorization for Medicaid billing?
      FERPA requires written parental or eligible-student consent before disclosing information for Medicaid billing purposes. HIPAA authorization is a separate, more detailed requirement that generally doesn’t apply when the record is a FERPA education record — but it can apply to an independent HIPAA-covered provider working with your district.

      What should our district do first?
      Start by mapping every point where student behavioral health information is electronically billed to Medicaid, then confirm which framework — FERPA or HIPAA — governs each record and each vendor relationship involved.

      Not Sure Which Rules Apply to Your District’s Medicaid Billing? Find Out Before It Becomes a Problem

      FERPA and HIPAA overlap in ways that trip up even well-run compliance programs — especially as more districts add behavioral health billing to their Medicaid programs. The safest move is finding out now exactly which framework governs each piece of your student health data and each vendor relationship, not after an incident forces the question.

      Get a free HIPAA Risk Review. We’ll help you map where FERPA and HIPAA intersect in your district’s Medicaid billing and show you exactly where your compliance gaps are.

      Schedule Your Free HIPAA Risk Review

      Sources

      U.S. Department of Health and Human Services & U.S. Department of Education, Joint Guidance on the Application of FERPA and HIPAA to Student Health Records (December 2019 update).

      45 CFR § 160.103 — HIPAA definitions; exclusion of FERPA “education records” from “protected health information.”

      MACPAC, School-Based Services for Students Enrolled in Medicaid (March 2024), macpac.gov.

      Healthy Schools Campaign, Medicaid Funding for School-Based Services.

    Helping healthcare organizations navigate HIPAA requirements, reduce compliance risks, and protect sensitive health information.

    Quick Links

    Our Services

    Specialty Services

    Need Help?

    Facebook X-twitter Linkedin Youtube

    © 2026 Colington Consulting. All rights reserved.