The U.S. Department of Health and Human Services' Office for Civil Rights (OCR) reportedly has updated its regulatory agenda. According to the timeframe on the reginfo.gov site, OCR expects to issue a final HIPAA Security Rule in July 2027.

This delay provides welcome relief to HIPAA covered entities and business associates who are struggling to anticipate and come into regulatory compliance with the proposed Security Rule.