Is Your Arkansas Healthcare Practice Ready for the Next HIPAA Security Changes?

In Brief

• The January 2025 proposal to overhaul the HIPAA Security Rule is still a proposal. Federal regulatory planners now list July 2027 as the target for final action, and that date is not binding.
• The rule already in force is not lenient. OCR's Risk Analysis Initiative keeps producing settlements against organizations, including imaging centers and women's health practices, that could not show an accurate, organization-wide risk analysis.
• Most of what the proposal would require (an asset inventory, MFA, tested restores, vendor verification) is cheaper to build gradually now than to compress into a short compliance window later.

The Short Answer

No new HIPAA Security Rule requirements have taken effect. The Security Rule your practice must meet today is the one HHS has enforced since 2013. What has changed is enforcement emphasis: OCR investigators now ask first for your risk analysis and your evidence that you acted on it. An Arkansas practice that can produce both is in a strong position whether or not the proposed rule is finalized.

Why a Proposal Is Driving Real Decisions

On January 6, 2025, the HHS Office for Civil Rights published a Notice of Proposed Rulemaking that would rewrite large parts of the Security Rule. It was the first serious attempt to modernize the rule in more than a decade, and it drew thousands of public comments, many of them from smaller providers worried about cost.

The proposal was originally scheduled for finalization in spring 2026. That date passed. According to reporting on the federal Unified Agenda released in mid-2026, the target for final action moved to July 2027, while OCR shifted its near-term attention to Privacy Rule changes. A target on the regulatory agenda is a planning signal, not a deadline. The final rule could arrive as proposed, arrive narrowed, slip again, or be withdrawn.

Practice owners in Little Rock, Conway and Benton reasonably ask whether to spend money on something that may never become law. The better question is which parts of the proposal already describe a defensible security program.

Current Law Versus Proposal: Where the Lines Are

The table below separates obligations that exist today from those that would exist only if the proposal is finalized. It is a simplified working summary, not legal advice.

Obligation	In force today	What the proposal would change
Risk analysis	Required. Must be "accurate and thorough" and cover all ePHI	Would specify content in more detail and require review at least every 12 months
"Addressable" safeguards	Practices may document why an addressable control is not reasonable and use an alternative	Would remove most of the addressable/required distinction
Encryption of ePHI	Addressable	Would become required at rest and in transit, with limited exceptions
Multi-factor authentication	Not explicitly required	Would be required for most access to systems holding ePHI
Technology asset inventory and network map	Implied by a thorough risk analysis	Would be explicitly required and kept current
Vulnerability scanning and penetration testing	Not specified	Scanning at least every six months; penetration testing annually
Restoration of critical systems	Contingency planning required	Would set an expectation of restoring critical systems within 72 hours
Business associate oversight	BAA required	Would add periodic written verification that business associates have deployed required safeguards

Read the right-hand column and a pattern emerges. Very little of it is new technology. It converts expectations that OCR already applies after a breach into explicit, auditable requirements.

What OCR Is Actually Enforcing in 2026

OCR launched its Risk Analysis Initiative in late 2024 to concentrate enforcement on a single, recurring failure: organizations that never completed an organization-wide assessment of where their ePHI lives and what threatens it. By spring 2026 the initiative had produced more than a dozen resolution agreements.

The April 2026 batch is instructive for independent practices because of who was involved. OCR announced four ransomware settlements on the same day, including Assured Imaging ($375,000) and Regional Women's Health Group, doing business as Axia Women's Health ($320,000). These were not academic medical centers. They were the kind of diagnostic and specialty organizations that also operate across Central Arkansas, and each settlement carried a multi-year corrective action plan.

The corrective action plans matter more than the dollar figures. They require documented risk analysis, a written risk management plan tied to specific vulnerabilities, and evidence that controls are working. Commentators tracking the initiative report that OCR intends to look harder at risk management, meaning the remediation record, rather than only whether an analysis exists.

The Arkansas Layer

HIPAA is not the only notification regime. Arkansas's Personal Information Protection Act requires notice to the Arkansas Attorney General when a breach of personal information affects more than 1,000 people, at the same time individuals are notified or within 45 days of determining there is a reasonable likelihood of harm, whichever comes first. How the state law interacts with HIPAA for a covered entity is a question for your attorney, but your incident response plan should name both timelines so nobody is reading statutes during a crisis.

Why Smaller Clinics Struggle, and Where the Effort Goes

A 12-provider practice in Bryant and a 400-bed hospital face the same Security Rule. The hospital has a compliance department. The practice has a manager who also handles payroll, credentialing and the front desk schedule. That mismatch, not unwillingness, explains most failed risk analyses.

In practice, compliance effort concentrates in five places.

1. Knowing What You Have

A risk analysis is only as good as its inventory. Most practices can list their EHR. Fewer can list every place ePHI travels: the fax-to-email service, the imaging workstation that stores studies locally, the billing company's portal, the dictation app on a physician's phone, the shared drive where referral letters accumulate. Building that inventory is tedious the first time and fast after that.

2. Access Control That Matches Reality

Shared logins at a nursing station, former employees whose accounts were never disabled, and a single administrator password known to three people are common findings. Fixing them requires decisions about workflow, not just software settings, which is why they linger.

3. Audit Logs Someone Actually Reviews

Most EHR platforms log access. The gap is review. A defensible program defines who looks at access reports, how often, and what triggers a follow-up, then keeps a record that the review happened.

4. Vendor Oversight

Small practices depend heavily on vendors: EHR hosting, clearinghouses, answering services, transcription, IT support. A signed Business Associate Agreement establishes responsibility. It does not establish that the vendor is secure. Asking key vendors annually for evidence of their safeguards is a modest habit that the proposal would make mandatory.

5. Documentation That Survives Staff Turnover

Policies written by a consultant in 2019 and never revisited are a liability, not an asset. OCR's questions are about what you do now.

A Practical Sequence for the Next Twelve Months

This sequence is designed for an independent practice with limited internal IT capacity. Each step produces a document you can show an investigator or a cyber-insurance underwriter.

1. Build or refresh the ePHI asset inventory, including cloud services and vendor connections. Output: a current inventory and simple network diagram.
2. Complete an organization-wide risk analysis using a recognized method, such as NIST SP 800-66 Revision 2 or the free HHS Security Risk Assessment Tool. Output: a dated analysis with risk ratings.
3. Turn the findings into a risk management plan with owners and target dates. Output: a remediation register you update monthly.
4. Close the access gaps first: MFA on email, remote access and the EHR where supported; removal of stale accounts; elimination of shared credentials. Output: an account review record.
5. Test a restore of your most critical system, then write down how long it took. Output: a restore test log.
6. Collect security attestations from your top five vendors by data volume. Output: a vendor review file.
7. Rewrite policies to match what steps 1 through 6 established, and train staff on them. Output: dated policies and training records.

The HHS 405(d) program's Health Industry Cybersecurity Practices, Technical Volume 1, is written specifically for small organizations without dedicated security staff and maps well to this sequence.

What Can Reasonably Wait

Not everything in the proposal deserves immediate spending. Annual outside penetration testing is valuable, but probably not a small practice's next dollar if MFA and backups are incomplete. Prioritize by risk, and record why. That reasoning is itself part of a defensible risk analysis.

Frequently Asked Questions

Is the new HIPAA Security Rule in effect in Arkansas?

No. As of October 2026 the January 2025 proposal has not been finalized, and the existing Security Rule remains the law that OCR enforces nationwide, including in Arkansas.

How often should a medical practice perform a HIPAA security risk assessment?

The current rule requires periodic review rather than a fixed interval. OCR guidance has long treated annual review, plus review after significant changes such as a move, a new EHR or a merger, as the practical standard. The proposal would codify a 12-month cycle.

Does a signed BAA make our vendor's security our vendor's problem?

Not entirely. A BAA allocates legal responsibility, but a covered entity still has to account for vendor risk in its own risk analysis, and OCR has named business associates and covered entities in the same enforcement matters.

Conclusion

The proposed HIPAA Security Rule changes have become a distraction for many practices, a reason to wait rather than act. The enforcement record points the other way. The practices that receive corrective action plans are generally not the ones that missed a new technical requirement. They are the ones that could not show they understood their own environment. Build that understanding now, document the decisions you make with it, and a final rule, whenever it arrives, becomes an adjustment rather than an emergency.

Talk to Meem Health

Meem Health helps Central Arkansas practices complete HIPAA security risk analyses, build remediation plans they can maintain, and put the access, backup and vendor-oversight controls behind them in place. If you want a second opinion on where your practice stands, start with our HIPAA & Compliance services page or call 501-777-5177.