https://infosecstandards.org/standards/hipaa News about Health Insurance Portability and Accountability Act (HIPAA), including major updates to our page on it. en-us https://infosecstandards.org/news/who-decides-what-to-ask https://infosecstandards.org/news/who-decides-what-to-ask Thu, 03 Sep 2026 00:00:00 GMT The HIPAA, PCI DSS, CMMC, and SOC 2 pages each gained a section naming the party that actually sets your obligation and the questions to put to them in writing. HIPAA and SOC 2 also gained a first-decision picker. https://infosecstandards.org/news/risk-assessment-tool https://infosecstandards.org/news/risk-assessment-tool Wed, 02 Sep 2026 00:00:00 GMT Infosec Standards now has a guided, NIST SP 800-30 based risk assessment tool. Everything stays in your browser; you leave with a JSON file to resume from, a spreadsheet register, and a printable report. https://infosecstandards.org/news/hipaa-osf-settlement https://infosecstandards.org/news/hipaa-osf-settlement Thu, 06 Aug 2026 00:00:00 GMT HHS OCR resolved a 2021 ransomware investigation with OSF Healthcare System for risk analysis, impermissible disclosure, and late breach-notification failures. https://infosecstandards.org/news/hipaa-security-rule-delay https://infosecstandards.org/news/hipaa-security-rule-delay Mon, 06 Jul 2026 00:00:00 GMT HHS OCR’s proposed Security Rule update is now a long-term action with a projected final action date of July 2027. The current Security Rule stays in force. https://infosecstandards.org/news/hipaa-omnibus-rule https://infosecstandards.org/news/hipaa-omnibus-rule Fri, 25 Jan 2013 00:00:00 GMT On January 25, 2013, HHS published the HIPAA Omnibus Final Rule. It took effect March 26, 2013, with a compliance date of September 23, 2013, and remains the rule set in force today.