For nearly a decade, dental practices could get away with a checkbox approach to HIPAA compliance. Run an antivirus scan, lock the server room door, sign an annual attestation, and move on. That era is ending.

The Department of Health and Human Services has proposed sweeping updates to the HIPAA Security Rule — the most significant revision since the original rule took effect in 2005. The draft regulations signal a fundamental shift in what regulators expect from covered entities, and dental practices that rely on legacy compliance strategies are about to discover how far behind they've fallen.

Here are the five changes that will hit hardest.

1. Multi-Factor Authentication Becomes Mandatory

The proposed rule eliminates the distinction between "required" and "addressable" implementation specifications. Under the current framework, practices could document why they chose not to implement certain controls — effectively creating a compliance loophole wide enough to drive a truck through. MFA was technically addressable. Most dental practices addressed it by not implementing it.

Under the updated rule, MFA for accessing electronic protected health information (ePHI) will be a baseline requirement. Every user, every system, every access point. This means the front desk logging into the practice management system, the hygienist accessing digital radiographs, and the billing coordinator pulling insurance claims — all protected by a second authentication factor.

For practices still running single-password logins on shared workstations (a shockingly common configuration), this change alone will require a significant infrastructure overhaul.

2. Encryption Is No Longer Optional

The current HIPAA Security Rule lists encryption as an addressable specification. The updated rule moves it to required. All ePHI must be encrypted at rest and in transit — no exceptions, no alternative measures, no documentation-your-way-out-of-it workarounds.

This has immediate implications for practices that store patient data on local servers without full-disk encryption, transmit unencrypted emails containing patient information, or use practice management systems that don't encrypt their database files. It also affects backup systems: if your backup drives aren't encrypted and they're stolen from the trunk of an IT technician's car (a real scenario from a 2024 HIPAA enforcement action), that's now an unambiguous violation rather than a judgment call.

3. The Security Risk Assessment Gets Teeth

Every dental practice is already required to conduct an annual Security Risk Assessment under the current rule. In practice, most don't. The ones that do often rely on generic templates or five-page questionnaires that identify risks in vague terms without documenting specific remediation plans or timelines.

The proposed rule transforms the SRA from a documentation exercise into an enforceable audit trail. Practices will need to maintain detailed inventories of all systems that create, receive, maintain, or transmit ePHI. Risk assessments must map specific threats to specific assets, evaluate the likelihood and impact of each threat, and document the controls implemented to mitigate each identified risk.

Regulators have signaled that the SRA will become the first document requested during an audit or breach investigation. A missing or incomplete SRA won't just be a finding — it will be treated as presumptive evidence of willful neglect, the highest penalty tier under HIPAA enforcement.

4. Business Associate Agreements Get Real Enforcement

The updated rule tightens requirements around business associates — the vendors, IT providers, billing companies, and cloud service providers that handle ePHI on behalf of dental practices. Current enforcement has been relatively lax; regulators focused most of their attention on the covered entity rather than the business associate chain.

That's changing. The proposed rule requires covered entities to verify that their business associates have implemented specific technical safeguards — not just signed a BAA that sits in a drawer. Practices will need to obtain and review evidence of their vendors' security controls, including penetration testing results, encryption certifications, and incident response plans.

For the average dental practice working with fifteen to twenty vendors (PM software, imaging, billing clearinghouse, IT provider, cloud backup, phone system, patient communication platform), this creates a substantial new compliance workload.

5. Incident Response Plans Become a Documented Requirement

The current rule requires practices to have policies and procedures for responding to security incidents. The updated rule goes significantly further: practices must maintain a written incident response plan that includes specific procedures for containment, eradication, and recovery; defined roles and responsibilities for incident response team members; communication protocols for notifying patients, regulators, and law enforcement; and evidence that the plan has been tested through tabletop exercises or simulations within the past twelve months.

This is where many dental practices will face the steepest learning curve. Building an incident response plan requires understanding your network architecture, data flows, and recovery capabilities at a level of detail that most practice owners have never engaged with.

The Compliance Cliff Is Real

The timeline for these changes remains in flux — public comment periods and political dynamics could push final implementation into late 2026 or early 2027. But waiting for a final rule before taking action is the wrong strategy.

Regulators evaluate compliance based on reasonable diligence, not perfect timing. A practice that began implementing MFA, encryption, and documented risk assessments in early 2026 will be treated far more favorably in an enforcement action than one that waited until the rule was finalized and then scrambled to catch up.

The dental practices that navigate this transition successfully will be the ones that stopped treating HIPAA compliance as a paperwork exercise and started treating it as what it's always been: a patient safety imperative backed by federal law.