Notifications
Clear all
Topic starter
10/06/2026 11:10 pm
TL;DR: OCR’s expected 2026 HIPAA Security Rule update removes addressable controls, makes encryption, MFA, logging, and repeated risk analysis mandatory, and folds AI systems touching ePHI into inventory and authorization obligations, according to EnforceAuth’s review of the NPRM. The real shift is that healthcare teams must prove runtime authorization for AI identities, not just authentication and provisioning.
NHIMG editorial — based on content published by EnforceAuth: HIPAA Security Rule update and the authorization gap in healthcare AI
By the numbers:
- The comment period closed in March 2025 with nearly 5,000 submissions.
Questions worth separating out
Q: What breaks when healthcare teams rely on provisioning-time access for AI systems touching ePHI?
A: Provisioning-time access breaks because it assumes the requester, purpose, and risk context stay stable long enough for quarterly review to matter.
Q: Why do AI systems complicate HIPAA access governance for ePHI?
A: AI systems complicate HIPAA access governance because they blur the line between identity and action.
Q: How do security teams know whether AI authorization for ePHI is actually working?
A: Teams know it is working when they can reconstruct every AI access decision from request to outcome, including the policy version and contextual inputs used.
Practitioner guidance
- Inventory every AI identity touching ePHI Build a live inventory of models, agents, API keys, service accounts, and workflows that can read, write, train on, or summarise ePHI.
- Convert AI access rules into policy-as-code Write Minimum Necessary, permitted-purpose, and sensitivity rules as versioned policy so you can prove what was enforced on a specific date.
- Correlate decision logs across every control layer Link the EHR, gateway, and authorization decision trail so each AI request can be reconstructed end to end.
What's in the full article
EnforceAuth's full research covers the operational detail this post intentionally leaves for the source:
- The specific 90-day readiness path with day-by-day implementation sequencing for healthcare teams
- Examples of how to inventory ambient documentation tools, prior authorization agents, and triage chatbots in one regulated control set
- The audit-request scenario showing which records OCR will likely ask for and where most organisations are exposed
- The policy-as-code approach the source uses to translate Minimum Necessary into enforceable runtime rules
👉 Read EnforceAuth’s analysis of HIPAA’s 2026 AI authorization requirements →
HIPAA and AI authorization: what healthcare IAM teams must prove?
Explore further
12/06/2026 5:00 am
The Authorization Gap is now a healthcare governance problem, not just an IAM gap. The NPRM does not need an AI-specific section to create an AI-specific obligation. Once the rule removes addressable escape hatches and requires continuous reassessment, the real failure mode becomes obvious: existing access governance cannot prove runtime control over identities that change context faster than review cycles can observe. Practitioners should treat this as a governance redesign problem, not a policy tweak.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to The State of Secrets in AppSec.
A question worth separating out:
Q: Who is accountable when an AI system accesses ePHI outside its intended purpose?
A: The covered entity remains accountable, and business associates may share that accountability depending on the service relationship and contract terms. HIPAA does not transfer the burden to the model or the tool. If AI access is not continuously governed and logged, the organisation that deployed it still has to answer for the exposure.
👉 Read our full editorial: HIPAA’s 2026 update turns AI authorization into a compliance test
