The HIPAA Security Rule (45 CFR §§164.302–318) protects electronic Protected Health Information (ePHI) through three families of safeguards: administrative (policies, training, a designated security official), physical (facility and device controls), and technical (access control, audit controls, integrity, authentication, and transmission security). Every safeguard is anchored in a documented risk analysis, which is the rule's true center of gravity — you identify your risks, then justify the controls you chose to address them.
A defining quality is that the Security Rule is deliberately technology-neutral. It demands outcomes — that access is controlled, that activity is audited, that data integrity and transmission security are protected — but it does not prescribe specific products or algorithms. That flexibility is a feature for builders, because it lets the rule survive changing technology, but it also means you cannot point to a vendor's badge and call yourself compliant; the burden of demonstrating reasonable, documented choices stays with you.
The timing nuance matters in 2026. A federal rulemaking initiated in 2024–2025 by HHS proposes the first major overhaul of the Security Rule in roughly two decades, and the proposal moves several safeguards that were "addressable" toward being effectively mandatory — notably encryption of ePHI and multi-factor authentication (MFA). For a telemedicine product team, the practical implication is to design assuming encryption-everywhere and MFA as baseline rather than optional, and to cite the rule with its applicable year so colleagues know whether you mean the long-standing version or the updated one. The common pitfall is reading older "addressable" language as "optional" — it never meant that, and the proposed update closes the gap further.
The handbook · 7 volumes
Fora Soft Video Engineering Handbook
The HIPAA Security Rule, tightened in the 2026 update, sets the encryption, access and audit controls a video consult platform must prove. Our handbook series covers the whole video stack in seven volumes; for Security Rule work start with Volume 7: compliance, serving infrastructure and vertical playbooks. Volume 3 covers WebRTC transport security and DRM; Volume 1 covers encoding. Written by Nikolay Sapunov, CEO at Fora Soft.
Is your telehealth video stack ready for the 2026 HIPAA Security Rule update?
We will check encryption, access control, audit logging and vendor coverage against the updated rule and give you a remediation plan with timelines. 250+ video products shipped since 2005.
