HIPAA, Ransomware and Your Website: What Dental Practices Better Fix Before 2027

Federal regulators have spent 2026 reshaping the rules on patient privacy, data security and digital accessibility. Some changes are final, some are delayed, and some are still pending. This article sorts out what applies now, what is coming, and what your practice should do before the new year.

KEY TAKEAWAYS

• The current HIPAA rules are fully enforced. Proposed changes do not delay your obligations today.
• The Security Rule overhaul is delayed to July 2027. But its core safeguards — multi-factor authentication, encryption and asset inventories — are best practice now.
• A Privacy Rule update is pending. It is expected to change your Notice of Privacy Practices and patient access procedures.
• Accessibility has a hard date. Practices with 15 or more employees that receive federal funds must have accessible websites, forms and portals by May 11, 2027.
• Your vendors are part of your compliance. Business Associate Agreements and vendor contracts need attention.

Where the Rules Stand Today

Rule	Status (October 2026)	What it means for you
Notice of Privacy Practices update (substance use disorder records rule)	Compliance date passed: February 16, 2026	Confirm your notice was updated.
HIPAA Privacy Rule — care coordination and patient access	Sent for final review April 2026; not yet published	Expect changes to your notice and access procedures; plan for one revision.
HIPAA Security Rule overhaul	Proposed January 2025; final action targeted July 2027	Current rule still applies; adopt key safeguards now.
Section 504 web and app accessibility	Deadlines extended in May 2026	May 11, 2027 (15+ employees); May 10, 2028 (fewer than 15).

Why Dental Practices Are Targets

Dental records contain names, birth dates, Social Security and insurance numbers, and payment information — everything needed for identity theft. Many practices run on small IT budgets and outside vendors, which makes them attractive to ransomware groups. A single attack can take scheduling, imaging and billing offline for days, and may trigger patient notification, regulatory reporting and lawsuits.

The HIPAA Security Rule: Delayed, Not Abandoned

HHS proposed the first major rewrite of the Security Rule in over a decade in January 2025. The agency has pushed final action to July 2027. The proposal would require written documentation of all security policies, technology asset inventories, encryption, multi-factor authentication and regular testing — many of which are currently "addressable" rather than required.

Practices should not wait. The safeguards in the proposal are the same ones that stop most ransomware attacks, and regulators already expect a thorough risk analysis under the current rule.

The HIPAA Privacy Rule: Changes on the Way

A separate Privacy Rule update, first proposed in 2021, was sent for final review in April 2026. It is expected to strengthen patients' right to access their records, ease information sharing for care coordination, and may eliminate the requirement to obtain a signed acknowledgment of your Notice of Privacy Practices. As of this writing, it has not been published. Once it is, practices will likely have several months to comply.

Your Website Is a Compliance Issue

Under the HHS Section 504 rule, practices that receive federal financial assistance, such as Medicaid or CHIP payments, must make web content, online forms, patient portals and mobile apps meet the WCAG 2.1 AA accessibility standard. HHS extended the deadlines by one year: May 11, 2027 for practices with 15 or more employees and May 10, 2028 for smaller practices. Online scheduling, intake forms and payment pages are common problem areas.

Review your website's tracking tools as well. Analytics pixels and chat widgets on appointment pages can disclose patient information to third parties.

Privacy, Security and Accessibility Checklist

Security

• Update your written security risk analysis and risk management plan.
• Turn on multi-factor authentication for email, practice management software, remote access and backups.
• Encrypt laptops, servers, backups and mobile devices that hold patient data.
• Keep an inventory of systems and devices that store or access patient data.
• Test backups and keep at least one offline copy.
• Adopt a written incident response plan and know who to call first.

Privacy

• Confirm your Notice of Privacy Practices reflects the February 16, 2026 changes.
• Review patient records request procedures and response times.
• Prepare to revise your notice and access policies once the Privacy Rule update is final.
• Train every workforce member and document the training.

Vendors and accessibility

• Confirm a current Business Associate Agreement with every vendor that handles patient data.
• Review cyber liability insurance limits and what the policy requires of you.
• Commission a WCAG 2.1 AA audit of your website, forms and patient portal.
• Add accessibility and data security warranties to vendor contracts.
• Remove or review tracking pixels and chat tools on patient-facing pages.

Let Oberman Law Firm Protect Your Patient Data

Oberman Law Firm helps dental practices build HIPAA compliance programs, negotiate vendor and Business Associate Agreements, and respond quickly when an incident occurs.

We can review your HIPAA policies, notices and vendor contracts, and give you a clear plan to meet the 2027 deadlines.

Schedule your HIPAA and accessibility review today. Contact Oberman Law Firm at (770) 886-2400, or visit our office at 327 Dahlonega Street, Suite 401, Cumming, Georgia 30040.

Oberman Law Firm provides this material for informational purposes only. The use of a lawyer is an important decision and should not be based solely upon advertisements.