November 7, 2026 MFA, Encryption, 72-Hour Restore: Washington’s HIPAA Overhaul Is a Preview of the New Security Floor for Every Dental Practice
Every so often a regulator writes down, in plain and enforceable language, the security measures that technicians have been recommending for years. When that happens, it is worth reading closely even if the rule does not apply to you directly — because it tells you the standard you will eventually be measured against. That is exactly what is happening now in Washington, where the U.S. Office for Civil Rights has proposed the most significant overhaul of the HIPAA Security Rule in more than a decade.
A dental practice in the Greater Toronto Area answers to Ontario’s PHIPA, not to HIPAA, so it would be easy to file this under “American news.” That would be a mistake. Cyber threats do not respect the border, and neither do the cyber-insurers, software vendors and auditors who increasingly decide what “reasonable safeguards” means in practice. The proposed HIPAA rule is the clearest public statement yet of the security floor every practice that holds patient records will be expected to stand on. Here is what is in it, and why you should treat the checklist as the new baseline well before anyone forces your hand.
What the proposed rule actually is
On December 27, 2024, the Office for Civil Rights at the U.S. Department of Health and Human Services issued a Notice of Proposed Rulemaking — an NPRM — to modernize the HIPAA Security Rule, the national standard that governs how electronic protected health information is secured. It is the first major revision to that rule since the 2013 HITECH update, and it is a deliberate response to the relentless rise in attacks on healthcare organizations.
The crucial word, as of late 2026, is proposed. After an extended comment period, OCR has not issued a final rule, and the requirements, their timing, and even whether they survive at all could still change. This is not a deadline you are late for. It is a preview. But previews from a national regulator have a way of becoming the reference everyone else — insurers, vendors, courts — starts quoting, which is precisely why it pays to understand it now rather than scramble later.
The headline change: “addressable” becomes “required”
For twenty years, the HIPAA Security Rule split its safeguards into two tiers: required measures you simply had to implement, and addressable ones you could decline if you documented a reason. In practice, “addressable” became a loophole that many small offices read as “optional.” Encryption was addressable. So, effectively, were a number of the controls that would have stopped the breaches now in the headlines.
The proposed rule closes that loophole. It would remove the distinction between required and addressable and make nearly every implementation specification mandatory, with only narrow, documented exceptions. In one stroke, that converts a long list of “should” into “must.” Everything that follows flows from that single structural change.
The controls that would become mandatory
Stripped of legal language, the proposal names a concrete set of safeguards that would move from recommended to required. The ones that matter most for a dental practice are these:
- Multi-factor authentication (MFA) on every system that touches patient data, with limited exceptions. A stolen or guessed password would no longer be enough to open a record.
- Encryption of patient data both at rest and in transit, removing the old “addressable” flexibility. Data on a laptop, a server or a backup drive, and data moving between them, would have to be encrypted.
- A technology asset inventory and network map, maintained and reviewed at least every 12 months, documenting every device that stores or touches patient data and how that data moves between them.
- A defined testing schedule: vulnerability scans at least every six months and penetration testing at least every twelve.
- Contingency timelines: notification within 24 hours when a contingency plan is activated, and restoration of critical data within 72 hours of an incident.
- Written documentation of all policies, procedures, plans and risk analyses — if it is not written down, it does not count.
None of these would surprise anyone who has watched how modern breaches unfold. They are, almost line for line, the controls whose absence keeps showing up in the post-mortems.
Why an Ontario practice should care
PHIPA does not contain this checklist. What it contains is a duty to take “reasonable” steps to protect personal health information — and the meaning of “reasonable” is not frozen. It is set by the prevailing standard of care, and that standard is exactly what documents like the HIPAA proposal, cyber-insurance questionnaires and vendor security requirements are busy redefining in real time.
Consider where you already meet these expectations without a Canadian statute spelling them out. Your cyber-insurance renewal almost certainly now asks whether you enforce MFA and whether you encrypt backups; answer “no” and the premium climbs or the coverage shrinks. Your practice-management and imaging vendors increasingly ship with MFA and encryption on by default. The same compliance instinct that drives an Ontario practice to keep its radiography equipment inspected and documented under the HARP Act applies here: the safe assumption is that the controls a serious regulator now calls mandatory are the controls you will be judged against if something goes wrong, border notwithstanding.
Where most practices will have gaps
Run the list against a typical small office and the same soft spots appear. The asset inventory and network map is the one almost nobody has produced — practices rarely possess a written list of every device touching patient data, let alone a diagram of how that data flows, yet it is the foundation the rule builds everything else on. The 72-hour restoration target is the second: plenty of offices have backups, but very few have ever timed a real restore to confirm they could rebuild a server inside three days. We made that precise point when ransomware began hunting the backup appliances themselves — a backup you have never test-restored is a hope, not a recovery plan.
MFA is often half-done, enforced on email but not on the practice-management login or remote access. Encryption of backups and portable devices is frequently assumed rather than verified. And the regular testing cadence — vulnerability scans every six months, informed by which flaws are actually being exploited — is something most practices have never run at all, even though free resources like the federal catalogue of known-exploited vulnerabilities make the prioritization straightforward.
What to do now, before anything is final
The good news is that none of this requires waiting for a rule to be finalized, and none of it is exotic. A practice can work through the list on its own schedule and be meaningfully safer at every step:
- Build the inventory first. List every device, workstation, server, imaging unit and cloud service that touches patient data, and sketch how the data moves. Everything else depends on this.
- Turn on MFA everywhere it is missing — practice management, remote access, email and cloud imaging — not just the one or two systems that already have it.
- Confirm encryption on laptops, servers, portable drives and, especially, backups. “We think it’s encrypted” is not an answer.
- Test a real restore. Time how long it actually takes to bring a critical system back from backup, and fix the plan if it misses a 72-hour window.
- Schedule security testing — a recurring vulnerability scan and a periodic review — rather than waiting for an incident to find the gaps for you.
- Write it down. Document your policies, your risk analysis and your decisions. Under both HIPAA’s proposal and PHIPA’s reasonableness test, undocumented diligence counts for very little.
That same discipline extends to the everyday habits a rule can never fully capture, like keeping patient discussions off unsecured channels — the kind of day-to-day judgement we covered in looking at what HIPAA and PHIPA actually require when a team talks about patients in Microsoft Teams.
How Compudent can help
Compudent Systems helps dental practices across the GTA and Ontario get ahead of exactly this curve — not by reacting to a rule once it lands, but by building the baseline it describes while there is time to do it calmly. We produce the technology asset inventory and network map most practices have never had, enforce multi-factor authentication across every system that touches patient data, verify that laptops, servers and backups are genuinely encrypted, and test your recovery against a real 72-hour restoration target instead of taking it on faith. We set up the vulnerability-scanning cadence and the written documentation that turn good intentions into something you can actually demonstrate. If you are not certain your practice would stand on the floor this proposal describes, contact us for a practice security and compliance review — it is far easier to build the baseline on your own schedule than on a regulator’s or an attacker’s.
Sources & further reading: