Recent Regulatory Updates

Regulatory Update: Annual Civil Monetary Penalty Inflation Adjustment (HHS)

Effective January 28, 2026 — The U.S. Department of Health and Human Services (HHS) published its annual adjustment of civil monetary penalties (CMPs) to reflect inflation, as required under the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015.

This rule increases penalty amounts across various healthcare regulatory programs administered by HHS, including:
    •    HIPAA privacy and security enforcement
    •    Medicare and Medicaid program requirements
    •    Hospital price transparency obligations
    •    Stark Law–related sanctions and other statutory penalties

The updated amounts take effect immediately and apply to penalties assessed after publication where permitted by law.

Why This Matters:
Although this rule does not create new enforcement authority, it raises the financial exposure associated with noncompliance. Healthcare providers, business associates, and other regulated entities should ensure their privacy, compliance, and governance programs are operating effectively and consistently with current standards to mitigate increased penalty risk.

For full details, see the official Federal Register notice:
https://www.federalregister.gov/documents/2026/01/28/2026-01688/annual-civil-monetary-penalties-inflation-adjustment.

Regulatory Update: HIPAA Notice of Privacy Practices Changes -Compliance by February 16, 2026

Source: U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR).

In April 2024, HHS issued a final rule modifying the HIPAA Privacy Rule to strengthen privacy protections for reproductive health information and to update certain Notice of Privacy Practices (NPP) requirements. The rule was published at 89 Fed. Reg. 32976 (April 26, 2024).

Among other changes, the rule revised 45 CFR 164.520 to require updates to covered entities’ Notices of Privacy Practices. These updates were intended to address disclosures involving reproductive health information and incorporate related regulatory changes.

On June 18, 2025, the U.S. District Court for the Northern District of Texas vacated most of the rule. However, according to HHS, certain NPP modifications remain in effect and must be implemented by February 16, 2026.

HHS further explains that the court vacated specific NPP provisions at 45 CFR 164.520(b)(1)(ii)(F), (G), and (H), while other NPP-related changes remain in force.

Practical Considerations

Healthcare providers, health plans, and healthcare clearinghouses should review their current Notices of Privacy Practices to determine whether updates are required under the remaining portions of 45 CFR 164.520 and ensure compliance by February 16, 2026.

Official Sources
    •    OCR Fact Sheet (includes judicial update and compliance date):
https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/final-rule-fact-sheet/index.html
    •    Federal Register Publication (89 Fed. Reg. 32976, April 26, 2024):
https://www.federalregister.gov/documents/2024/04/26/2024-08503/hipaa-privacy-rule-to-support-reproductive-health-care-privacy