HIPAA IT controls for Hawaii medical practices: what’s required in 2026

Published June 17, 2026 · HI Tech Hui · ~10 min read

The current HIPAA Security Rule technical safeguards

Under the existing HIPAA Security Rule (45 CFR Part 164, Subpart C), every Hawaii covered entity — medical practices, dental practices, behavioral health clinics, imaging centers, labs — must implement the following technical safeguards. These are not new in 2026; they have been law since 2005 and are what OCR enforces today:

• Access control — unique user identification, emergency access procedure, automatic logoff, encryption and decryption.
• Audit controls — hardware, software, and procedural mechanisms that record and examine activity in systems containing or using ePHI.
• Integrity controls — mechanisms to ensure ePHI is not improperly altered or destroyed.
• Person or entity authentication — verify the identity of anyone or anything seeking access to ePHI.
• Transmission security — integrity controls and encryption for ePHI in motion.

Several of these specifications are currently labeled “addressable,” which means a covered entity may document why a specific implementation is not reasonable and appropriate and implement an equivalent measure instead. The pending NPRM removes that distinction. The full text of the current rule is on the HHS Security Rule page.

What the 2026 NPRM would add (when finalized)

The Notice of Proposed Rulemaking that OCR published on January 6, 2025 is the most significant Security Rule update in over twenty years. As of the publication date of this post, the final rule has not been issued — OCR’s May 2026 target passed without publication. The proposal’s headline changes are:

• End of “addressable” vs “required” distinction — nearly every safeguard becomes mandatory.
• Mandatory MFA on every system that accesses, stores, or transmits ePHI. Phishing-resistant MFA (passkeys, FIDO2, certificate-based) is preferred; we covered the migration in our piece on phishing-resistant authentication via Entra passkeys.
• Encryption of ePHI at rest and in transit — required, not addressable. FIPS-validated cryptographic modules where applicable.
• Detailed technology asset inventory — not a spreadsheet of laptops, but a documented map of every system, application, and data flow involving ePHI.
• Risk analyses with explicit threat-vulnerability pairs tied to the asset inventory.
• Vulnerability scanning every six months and annual penetration testing.
• 72-hour Recovery Time Objective and 48-hour Recovery Point Objective for disaster recovery.
• Annual compliance audits against the Security Rule.
• Tighter Business Associate Agreements, with annual written verification of BA security controls.

The compliance window once the final rule is published is 180 days. That is not generous for a small Hawaii practice starting from zero on MFA and encryption-at-rest. Some of the public commentary — more than 4,700 comments — pushed for longer windows or rule withdrawal, including from major systems like Cleveland Clinic and Yale New Haven. OCR has not signaled which way the final rule will land.

The order Hawaii practices should tackle the work in

If your Honolulu practice does not yet have the proposed controls in place, the practical order of operations — not the regulatory order — looks like this. Each step builds on the last:

1. Asset and data-flow inventory (weeks 1-2)

You cannot risk-analyze what you cannot list. Every workstation, server, mobile device, EHR, billing system, secure messaging platform, scheduling system, imaging modality, fax appliance, cloud storage tenant, and BA-managed system that touches ePHI gets inventoried with owner, location, data sensitivity, and a documented data flow. This document is the foundation of everything else.

2. MFA on every ePHI system (weeks 2-6)

Roll MFA out in this order: Microsoft 365 admin accounts first, all user accounts second, EHR accounts third, then remote access (VPN, RDP, remote support tools), then any third-party SaaS that touches ePHI. Push to phishing-resistant methods (passkeys, FIDO2 keys, or Microsoft Authenticator number-matching) wherever the system supports it. SMS-based MFA is better than nothing but is being deprecated industry-wide.

3. Encryption at rest and in transit (weeks 4-8)

BitLocker on every Windows endpoint with Intune key escrow. FileVault on every Mac. Mobile device encryption enforced via MDM. TLS 1.2 minimum (1.3 preferred) for all data in transit. Confirm cloud storage tenants are encrypted at rest by the provider with customer-managed keys where the EHR vendor supports it. Document the cryptographic modules in use.

4. EDR on every endpoint (weeks 6-8)

Endpoint detection and response on every workstation, server, and managed device. Named tooling — CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint — with central reporting to a SOC. We monitor client environments through our in-house SOC for exactly this reason; for healthcare, alerting needs to land with someone who can act on it 24/7.

5. Risk analysis (weeks 8-12)

A current, written risk analysis with threat-vulnerability pairs tied to your asset inventory. OCR’s January 2026 Cybersecurity Newsletter named risk analysis as the most frequently cited Security Rule deficiency in resolution agreements. Use a methodology — NIST SP 800-30 is the conventional reference. Update annually and after any material change to systems or services.

6. Backup, recovery, and incident response (weeks 10-14)

3-2-1 backup architecture with immutability on at least one copy, tested quarterly — not just “the backup ran last night.” A written incident response plan with named roles, escalation contacts, and a tabletop exercise on the calendar. Recovery objectives documented; the proposed rule’s 72-hour RTO and 48-hour RPO are reasonable targets even before they become mandatory.

7. BAA inventory and refresh (weeks 12-16)

Every vendor that touches ePHI needs a current, signed Business Associate Agreement. The proposed rule will require annual written verification of BA security controls. Get ahead of that now: build the BA inventory, refresh stale agreements, and add a security questionnaire to your annual vendor review.

How Hawaii-specific factors change the math

Hawaii medical practices face the same Security Rule as mainland practices, but the operational context is different in three ways that affect IT planning:

• On-island response. A ransomware incident on a Friday night requires people on island. Pure-remote MSPs cannot physically isolate infected machines or restore from offline media. Healthcare incident response in Hawaii must include on-island capability.
• State law overlay. Hawaii’s breach notification statute (HRS Chapter 487N) applies on top of HIPAA. Notifications to affected patients and to the state Office of Consumer Protection can be required even when HIPAA notice timelines have not been reached.
• Workforce mobility. Travel between offices, neighbor-island clinics, and clinician home offices is common. Conditional access policies and MDM matter more here than in a single-office mainland practice. Persistent connection assumptions break in Hawaii.

The cost framework for HIPAA-aware managed IT in Hawaii sits at the upper end of the standard managed IT pricing we covered in the 2026 pricing breakdown for Honolulu businesses — expect $225 to $300 per user per month for a compliance-driven engagement.

What OCR is enforcing right now (regardless of the final rule)

The proposed rule has not been finalized, but OCR has not been quiet. Recent enforcement patterns relevant to Hawaii practices:

• Risk analysis deficiencies remain the single most-cited Security Rule failing in resolution agreements.
• Missing or stale Business Associate Agreements draw consistent citations, especially as practices add cloud-based EHRs and AI scribes.
• Shared user accounts and missing audit logging show up in nearly every breach investigation.
• Lack of MFA on remote access is now treated as a baseline failure even though it is technically still “addressable.”
• Encryption gaps on portable devices (laptops, USB drives) trigger breach reporting that healthier controls would have prevented entirely.

The takeaway is that the proposed rule is not academic. OCR is treating its provisions as expected baseline care even before the rule is finalized. The closer your practice gets to the proposal now, the smaller the year-of-finalization scramble will be.

The compliance documentation Hawaii practices commonly lack

Most Hawaii medical practices we see for the first time have similar gaps in documentation, not necessarily in controls. The controls may be present; the paperwork is not. Common missing artifacts:

• Current written risk analysis with threat-vulnerability pairs.
• Technology asset inventory mapped to ePHI flow.
• Written sanction policy and workforce security policies.
• Incident response plan with named roles and contact lists.
• BAA inventory with renewal dates and security questionnaires.
• Audit log retention and review procedures.
• Backup recovery test results from the past 12 months.
• Training records for workforce security awareness.

This is the documentation OCR asks for in an investigation. The investigation often begins with a complaint or breach notification triggered by an event that the controls themselves would have prevented — which is why control deployment and documentation discipline are inseparable.

What to do this quarter

Practical 90-day plan for a Hawaii medical practice that wants to be defensible against both current OCR enforcement and the eventual final rule:

1. Complete an asset and ePHI data-flow inventory.
2. Deploy phishing-resistant MFA on all admin accounts and remote access; SMS or TOTP MFA everywhere else as an interim step.
3. Verify BitLocker/FileVault on every endpoint and confirm Intune key escrow.
4. Confirm EDR is deployed and monitored 24/7 with named escalation.
5. Produce a written risk analysis or refresh the most recent one against the new inventory.
6. Refresh the BAA inventory and chase down any missing or stale agreements.
7. Run a tabletop exercise of your incident response plan; document the gaps you find.

None of this list is novel. All of it is what OCR expects to see when it opens a file on your practice. Most of it is also what a competent managed IT provider should be doing already — the test for any Hawaii MSP claiming healthcare expertise is whether they can show you their template artifacts, not just promise them. The buyer-side framework for vetting that claim is in our evaluation framework for Honolulu MSPs, and the broader compliance landscape is in our CMMC vs SOC 2 vs HIPAA comparison for Hawaii SMBs.

Sources

• HHS HIPAA Security Rule — current text and guidance
• HIPAA Security Rule NPRM — Federal Register, January 6, 2025
• Hawaii Revised Statutes Chapter 487N — Security Breach of Personal Information

Building a HIPAA control program for a Hawaii practice? HI Tech Hui provides managed IT, cybersecurity, and 24/7 monitoring through our in-house SOC with HIPAA-aware tooling and documentation. Contact us for a no-pressure scoping conversation.