HIPAA Security Rule 2026

Does Your VoIP Provider
Survive the
2026 HIPAA Audit?

HHS published a sweeping NPRM on January 6, 2025. Every "addressable" specification — including VoIP encryption and MFA — becomes required by Q3–Q4 2026. Three enforcement cases already cite VoIP. Is your vendor ready?

📅

Check My VoIP Vendor → View Vendor Rankings ↓
⚠ Compliance Deadline
Q3–Q4 2026
HIPAA Security Rule Final Rule compliance deadline
Lafourche Medical GroupVoIP cited $480K
Plastic Surgery Associates $125K
Yakima Valley Memorial $240K
📋 Get the Free HIPAA VoIP Compliance Checklist
14-point checklist + vendor evaluation framework — instant access.
No spam • Instant access • Written for healthcare IT
🔑

HHS NPRM: "Addressable" Is Over

The January 6, 2025 NPRM eliminates the "addressable vs. required" distinction for technical safeguards. Encryption of ePHI — including phone calls, voicemail, and SIP signaling — is no longer optional. Every covered entity and BA must comply by Q3–Q4 2026.

See Vendor Ratings →
The 2026 Rule Change

Three Requirements That Are Now Mandatory

Under the current HIPAA Security Rule, "addressable" specs let covered entities skip controls if they documented a rationale. The 2026 Final Rule closes that loophole. These three apply directly to VoIP.

🔒

ePHI Encryption in Transit

All ePHI transmitted over VoIP — voice media (RTP), call signaling (SIP), voicemail — must be encrypted using TLS 1.2 or higher. "Industry-standard encryption" without specifics is no longer acceptable language in a BAA.

⚠ Now Required Was: Addressable
🔐

Multi-Factor Authentication

MFA must be enforced for all users accessing systems that process ePHI. This applies to VoIP admin consoles, softphone apps, and call recording platforms. SMS-only MFA may not satisfy the standard.

⚠ Now Required Was: Addressable
📝

Business Associate Obligations

VoIP vendors processing ePHI must sign a BAA that covers all subprocessors — AI transcription engines, call recording storage, SMS gateways. The 2026 rule requires explicit subprocessor disclosure and downstream BAA coverage.

⚠ Now Required Was: Addressable
Vendor Compliance Database

HIPAA Security Rule 2026 — VoIP Vendor Readiness

Not all VoIP vendors are equal. This table shows readiness across the four criteria that matter most for the 2026 rule. Verified from public certifications and vendor compliance documentation.

Vendor 2026 Readiness BAA Available E2E Encryption MFA Enforced Subprocessor BAAs
Weave ✓ Pass ✓ ✓ ✓ ✓
RingCentral RingEX ✓ Pass ✓ ✓ ✓ ✓
8x8 XCaaS ✓ Pass ✓ ✓ ✓ ✓
Microsoft Teams Phone ✓ Pass ✓ ✓ ✓ ✓
Cisco Webex Calling ✓ Pass ✓ ✓ ✓ ✓
Nextiva ⚠ Needs Updates ✓ ~ ~ ~
Dialpad Ai Voice ⚠ Needs Updates ✓ ✓ ~ ~
Five9 ⚠ Needs Updates ✓ ✓ ~ ✕
Vonage Business ⚠ Needs Updates ✓ ~ ~ ~
Ooma Office ✕ High Risk ~ ✕ ✕ ✕
Grasshopper ✕ High Risk ✕ ✕ ✕ ✕
Avaya (legacy SIP) ✕ High Risk ~ ✕ ✕ ✕
Unmanaged SIP Trunking ✕ High Risk ✕ ✕ ✕ ✕

ⓘ  ✓ = confirmed  •  ~ = partial / in progress  •  ✕ = not confirmed. Data from vendor compliance docs & public certifications. Run a full analysis for your specific configuration. Get my full vendor report →

OCR Enforcement History

Three Cases. All Cited VoIP or Communications Systems.

OCR has already been penalizing VoIP-related HIPAA violations — before the 2026 rule makes encryption mandatory. After the rule takes effect, exposure increases significantly.

$480K
Lafourche Medical Group
OCR investigation found unencrypted ePHI transmitted through VoIP systems. Vendor lacked a valid BAA for the telephony platform. Settlement included corrective action plan requiring full encryption implementation.
📞 VoIP Explicitly Cited
$125K
Plastic Surgery Associates of South Dakota
Unencrypted communications channels — including voice and messaging — were found during OCR investigation following a breach. Missing subprocessor BAAs for communication vendors contributed to the penalty.
📞 Communications Cited
$240K
Yakima Valley Memorial Hospital
OCR cited failure to encrypt workforce communication channels containing ePHI. The hospital's telephony configuration lacked TLS enforcement. Corrective action required vendor replacement and encryption audit.
📞 Telephony Cited
State-Level Amplifiers

Federal Floor + State Ceiling

The 2026 HIPAA Security Rule is a federal floor. These three states have laws that exceed it — adding additional liability for healthcare organizations operating in them.

TX
Texas Health & Safety Code § 181

Texas Medical Records Privacy Act

Stricter than HIPAA on some provisions. Requires specific written authorizations for electronic health information sharing. VoIP vendors that transmit ePHI are subject to Texas AG enforcement independent of OCR action.

CA
California CMIA & CPPA

Confidentiality of Medical Information Act

California's CMIA provides private right of action — patients can sue directly. The CPPA can add additional penalties. Healthcare VoIP vendors operating in CA must address both state laws plus federal HIPAA requirements.

NY
NY SHIELD Act + NYDFS

New York Enforcement Activity

New York's AG has been actively enforcing health data security failures. NY SHIELD Act requires "reasonable" security — a bar that the 2026 HIPAA Security Rule helps define. Healthcare organizations in NY face dual enforcement risk.

Common Questions

HIPAA VoIP 2026: What You Need to Know

HHS published the NPRM on January 6, 2025. The compliance deadline is expected Q3–Q4 2026 — approximately July to October 2026 — converting previously "addressable" specifications, including VoIP encryption, to required. Covered entities should begin vendor assessments now.
Yes. Under the 2026 HIPAA Security Rule, encryption of ePHI in transit — including voice calls over VoIP networks — moves from "addressable" (optional with documentation) to "required" (no exceptions). Covered entities must use TLS 1.2+ for all ePHI-bearing VoIP traffic.
High-risk vendors include Ooma Office, Grasshopper, Avaya (legacy SIP), and unmanaged SIP trunking providers. These vendors lack signed BAAs, don't enforce end-to-end TLS encryption, and don't have documented MFA enforcement for ePHI-touching applications. Any vendor that cannot provide a BAA should be considered non-compliant immediately.
Three recent OCR settlements cited VoIP or telephony: Lafourche Medical Group ($480K — VoIP system explicitly cited), Plastic Surgery Associates of South Dakota ($125K — unencrypted communications), and Yakima Valley Memorial Hospital ($240K — workforce communication channels). These cases establish enforcement precedent before the 2026 rule even takes effect.
Yes. If your VoIP vendor processes, stores, or transmits ePHI — including voicemail, call recordings, or transcriptions — they are a Business Associate and must sign a BAA. The 2026 rule also requires the BAA to cover all subprocessors your vendor uses (AI transcription, recording storage, SMS gateways). Ask your vendor for their full subprocessor list and confirm BAA coverage for each.
📋 Free HIPAA VoIP Analysis

Find a HIPAA-Compliant VoIP Provider

Answer 15 questions about your organization and compliance needs. Get a ranked list of HIPAA-ready VoIP vendors matched to your size, use case, and 2026 readiness requirements — at zero cost.

Start My Free VoIP Analysis →
No account required • Results in under 15 minutes • Completely free
Related: General Healthcare HIPAA Compliance
Looking for the full picture on HIPAA-compliant UCaaS — not just VoIP? Our healthcare landing page covers Section 504, certification matrices, and the complete compliance checklist.
HIPAA UCaaS & Healthcare Compliance →