HIPAA Compliance in Pennsylvania: A 2026 Guide for Practices
HIPAA Compliance in Pennsylvania: What Your Practice Needs to Know
If you run a medical, dental, or behavioral health practice in Pennsylvania, you're now working under two sets of rules that overlap: the federal HIPAA regulations that apply everywhere, and Pennsylvania's own breach notification law, which the state tightened significantly in 2024. Getting one right and ignoring the other leaves a gap that regulators, and plaintiffs' attorneys, can walk right through.
This guide covers what HIPAA actually requires, how Pennsylvania's amended breach law changes your obligations, where enforcement is heading, and a practical checklist you can act on.
The two layers of compliance you're dealing with
HIPAA is the federal baseline. It applies to covered entities (providers, health plans, clearinghouses) and their business associates, and it doesn't change based on which state you practice in. Its three core rules are the Privacy Rule (how protected health information can be used and disclosed), the Security Rule (safeguards for electronic PHI), and the Breach Notification Rule (what you do after a breach).
Pennsylvania adds a second layer through the Breach of Personal Information Notification Act. State breach law runs in parallel with HIPAA rather than replacing it, so a single incident involving patient records can trigger both federal and state notification duties at the same time, often on different timelines and to different authorities.
What changed in Pennsylvania in 2024
Pennsylvania overhauled its breach notification statute in 2024, and the changes matter for any organization holding data on state residents. The Breach of Personal Information Notification Act was amended by Senate Bill 824 and was signed into law by state Governor Josh Shapiro on June 28, 2024. The law goes into effect on September 26, 2024.
Here are the practical shifts:
Attorney General notification. SB 824 now requires organizations impacted by a data breach to furnish notice to the PA Attorney General.
A lower threshold for notifying credit reporting agencies. The PA Notification Act previously required organizations to furnish notice of a data breach to consumer reporting agencies when more than 1,000 individuals were affected by the breach at one time; SB 824 changed this notification threshold from 1,000 individuals to 500 individuals.
Mandatory credit monitoring in certain cases. The most important change for Pennsylvania residents is the legal requirement for a breached entity to provide credit monitoring services for 12 months, under certain circumstances. An entity may satisfy this requirement by providing notice to the individual of the availability of monitoring services for a period of 12 months at no cost to the individual.
A narrower definition of personal information. The amendment changes the term "medical information" to "medical information in the possession of a state agency or state agency contractor." More broadly, the amended law introduces a new definition of personal information, expanded access to credit reporting, a credit monitoring mandate for most data breaches, and new notification requirements.
The takeaway: after a reportable incident, a Pennsylvania practice may need to notify affected patients, the state Attorney General, consumer reporting agencies, and (under HIPAA) the HHS Office for Civil Rights. Your breach response plan should map all of these, not just the federal ones.
The federal picture is getting stricter too
For years, parts of the HIPAA Security Rule were flexible. Safeguards labeled "addressable" let organizations decide whether a control was reasonable for them, and risk analysis was expected "periodically" without a hard schedule. That flexibility is on its way out.
In early 2025, HHS proposed the first major overhaul of the Security Rule since 2013. The proposal removes the word "addressable" from the rule, ending an era in which "addressable" specifications let organizations document their way around controls like encryption and MFA, and "periodic" risk analysis meant whenever you got around to it.
The proposed requirements would make several controls mandatory rather than optional. These include mandatory encryption of ePHI at rest and in transit with limited exceptions, multi-factor authentication for systems accessing ePHI, and a defined testing schedule. Reporting from compliance analysts describes the proposed package as also including annual penetration testing and vulnerability scanning on a set cadence.
These changes are proposed, not yet final, so treat them as the clear direction of travel rather than current law. If your practice adopts encryption, MFA, and a real testing schedule now, you'll be ahead of the rule instead of scrambling when it's finalized.
Enforcement is aimed squarely at risk analysis
If you do one thing this year, do a proper security risk analysis. OCR has made it the centerpiece of a dedicated enforcement push. The first front of OCR's efforts is being waged around the HIPAA Security Rule, which requires covered entities and business associates to perform security risk analyses.
The penalties are real and reach small organizations. One action was the first under OCR's new risk analysis enforcement initiative and involved a $90,000 financial penalty and the adoption of a corrective action plan for Bryan County Ambulance Authority in Oklahoma. OCR collected more than $7 million in HIPAA fines during that year, more than the total fines collected in 2022 and 2023 combined. Other settlements under the same initiative have included penalties such as Northeast Radiology agreeing to pay $350,000, the 6th financial penalty imposed under OCR's risk analysis enforcement initiative.
A risk analysis isn't a checkbox or a one-page attestation. It's a documented, current assessment of where ePHI lives across your systems, what could go wrong, and what you're doing about each identified risk. A risk assessment from eighteen months ago that doesn't reflect your current setup is exactly what OCR has been penalizing.
What a breach actually costs
The financial case for prevention is straightforward. Healthcare consistently records the highest breach costs of any industry. Healthcare data breach costs fell 10.6% year over year, from $10.93 million in 2023 to $9.77 million in 2024, but that reduction was not enough for healthcare to lose its place at the top. On a per-record basis, healthcare breach cost per record ran to roughly $408 versus a global average near $148.
Those figures are averages skewed by large enterprises, so a small practice won't face a ten-million-dollar bill. But the components that drive the number, patient notification, credit monitoring, forensic investigation, legal exposure, and lost trust, scale down to your practice too. Pennsylvania's new credit monitoring mandate adds a direct, quantifiable cost to any qualifying breach.
A HIPAA compliance checklist for Pennsylvania practices
Use this as a working list, not a finish line. Compliance is an ongoing process.
- Complete a current security risk analysis. Inventory every place ePHI is created, stored, and transmitted, then document risks and your response to each. Update it after any significant change to your systems.
- Encrypt ePHI at rest and in transit. This is already best practice and is heading toward being mandatory. Cover laptops, servers, backups, and email.
- Turn on multi-factor authentication for any system that touches patient data, including your EHR and remote access.
- Review your Business Associate Agreements. Every vendor that handles PHI (billing companies, IT providers, cloud services) needs a current, signed BAA.
- Update your breach response plan for Pennsylvania. Build in notification to affected patients, the HHS Office for Civil Rights, the PA Attorney General, consumer reporting agencies at the 500-individual threshold, and the 12-month credit monitoring requirement where it applies.
- Run vulnerability and network scans. Regular scanning surfaces the misconfigured servers and unpatched systems that show up repeatedly in enforcement actions.
- Train your staff and document it. Phishing and human error drive a large share of breaches. Keep dated records of who was trained and when.
- Keep written policies current and provably in use. Regulators increasingly want proof the controls run, not just a binder of policies.
Where outside help makes sense
Most Pennsylvania practices don't have a security specialist on staff, and they shouldn't have to. The technical parts of compliance, vulnerability scanning, network scans, testing whether your safeguards actually work, are where practices most often fall short, precisely because they require expertise a clinical team isn't expected to have.
This is where an in-person assessment is worth more than a self-service questionnaire. PolySec performs on-site HIPAA security risk assessments built for healthcare: vulnerability and network scanning, policy and BAA review, an audit-ready findings report, and a remediation roadmap with ongoing support so gaps actually get closed. The model is designed for practices that want the assessment-to-remediation work handled by specialists while they stay focused on patient care.
Frequently asked questions
Does HIPAA or Pennsylvania law take priority? They work together. HIPAA sets the federal floor and Pennsylvania's Breach of Personal Information Notification Act adds state-specific duties. When both apply, you comply with both, which usually means the stricter or more specific requirement governs each obligation.
Do I have to notify the Pennsylvania Attorney General after a breach? Under the 2024 amendment, yes. SB 824 requires organizations impacted by a data breach to furnish notice to the PA Attorney General. Confirm the specific timing and content requirements for your situation, ideally with counsel.
When do I have to offer credit monitoring? The amended law requires it under certain circumstances. An entity can satisfy the requirement by notifying the individual of the availability of monitoring services for a period of 12 months at no cost to the individual. Whether it's triggered depends on the type of data involved, so review each incident against the statute.
How often should I do a HIPAA risk analysis? At minimum annually, and again after any major change to your systems, vendors, or facilities. Given OCR's enforcement focus on risk analysis and the proposed shift away from vague "periodic" language, a stale assessment is one of the riskiest gaps a practice can have.
Are the new federal Security Rule requirements in effect yet? Not yet. HHS proposed the overhaul in early 2025, and it removes the "addressable" flexibility around controls like encryption and MFA, but it hasn't been finalized. Treat it as the clear direction of federal policy and start adopting those controls now.
The bottom line
Pennsylvania practices face a moving target: HIPAA is getting more prescriptive, the state raised the stakes on breach response in 2024, and OCR is actively fining organizations that skip a real risk analysis. The good news is that the same handful of actions, a current risk analysis, encryption, MFA, tight vendor agreements, and a Pennsylvania-aware breach plan, address most of the exposure. Start with the risk analysis. Everything else follows from knowing where your gaps actually are.
Stories and Helpful Content
