Source: Eversheds Sutherland (EBG Law - Health Law Advisor)

On September 2–3, 2026, the Department of Health and Human Services’ Office for Civil Rights and the National Institute of Standards and Technology jointly hosted the Safeguarding Health Information: Building Assurance Through HIPAA Security 2026 conference. A cross-agency focus on trustworthiness in AI governance emerged from NIST, HHS offices including ONC and OCR, with governance highlighted as the foundational element for deploying and overseeing AI in health care. NIST also previewed ongoing updates to its AI Risk Management Framework, maintaining the statutory emphasis on trustworthiness as established in prior legislation.

The conference included a roundtable on cybersecurity and breach trends in health care, reporting that 92.6% of the 338 large HIPAA breaches in 2026 involved hacking incidents, primarily targeting network servers. Panelists noted a shift in cyber extortion tactics from ransomware to data exfiltration or dual-modality schemes. They further observed AI’s role in advancing malware capabilities and identifying security weaknesses. NIST presented cybersecurity tools such as the AI RMF, Cybersecurity Framework Profiles, and the RISC 2.0 Toolkit and discussed the importance of beginning to address post-quantum computing-related encryption vulnerabilities, which are expected to pose risks within the coming decade or so.