The Office of Management and Budget's 2026 Unified Agenda signals major changes to health privacy and interoperability requirements. If you're responsible for HIPAA compliance or health IT certification, the timeline is tight: HHS plans to finalize HIPAA Privacy Rule modifications and ONC deregulatory changes by August 2026, with more proposed rules arriving through December.
This checklist translates those regulatory signals into concrete preparation steps. You're working against agency timelines that may shift, but the underlying compliance gaps won't fix themselves.
What This Checklist Covers
This checklist addresses readiness for the four regulatory actions most likely to affect your organization's compliance in 2026:
- HIPAA Privacy Rule modifications affecting PHI access rights and information sharing
- ONC health IT deregulatory changes (HTI-5) affecting certification criteria
- Proposed 15-calendar-day PHI access response requirements
- Information blocking and API standards updates (HTI-6)
Each item includes the regulatory reference, the specific action required, and what satisfactory completion looks like.
Prerequisites
Before you start this checklist, confirm you have:
- Current inventory of systems processing PHI, including those subject to ONC certification requirements
- Documentation of your existing PHI access request workflows and average response times
- List of third-party vendors and business associates involved in care coordination or information exchange
- Access to your organization's HIPAA policies last updated after the January 2021 proposed rule
- Authority to convene cross-functional stakeholders (clinical operations, IT, legal, compliance)
Checklist Items
1. Map Current PHI Access Request Workflows Against 15-Day Requirement
Regulatory reference: HIPAA Privacy Rule proposed modification (expected November 2026)
Action: Document every step in your current process for responding to individual PHI access requests. Calculate the median time from request receipt to fulfillment. Identify bottlenecks that would prevent consistent 15-calendar-day responses.
What good looks like: You have a process map showing the current state, a gap analysis showing where delays occur, and initial remediation options identified. Your median response time is quantified with supporting data from the past 12 months.
2. Audit Emergency Disclosure Policies for Family and Caregiver Involvement
Regulatory reference: HIPAA Privacy Rule final rule modifications (expected August 2026)
Action: Review your policies governing PHI disclosures in emergencies. The forthcoming rule will facilitate greater family and caregiver involvement. Document where your current policies restrict such disclosures beyond what HIPAA requires.
What good looks like: You've identified specific policy language that may be more restrictive than necessary, with notes on clinical operations concerns that drove those restrictions. You're prepared to revise once the final rule clarifies new permissions.
3. Assess Care Coordination Information Sharing Agreements
Regulatory reference: HIPAA Privacy Rule final rule modifications (expected August 2026)
Action: Inventory all business associate agreements, health information exchange agreements, and care coordination arrangements. The rule aims to improve information sharing for care coordination and case management. Flag agreements with overly restrictive data sharing clauses.
What good looks like: You have a spreadsheet listing each agreement, the data types covered, current sharing restrictions, and whether the agreement allows amendment for regulatory changes. You've identified which agreements need renegotiation.
4. Review ONC Certification Status and Deregulatory Impact
Regulatory reference: HTI-5 final rule (expected August 2026)
Action: If you're a health IT developer or use certified health IT, review the December 29, 2025, HTI-5 proposed rule. Identify which certification criteria may be eliminated or modified. Assess whether your current certification approach depends on criteria likely to be removed.
What good looks like: You've documented which ONC certification requirements apply to your systems, which are proposed for elimination, and whether deregulation creates new compliance risks. You have a plan to update internal documentation.
5. Prepare for Information Blocking Requirement Updates
Regulatory reference: HTI-6 proposed rule (expected November 2026)
Action: Review your current information blocking risk assessment and exception documentation. ONC will propose updates to information blocking regulations. Document practices that currently rely on specific exception interpretations.
What good looks like: You have a written summary of each information blocking exception you invoke, the business justification, and the specific regulatory language you rely on. You're positioned to reassess when HTI-6 clarifies or modifies those exceptions.
6. Evaluate API Implementation Against Expanded Use Cases
Regulatory reference: HTI-6 proposed rule (expected November 2026)
Action: If you operate APIs for health information exchange, assess your current implementation against the likelihood of expanded certification requirements. Document technical debt, security gaps, or functionality limitations that would complicate expanded API use.
What good looks like: You've completed a technical assessment showing current API capabilities, security controls, and gaps relative to FHIR standards. You have preliminary cost and timeline estimates for API enhancements.
7. Update HIPAA Administrative Simplification Transaction Standards
Regulatory reference: CMS proposed rule for X12 standards updates (expected December 2026)
Action: If you process electronic health care claims or remittance advice transactions, identify systems using X12 Version 5010. CMS will propose replacing this with an updated version. Engage your clearinghouse vendors and trading partners to assess readiness.
What good looks like: You've confirmed which systems use X12 5010, identified vendor dependencies, and established a communication channel with key trading partners. You have a preliminary migration plan template ready to populate once the proposed rule specifies the new version.
8. Conduct Cross-Functional Readiness Assessment
Action: Convene representatives from clinical operations, health information management, IT, legal, and compliance. Review this checklist's findings collectively. Identify resource constraints, conflicting priorities, and dependencies.
What good looks like: You've held a readiness meeting with documented attendance, identified three critical path items that require executive sponsorship, and assigned ownership for monitoring each regulatory action's progression. You have a communication plan for updates.
Common Mistakes
Waiting for final rules to start preparation. By the time the August 2026 final rules publish, you'll have weeks to achieve compliance, not months. Organizations that begin gap assessments now will have time to remediate; those who wait will scramble.
Treating this as a compliance-only exercise. The HIPAA Privacy Rule changes aim to reduce administrative burdens and improve care coordination. If you frame preparation purely as risk mitigation, you'll miss opportunities to streamline operations and improve patient engagement.
Ignoring vendor dependencies. Your PHI access workflow, X12 transaction processing, and API functionality likely depend on third-party systems. Vendors won't prioritize your requests unless you engage early. Map those dependencies now.
Assuming deregulation means less work. ONC's deregulatory actions may eliminate certification requirements, but they don't eliminate the underlying security and interoperability obligations. You'll need to reassess how you demonstrate compliance when prescriptive criteria disappear.
Next Steps
Set quarterly checkpoints to review the OMB Unified Agenda for updated timelines. Assign one person to monitor the Federal Register for each of the four regulatory actions listed above. When proposed rules publish, you'll have 60-90 days to submit comments; use that window to refine your gap analysis with rule-specific details.
Don't wait for August 2026 to discover your PHI access process can't meet a 15-day requirement or your care coordination agreements block information sharing the new rule permits. The organizations that treat regulatory signals as preparation triggers, not just compliance deadlines, will implement changes smoothly while others rush incomplete solutions into production.
