The 2026 HIPAA Security Rule updates will make encryption of all electronic protected health information (ePHI) at rest and in transit mandatory, ending the long-standing 'addressable' flexibility.