The U.S. Department of Health and Human Services has finalized new standards under the Administrative Simplification provisions of the Health Insurance Portability and Accountability Act (HIPAA) governing electronic health care claims attachments and the electronic signatures used with them. The final rule was published in the Federal Register on March 24, 2026 and became effective on May 26, 2026. Because the effective date has now passed, covered entities and their business associates should already be evaluating their compliance posture and identifying any remaining gaps in their workflows.
The rule adopts a standard for health care claims attachments transactions, addressing a long-standing area of the Administrative Simplification framework that had not previously been subject to a uniform federal standard. In tandem, the rule adopts a standard for electronic signatures to be used in conjunction with those attachments. Together, these standards are intended to promote consistency, interoperability, and reliability in the exchange of supporting documentation that accompanies health care claims, while reinforcing the integrity of signatures associated with that documentation.
Health care providers, health plans, and clearinghouses are the principal stakeholders affected, although the practical impact will extend to the business associates and technology vendors that support claims processing on their behalf. Entities should consider undertaking a focused review of existing claims attachment workflows to confirm that the systems used to generate, transmit, and receive attachments align with the newly adopted standard. A parallel assessment of electronic signature processes is also advisable, with attention to how signatures are captured, applied, and validated within the attachment workflow.
In addition to internal system reviews, organizations should examine vendor contracts and service agreements to confirm that their counterparties are positioned to support the new standards. Where appropriate, amendments may be needed to allocate responsibility for ongoing compliance, address testing obligations, and clarify remediation expectations. Internal policies, training materials, and documentation practices may likewise warrant updates so that staff understand the operational changes and any associated recordkeeping requirements.
This update is provided for general informational purposes and does not constitute legal advice. Clients with questions about how these standards apply to their specific operations, contracts, or compliance programs should consult counsel for tailored guidance.