Recommended Free Tools
Electronic health record (EHR) systems protect patient information through layers of organizational, physical, and technical safeguards—not through one feature or a “HIPAA-certified” label. Under the HIPAA Security Rule, covered organizations and their business associates must use reasonable and appropriate safeguards for electronic protected health information (ePHI), guided by the risks to their systems.
How is my health information protected?
The HIPAA Security Rule aims to protect three things: confidentiality, integrity, and availability. In practical terms, that means preventing unauthorized access or disclosure, guarding against improper alteration or destruction, and keeping information accessible to authorized users when needed. The Security Rule applies to ePHI and works alongside HIPAA’s Privacy Rule and Breach Notification Rule. HHS explains the current framework in its Security Rule summary.
As an Amazon Associate I earn from qualifying purchases.
HHS describes the rule as “flexible, scalable, and technology neutral.” It does not prescribe one EHR product or identical setup for every organization. Instead, the safeguards should fit the organization’s size, capabilities, infrastructure, costs, and risks to ePHI. A clinic’s precise controls can therefore differ from those of a large hospital, while both remain responsible for meeting applicable requirements.
What safeguards protect electronic medical records?
Protection is a combination of policies, people, facilities, and system controls. Risk analysis helps an organization decide which safeguards are appropriate and whether they are working.
#1 Best Overall
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Hardbound Composition Book. Section sewn, so the book lies flat when open.
- Composition Book title on the spine with a blank space for you to fill in your own title. Inside the front cover has spaces for your personal information
- 100 Pages - Page Dimensions: 8.5" X 11"
- Reorder SKU: LOG-120-7CS-A(Patient_Narcotics)
Risk analysis and ongoing risk management
Organizations assess where ePHI is created, received, stored, maintained, or transmitted; identify relevant threats and vulnerabilities; review existing safeguards; and use those findings to decide how to reduce risk. HHS calls risk analysis foundational to the Security Rule. Risk analysis identifies and assesses risks; risk management implements measures to reduce them. Organizations also need to revisit risks and evaluate safeguards periodically. See HHS’s Guidance on Risk Analysis.
Access limits and identity checks
Policies and technical controls should authorize access appropriate to a person’s role and verify the identity of someone seeking access. In practice, access should be limited to workforce members who are authorized to use the information for their work. The exact roles, permissions, and authentication methods vary by organization; HIPAA does not mean that every EHR uses the same access design.
Audit controls
Systems need mechanisms to record and examine activity involving ePHI. Reviewing those records can help an organization understand system use and investigate possible incidents. Audit logs are a detection and review tool, not a guarantee that every inappropriate access attempt will be noticed or stopped.
Workforce and physical safeguards
Organizations are responsible for appropriate workforce authorization and supervision, security awareness and training, policies, and responses to violations. Physical safeguards can include controlling access to facilities and systems, setting secure workstation practices, and managing hardware and electronic media that contain ePHI. That includes appropriate disposal and removing ePHI before media are reused.
Integrity, backups, and recovery
Safeguards also address improper alteration or destruction and prepare for emergencies. HHS describes contingency planning that includes backing up ePHI, restoring lost data, and continuing critical operations in emergency mode. Backups and recovery planning support availability; they do not, by themselves, prevent unauthorized disclosure.
Encryption and secure transmission
HHS identifies encryption as a safeguard to use when reasonable and appropriate under the current framework. Encryption can help protect information stored on systems or transmitted between them, but it is one part of a broader program—not a promise that information cannot be exposed.
Rank #3
Incident response and improvement
Organizations need processes to identify and respond to suspected or known security incidents, mitigate effects where possible, document outcomes, and evaluate safeguards over time. HHS’s January 2026 Security Rule guidance and resources newsletter notes that hardening measures and security baselines require ongoing review as threats and vulnerabilities change.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Who can see my electronic medical records?
Access depends on the organization’s policies and system permissions. The Security Rule calls for identity verification and access controls, while workforce authorization and supervision help determine who may use ePHI and for what work. These safeguards are intended to restrict access to authorized users, but the specific setup differs among organizations.
Audit controls provide a way to record and examine system activity. They can support reviews and incident investigations, but they should not be mistaken for a guarantee that every improper access will be caught. If you have a concern about access to your records, contact the provider or health plan that maintains them and ask how to raise a privacy or security concern.
Rank #4
Can a doctor’s office or EHR vendor share my records?
HIPAA regulates how covered entities and business associates handle protected health information; it does not mean that information can never be shared. The Security Rule focuses on ePHI safeguards, while HIPAA’s Privacy Rule and other applicable requirements govern permitted uses and disclosures. The details depend on the organization and circumstances, so a security safeguard should not be read as a blanket rule about whether a particular disclosure is allowed.
An EHR or cloud provider handling ePHI for a covered organization may be a business associate. HHS says a covered entity or business associate must have a business associate agreement (BAA) with a cloud service provider acting as a business associate, including satisfactory assurances that PHI will be safeguarded. Business associates are directly subject to applicable Security Rule requirements. HHS’s cloud service provider FAQ also explains that HIPAA does not expressly require a cloud provider to supply security documentation or allow customer audits. A customer may seek additional assurances, such as documentation of safeguards or audit rights, through contract or other documentation based on its risk analysis. A BAA sets obligations; it is not independent proof that a vendor is secure.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesDoes HIPAA cover health apps?
Not necessarily. HIPAA applies to covered entities—health plans, healthcare clearinghouses, and qualifying healthcare providers—and to business associates in applicable circumstances. Some consumer health apps and companies are not covered entities or business associates, so they may fall outside HIPAA’s coverage. HHS notes that obligations under the FTC Act can still apply to companies outside HIPAA. Its health app guidance explains the distinction.
Best Value
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
The Security Rule’s scope is electronic PHI. HHS says it does not apply to PHI maintained or transmitted on paper or verbally, although other HIPAA rules may apply. Whether a particular app or service is covered depends on its role and relationship to a regulated organization; the fact that an app contains health information alone does not establish that HIPAA applies.
What is current, and what has HHS proposed?
HHS issued a Notice of Proposed Rulemaking on December 27, 2024, to modify the HIPAA Security Rule. Its NPRM fact sheet lists proposed provisions that include more detailed risk analysis, annual compliance audits, encryption at rest and in transit with limited exceptions, multi-factor authentication with limited exceptions, vulnerability scanning at least every six months, penetration testing at least annually, network segmentation, backup and recovery controls, and specified security configuration measures.
Those are proposals in the NPRM, not evidence that these new prescriptive requirements are final current rules. HHS’s separate summary of the Security Rule currently in effect describes the existing framework. Requirements can change, so organizations should consult current HHS materials and applicable legal advice when making compliance decisions.
What this means for patients
HIPAA’s framework requires organizations to manage ePHI risks with safeguards suited to their circumstances. It does not certify a particular EHR as breach-proof, and no single measure—encryption, logs, a vendor contract, or backups—does that on its own. A specific provider’s configuration and a specific vendor’s performance cannot be inferred from the general rule.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
