The HIPAA Security Rule requires covered entities and business associates that handle electronic protected health information (ePHI) to use reasonable and appropriate administrative, physical, and technical safeguards. Those safeguards must protect ePHI’s confidentiality, integrity, and availability; defend against reasonably anticipated threats and impermissible uses or disclosures; and support workforce compliance. The rule does not mandate one software product, security architecture, or checklist. Each organization must analyze its own risks, choose suitable measures, document its decisions, and keep reviewing and improving them.
Who must comply with the HIPAA Security Rule?
The Security Rule is in 45 CFR Part 160 and Subparts A and C of Part 164. It applies to three types of covered entities:
As an Amazon Associate I earn from qualifying purchases.
- Health plans
- Health care clearinghouses
- Health care providers that conduct covered electronic transactions
It also applies to business associates. A business associate is a person or organization that creates, receives, maintains, or transmits ePHI for a covered entity while performing a service or function for that entity. Examples can include claims processors, certain consultants, hosted-service providers, billing companies, and other contractors whose work involves ePHI. A business associate’s subcontractor that handles ePHI has corresponding obligations.
The rule protects ePHI: protected health information maintained in or transmitted by electronic media. Paper records and information spoken aloud are not covered by the Security Rule itself, although the Privacy Rule, Breach Notification Rule, state law, contracts, and other requirements may still apply to them. A mixed environment can therefore have different obligations: an electronic copy of a record is ePHI, while a paper copy is not within this rule’s scope solely because it contains the same information.
#1 Best Overall
What the rule is designed to protect
The Security Rule has three security objectives:
| Objective | Meaning in practice |
|---|---|
| Confidentiality | Only authorized people and systems can access or disclose ePHI. |
| Integrity | ePHI is not improperly altered or destroyed, and the organization can detect or address unauthorized changes. |
| Availability | Authorized users can access ePHI when needed for permitted work, including during disruptions. |
Organizations must protect against reasonably anticipated threats to security or integrity, reasonably anticipated uses or disclosures that are not permitted, and failures by members of the workforce to comply with security policies. The measures have to be reasonable and appropriate for the entity’s circumstances. Relevant factors include size and complexity, technical infrastructure, hardware and software, available capabilities, cost, and the probability and criticality of identified risks.
Risk analysis is the starting point
A covered entity or business associate must conduct an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. This is not a one-time inventory or a generic questionnaire. It is the factual basis for selecting and prioritizing safeguards.
What a useful risk analysis examines
- Where ePHI exists: Identify ePHI that the organization creates, receives, maintains, or transmits, including data in clinical systems, email, file stores, backups, removable media, mobile devices, applications, and hosted services.
- How it moves: Map interfaces, exports, remote access, messaging, integrations, and other transmission paths.
- Who and what can affect it: Consider workforce members, contractors, vendors, subcontractors, malicious actors, accidental users, compromised accounts, and system dependencies.
- Threats and vulnerabilities: Include human, natural, and environmental threats, as well as outdated software, poor configurations, weak authentication, excessive permissions, unavailable backups, and physical access weaknesses.
- Existing safeguards: Record controls already in place and whether they are properly configured, consistently used, and effective for the risks identified.
- Impact and likelihood: Evaluate the probability of an event and its potential effect on confidentiality, integrity, and availability so the organization can prioritize treatment.
The analysis should lead to a risk-management plan. Analysis identifies and evaluates risks; risk management implements measures that reduce them to a reasonable and appropriate level. For example, findings may support decisions about backup architecture, encryption, authentication, network segmentation, access reviews, incident detection, or transmission protections.
When to repeat or update the analysis
The Security Rule does not set a universal calendar interval. HHS describes risk analysis as foundational and ongoing. Reassess when technology, vulnerabilities, threats, facilities, vendors, workflows, mergers, or business conditions change, and when incidents reveal that assumptions or safeguards were inadequate. A documented schedule can help, but a calendar-only exercise is not enough if a major change occurs between reviews.
HHS and ASTP/ONC provide a Security Risk Assessment Tool aimed especially at small and medium-sized practices and business associates. It is a resource for organizing an assessment, not a certification and not proof that every Security Rule requirement has been met. HHS does not endorse one risk-analysis or risk-management model.
Administrative, physical, and technical safeguards
The rule groups its standards into three safeguard categories. The categories overlap operationally: a technical access control may depend on an administrative approval process and physical protection of the workstation that uses it.
Administrative safeguards
Administrative safeguards are policies, processes, and management actions that direct and support security. The required areas include:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →| Area | What the organization needs to address | Examples of evidence |
|---|---|---|
| Security management process | Risk analysis, risk management, sanctions for workforce violations, and regular review of information-system activity. | Risk register, treatment plan, sanction policy, audit-log and access-report reviews. |
| Assigned security responsibility | Name a security official or equivalent responsible role with authority to coordinate the program. | Appointment record, job description, governance minutes. |
| Workforce security and information access | Authorize, supervise, establish, and modify access according to job duties and risk. | Onboarding and termination records, role matrix, periodic access reviews. |
| Security awareness and training | Train workforce members and reinforce secure behavior appropriate to their work. | Training content, attendance, reminders, testing or acknowledgement records. |
| Security incident procedures | Identify, respond to, mitigate, and document suspected or known security incidents. | Incident plan, tickets, investigation notes, corrective actions, lessons learned. |
| Contingency planning | Prepare for emergencies that affect systems containing ePHI and restore operations appropriately. | Data-backup and disaster-recovery plans, emergency-mode procedures, test results. |
| Evaluation | Periodically assess whether the security environment and safeguards remain appropriate. | Technical and non-technical evaluations, remediation tracking, management review. |
Policies should describe responsibilities, approval paths, exceptions, retention of records, and how changes are controlled. They should be usable by the workforce rather than merely stored in a policy repository.
Physical safeguards
Physical safeguards protect facilities, workstations, and devices that can access ePHI. The standards address:
- Facility access and control: Limit physical access to systems and facilities while allowing authorized work, including procedures for visitors, repairs, emergencies, and facility changes.
- Workstation use: Define appropriate functions and physical surroundings for workstations that access ePHI.
- Workstation security: Restrict physical access to workstations and devices so unauthorized people cannot use or view them.
- Device and media controls: Govern receipt, removal, movement, disposal, and reuse of hardware and electronic media, including procedures for clearing or destroying ePHI when appropriate.
Controls can include room access restrictions, screen positioning, privacy measures, secure storage, inventory records, approved disposal processes, and protections for laptops or removable media. The correct combination depends on the risks documented by the organization.
Rank #3
Technical safeguards
Technical safeguards are technology-related controls that protect ePHI and control access to systems. The standards cover:
- Access control: Assign unique user identification where appropriate, establish emergency-access procedures, implement automatic logoff when suitable, and use encryption or decryption capabilities when appropriate.
- Audit controls: Record and examine activity in systems that contain or use ePHI so the organization can identify inappropriate access or other events.
- Integrity: Protect ePHI from improper alteration or destruction and use mechanisms that help detect unauthorized changes when appropriate.
- Person or entity authentication: Verify that a person or entity seeking access is the one claimed.
- Transmission security: Protect ePHI against unauthorized access while it is being transmitted, using measures suited to the documented risk.
The rule does not require a particular vendor, cloud architecture, authentication product, logging platform, or encryption algorithm. A technology choice should be judged by its fit to identified risk, protection of confidentiality, integrity and availability, compatibility with existing systems, auditability, workforce usability, operational burden, and cost relative to the organization’s size and capabilities.
Required versus addressable implementation specifications
“Addressable” does not mean optional. A required implementation specification must be implemented. For an addressable specification, the organization must assess whether the specification is reasonable and appropriate in its environment.
- Assess the addressable specification against the organization’s risks, capabilities, systems, and operating conditions.
- If it is reasonable and appropriate, implement it.
- If it is not reasonable and appropriate as written, document why.
- Implement an equivalent alternative measure when an alternative is reasonable and appropriate for the identified risk.
Encryption specifications are commonly discussed examples, as are several workforce and access procedures. The organization cannot simply mark encryption or another addressable item “not applicable” without an analysis and written rationale. The decision, factors considered, alternative controls, and approval should be retained with the organization’s compliance documentation.
This framework permits scalability without granting an automatic exemption. A smaller practice may use different controls from a large hospital, but both must be able to explain how their documented choices address their risks.
Recommended Free Tools
Rank #4
Does HIPAA require encryption?
The Security Rule does not impose one universal encryption configuration for every circumstance. Encryption-related specifications are addressable, so the organization must evaluate whether encryption is reasonable and appropriate for its environment and risks. If it is, the organization must implement it. If the exact specification is not reasonable and appropriate, the organization must document that conclusion and use an equivalent appropriate alternative when warranted.
A defensible decision considers where ePHI is stored, how it is transmitted, who can access it, the consequences of disclosure, available technical capabilities, operational effects, and other safeguards. “Addressable” is therefore a documented risk decision, not permission to skip encryption automatically.
Documentation and continuing evaluation
Organizations need written policies and procedures and records showing that required activities and decisions occurred. Useful documentation commonly includes:
- Current ePHI and system inventories
- Risk-analysis reports, risk registers, and risk-management plans
- Addressable-specification assessments and alternative-control rationales
- Assigned security responsibility and workforce access records
- Training, sanctions, incident, backup, and recovery records
- Audit-log and access-report review evidence
- Vendor and subcontractor agreements
- Technical and non-technical evaluation results
- Corrective-action plans, approvals, and completion records
Security measures must be reviewed and modified as needed to continue providing reasonable and appropriate protection. HHS OCR’s compliance FAQ describes the principle plainly: “Compliance is not a one-time goal, but an ongoing process.” Periodic evaluation should test not only whether a policy exists, but whether controls are configured correctly, used in practice, monitored, and updated after changes or incidents.
Business associate agreements and vendors
When a business associate creates, receives, maintains, or transmits ePHI for a covered entity, the covered entity must obtain satisfactory assurances through a business associate agreement (BAA). The agreement addresses appropriate safeguards and compliance responsibilities. A business associate must also obtain appropriate written assurances from subcontractors that handle ePHI on its behalf.
Best Value
A BAA does not replace the organization’s own risk analysis or oversight. Customers may negotiate additional documentation, security questionnaires, incident-notification terms, or audit rights when those provisions fit their risks and business needs. HIPAA does not universally require every cloud provider to furnish audit reports to every customer; what is required is an appropriate contractual assurance and safeguards consistent with the parties’ roles and documented risks.
A practical implementation sequence
- Define scope. Identify whether the organization is a covered entity, business associate, or subcontractor and list every environment where ePHI is created, received, maintained, or transmitted.
- Map data and dependencies. Document systems, interfaces, users, facilities, vendors, backups, remote access, and transmission paths.
- Perform and document the risk analysis. Evaluate threats, vulnerabilities, likelihood, impact, existing safeguards, and gaps affecting confidentiality, integrity, and availability.
- Prioritize risk management. Assign owners, deadlines, funding, and validation methods to remediation items. Address high-impact access, backup, authentication, monitoring, and transmission weaknesses first when the analysis supports that priority.
- Build administrative processes. Establish security responsibility, workforce access and training procedures, sanctions, incident handling, contingency planning, and evaluation methods.
- Implement physical and technical controls. Configure access, authentication, logging, integrity, transmission, workstation, facility, and device/media protections to match the documented risks.
- Resolve addressable specifications deliberately. Implement them when reasonable and appropriate; otherwise document the decision and adopt an equivalent alternative when appropriate.
- Control vendors. Execute BAAs where required, address subcontractors, and obtain assurances that match the services and risks.
- Test and improve. Review logs and access, exercise recovery procedures, evaluate controls, investigate incidents, and update safeguards when conditions change.
Common failure modes and how to correct them
Treating a template as the risk analysis
A generic form that does not identify the organization’s systems, data flows, threats, vulnerabilities, and existing safeguards is unlikely to be an accurate and thorough assessment. Correct it by tying every finding to a system, workflow, threat, likelihood, impact, owner, and remediation decision.
Calling addressable controls optional
Marking an item “addressable” and taking no action skips the required evaluation. Record the assessment, rationale, alternative measure, approval, and review date instead.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWriting policies that are not followed
A policy that requires quarterly access reviews, backup tests, or incident escalation is not sufficient if there is no evidence those activities occurred. Assign owners, collect records, and investigate missed activities.
Ignoring vendors and subcontractors
Unlisted hosted systems, support providers, or downstream processors can leave ePHI outside the control inventory. Add them to data-flow and risk reviews, execute appropriate agreements, and monitor changes in their services.
Assuming one annual review is always enough
The rule does not prescribe a fixed interval. A yearly review may be part of a program, but significant technology, threat, facility, workforce, or vendor changes require a timely reassessment rather than waiting for the next calendar cycle.
Current status of proposed cybersecurity changes
HHS’s Security Rule history page, last reviewed March 19, 2026, lists the January 6, 2025 “HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information” as a proposed rule. The January 25, 2013 Omnibus HIPAA Final Rule is listed as the prior final modification. On that basis, the 2025 cybersecurity text should not be presented as a current binding requirement. Rulemaking status can change, so organizations planning for future requirements should check the Federal Register and HHS before relying on the proposal.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The Bottom Line
HIPAA Security Rule compliance means continuously managing risk to ePHI through documented administrative, physical, and technical safeguards. Start with an accurate risk analysis, treat addressable specifications as decisions that require evidence, maintain appropriate workforce and vendor processes, and reevaluate protections as systems and risks change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
