Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The HIPAA Security Rule requires covered entities and business associates that handle electronic protected health information (ePHI) to use reasonable and appropriate administrative, physical, and technical safeguards. Those safeguards must protect ePHI’s confidentiality, integrity, and availability, address reasonably anticipated threats and impermissible uses or disclosures, and be supported by risk analysis, written procedures, workforce controls, incident response, documentation, and continuing evaluation.
Who must comply with the HIPAA Security Rule?
The Security Rule appears in 45 CFR Part 160 and Subparts A and C of Part 164. It applies to HIPAA covered entities:
- Health plans
- Health care clearinghouses
- Covered health care providers
It also applies to business associates that create, receive, maintain, or transmit ePHI for a covered entity. A technology company, billing service, claims processor, consultant, or other contractor can be a business associate when its work involves ePHI, even if it does not provide health care itself.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The rule protects electronic protected health information: individually identifiable health information that a covered entity or business associate maintains or transmits in electronic media. Paper records and spoken conversations are not governed by the Security Rule itself, although the HIPAA Privacy Rule and other requirements may still apply to them. An organization should therefore map both electronic and non-electronic information, then apply the correct HIPAA requirements to each.
#1 Best Overall
What the rule is designed to protect
Security Rule safeguards serve three security goals:
- Confidentiality: ePHI is not disclosed or made available to people who are not permitted to see it.
- Integrity: ePHI is not improperly altered or destroyed.
- Availability: authorized users can access ePHI when it is needed for care, operations, and other permitted purposes.
The rule also requires protection against reasonably anticipated threats to the security or integrity of ePHI, impermissible uses and disclosures, and workforce actions that violate security policies.
HIPAA does not prescribe one universal product, network design, encryption vendor, or authentication method. Measures must be reasonable and appropriate for the organization’s size, complexity, capabilities, technical infrastructure, hardware and software, implementation cost, and the probability and criticality of identified risks. A rural clinic and a national health plan can meet the same standards with different controls if their documented risk decisions are sound.
Risk analysis is the starting point—and an ongoing activity
A covered entity or business associate must perform an “accurate and thorough assessment” of potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI. The analysis is not a checklist that can be completed once and filed away. It is the foundation for deciding which safeguards to implement and how strong they need to be.
What a thorough analysis examines
A useful analysis should, at minimum, establish:
- Where the organization creates, receives, maintains, or transmits ePHI
- Which applications, databases, endpoints, cloud services, medical devices, removable media, and networks handle it
- Which internal users, privileged administrators, contractors, patients, and external organizations can access it
- Vendors and other external sources that introduce threats or dependencies
- Human, natural, and environmental threats, such as phishing, malware, insider misuse, power loss, fire, flood, and equipment failure
- Existing safeguards, including whether they are correctly configured, consistently used, and monitored
- The likelihood and potential impact of each relevant threat or vulnerability
The result should identify risks that need treatment and explain priorities. For example, the analysis may lead an organization to strengthen backups, encrypt laptops, add multifactor authentication, restrict administrator privileges, improve transmission security, or segment systems containing ePHI.
Analysis versus risk management
These terms describe different work. Risk analysis identifies and evaluates risks. Risk management implements measures that reduce those risks to a reasonable and appropriate level, then verifies that the measures continue to work. Recording a vulnerability without deciding how to address it is not a complete risk-management program.
When to revisit the analysis
HIPAA does not set a single required calendar interval. Reassessment should occur when technology, threats, vulnerabilities, facilities, vendors, services, or business conditions change, and after events that reveal weaknesses. Organizations should also set a recurring review schedule appropriate to their environment. HHS and the Administration for Strategic Preparedness and Response (ASTP)/Office of the National Coordinator for Health Information Technology (ONC) provide a Security Risk Assessment Tool for small and medium-sized practices and business associates. HHS describes it as a resource, not a certification or proof that every Security Rule requirement has been met, and does not endorse one risk-analysis or risk-management model.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHow the safeguards are organized
The Security Rule divides its standards into administrative, physical, and technical safeguards. The categories overlap in practice: a technical access control needs an administrative policy, trained users, and physical protection of the devices that run it.
| Safeguard category | What it addresses | Typical decisions driven by the risk analysis |
|---|---|---|
| Administrative | Policies, assigned responsibility, workforce practices, incident handling, contingency planning, and evaluation | Who approves access, how staff are trained, how incidents are escalated, and how recovery priorities are set |
| Physical | Facilities, workstations, devices, and media | Entry controls, workstation placement, equipment disposal, and protection of portable devices |
| Technical | Electronic access, auditability, integrity, authentication, and transmission | Accounts, logging, verification methods, safeguards against alteration, and protected data flows |
Administrative safeguards
Administrative safeguards are the management processes that establish and maintain security. Required areas include:
Security management process
The organization must conduct risk analysis, implement risk management, apply sanctions for workforce violations, and regularly review information-system activity such as audit logs and access reports. Reviews should be meaningful: identify unusual access, investigate findings, and record corrective actions rather than merely generate reports.
Assigned security responsibility
A designated security official or equivalent accountable role must coordinate the program. The assignment should include authority, resources, escalation rights, and responsibility for tracking remediation, not just a title in a policy document.
Free tools Windows power users keep installed
One-click scans. No signup required.
Workforce security and information access
Organizations need procedures for authorizing, establishing, modifying, and ending access. Hiring, role changes, leave, termination, temporary assignments, and contractor access should trigger documented decisions. Access should match job duties, with privileged access limited and reviewed.
Rank #3
Security awareness and training
Training should cover the threats and procedures relevant to the workforce, such as phishing, passwords, authentication devices, malware, reporting channels, workstation security, and handling of portable media. Refresher training and targeted instruction after incidents or major system changes help keep procedures usable.
Security incident procedures
Incident procedures should define how personnel report suspected events, how the organization contains and investigates them, who decides whether ePHI was affected, how evidence is preserved, and how recovery and corrective action are coordinated. Security Rule incident handling must fit with the organization’s broader HIPAA breach-response and notification obligations.
Contingency planning
Plans should address data backup, disaster recovery, emergency-mode operation, testing and revision, and the criticality of applications and data. The correct recovery point and recovery time depend on clinical and operational needs documented in the risk analysis. A backup that cannot be restored is not an effective availability safeguard.
Recommended Free Tools
Periodic evaluation
Organizations must evaluate whether their security policies and safeguards remain reasonable and appropriate. Evaluations can be technical, such as vulnerability testing or configuration review, and non-technical, such as policy review, interviews, walkthroughs, and training checks. Findings should lead to tracked remediation and updated documentation.
Physical safeguards
Physical standards address the places and equipment through which ePHI can be accessed. They include:
- Facility access and control: limit physical access to systems and facilities while allowing authorized work and emergency response.
- Workstation use: specify how workstations may be used and where they may be located so screens, conversations, and printed output are not unnecessarily exposed.
- Workstation security: protect workstations from unauthorized physical access.
- Device and media controls: govern receipt, removal, movement, reuse, and disposal of hardware and electronic media containing ePHI.
Controls may include locked areas, visitor procedures, privacy positioning, screen locking, asset inventories, secure transport, media sanitization, and documented disposal. The appropriate combination depends on whether the equipment is in a controlled data center, a clinic, a home office, or a mobile setting.
Rank #4
Technical safeguards
Technical standards focus on technology that controls and records electronic access:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Access control
Systems should grant access only to users or processes that need ePHI. Organizations commonly implement unique user identification, emergency access procedures, automatic logoff where appropriate, and encryption or decryption mechanisms when the risk analysis supports them.
Audit controls
Information systems containing or using ePHI must record and examine activity sufficiently to detect inappropriate access and support investigations. Logging without retention, review, alerting, or a response process leaves a major gap between collecting data and using it for security.
Integrity
Measures must protect ePHI from improper alteration or destruction and help detect changes that should not have occurred. Examples can include access restrictions, change controls, validation, checks, and reliable backup and restoration processes selected for the identified risks.
Person or entity authentication
Before granting access, a system must verify that a user or other entity is the one claimed. Passwords, tokens, certificates, biometrics, and multifactor combinations are possible approaches. The rule does not mandate one factor count in every situation; the organization must select an appropriate method and document its reasoning.
Transmission security
Organizations must protect ePHI while it is being transmitted over electronic communications networks. The analysis should consider email, application interfaces, remote access, vendor connections, messaging, and other data flows, then select protections against interception and unauthorized access.
Best Value
Required and addressable specifications: is addressable optional?
No. A required implementation specification must be implemented. An addressable specification requires a documented decision process:
- Assess whether the specification is reasonable and appropriate in the organization’s environment.
- If it is reasonable and appropriate, implement it.
- If it is not, document why that conclusion is justified by the organization’s circumstances and risk analysis.
- Implement an equivalent alternative measure when an alternative is reasonable and appropriate for addressing the identified risk.
Encryption specifications are examples of addressable specifications, as are several workforce and access procedures. “Addressable” does not create a blanket exemption and does not mean an organization may ignore the issue. A decision not to use a particular control should identify the risk, explain the feasibility or appropriateness problem, describe any alternative, and be approved and maintained with the rest of the security documentation.
Documentation and proof of continuing compliance
Written policies and procedures should describe how the organization meets its standards, who is responsible, how exceptions are handled, and how changes are approved. Keep records of risk analyses, risk-management decisions, access reviews, training, sanctions, incident investigations, contingency tests, evaluations, system reviews, and addressable-specification decisions.
Documentation is not a substitute for functioning safeguards. During an assessment, an organization should be able to connect a documented risk to an implemented control, show that the control is operating, and demonstrate how deficiencies are corrected. HHS OCR’s compliance guidance describes compliance as “not a one-time goal, but an ongoing process.” Security measures must be reviewed and modified as needed to continue providing reasonable and appropriate protection.
Business associates, subcontractors, and agreements
When a business associate handles ePHI for a covered entity, the covered entity must obtain satisfactory assurances through a business associate agreement (BAA). The agreement addresses appropriate safeguards and the business associate’s compliance responsibilities. A business associate must also obtain appropriate written assurances from subcontractors that handle ePHI on its behalf.
A BAA does not replace the parties’ risk analysis or technical due diligence. Customers may negotiate additional documentation, security questionnaires, assessment rights, or audit rights when those terms are appropriate to their risks and services. HIPAA does not universally require every cloud provider to furnish a particular audit report to every customer; the agreement and risk-based diligence should define what evidence is needed.
A practical implementation sequence
- Define the environment: identify covered-entity or business-associate status, ePHI locations, systems, users, vendors, and data flows.
- Perform and record the risk analysis: assess threats, vulnerabilities, existing controls, likelihood, and impact.
- Prioritize risk management: assign owners, deadlines, resources, and acceptance criteria for corrective actions.
- Build the administrative foundation: approve policies, designate security responsibility, set workforce access and sanction procedures, and establish incident and contingency plans.
- Implement physical and technical controls: configure access, authentication, logging, transmission protections, backups, workstation controls, and device/media processes to match documented risks.
- Train and exercise: train the workforce, test incident and recovery procedures, and correct failures found during exercises.
- Evaluate and update: review logs and access reports, test safeguards, reassess after changes or incidents, and maintain evidence of decisions and remediation.
- Manage vendors: execute BAAs where required, assess subcontractors, and monitor services that create, receive, maintain, or transmit ePHI.
Common mistakes to avoid
- Treating a risk-analysis template as proof that every risk was assessed or every safeguard works
- Calling an addressable specification optional without documenting the decision and an appropriate alternative when needed
- Buying encryption or authentication technology without defining who uses it, how it is configured, and how failures are handled
- Reviewing policies annually while ignoring access logs, system changes, incidents, and vendor changes
- Leaving terminated or transferred workers’ access active
- Relying on backups that are neither isolated from the threat nor tested for restoration
- Assuming a BAA alone proves that a vendor’s service protects ePHI
- Confusing protection of electronic records under the Security Rule with complete HIPAA compliance for paper, verbal, privacy, or breach-notification matters
What is the current status of proposed Security Rule changes?
HHS’s Security Rule history page, last reviewed March 19, 2026, lists the January 6, 2025 “HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information” as a proposed rule. The page lists the January 25, 2013 Omnibus HIPAA Final Rule as the prior final modification. On that status information, the 2025 cybersecurity text should not be presented as a current binding requirement. Rulemaking status can change, so organizations preparing for publication or compliance decisions should check the Federal Register and HHS’s current materials for updates.
Bottom line for compliance teams
The HIPAA Security Rule is a risk-based, continuing security program—not a one-time certification or a fixed technology shopping list. Covered entities and business associates must know where ePHI is, analyze threats and vulnerabilities, select and operate administrative, physical, and technical safeguards, document required and addressable decisions, control workforce and vendor access, prepare for incidents and outages, and evaluate the program as conditions change. The strongest evidence of compliance is a consistent chain from identified risk to implemented control, tested operation, documented review, and timely correction.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
