What does healthcare data security require under the HIPAA Security Rule?

In the United States, healthcare data security is governed largely by the HIPAA Security Rule. It requires covered entities and business associates to protect electronic protected health information (ePHI) through administrative, physical (164.310) and technical safeguards, starting with a risk analysis. The rule sets outcomes; it does not name specific products.

Who must comply, and with what?

The Security Rule is in the US Code of Federal Regulations at 45 CFR Part 164, subpart C. Sections 164.308 (administrative safeguards) and 164.312 (technical safeguards) apply to a covered entity or business associate. Section 164.308(b) extends the duty down the chain: a business associate may let a subcontractor handle ePHI only with satisfactory assurances, documented in a written contract or other arrangement.

Each requirement is either Required or Addressable. Addressable does not mean optional. Section 164.306(d) says you assess whether the measure is reasonable and appropriate. If it is, implement it. If not, document why and implement an equivalent alternative if that is reasonable. Section 164.306(b) lets you weigh your size and complexity, your technical capabilities, the cost of the measure and the probability and criticality of the risk.

What do the administrative safeguards require?

The regulation text (read from the eCFR) includes these items, among others:

• Risk analysis (Required). An accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI.
• Risk management (Required). Security measures sufficient to reduce those risks to a reasonable and appropriate level.
• Sanction policy and activity review (Required). Penalties for staff who break policy, and regular review of audit logs, access reports and incident tracking reports.
• Workforce security. Authorization or supervision, clearance procedures and termination procedures (all Addressable) so that people who leave lose access.
• Information access management. Policies for granting, establishing and modifying access.
• Security awareness and training, including malware protection, login monitoring and password management as addressable items.
• Incident procedures (Required). Identify and respond to suspected or known incidents, mitigate harm and document outcomes.
• Contingency plan. A data backup plan, a disaster recovery plan and an emergency mode operation plan are Required. Testing and criticality analysis are Addressable.
• Evaluation. Periodic technical and nontechnical review of whether your policies meet the rule.

What do the technical safeguards require?

Section 164.312 covers five standards:

• Access control: unique user identification and an emergency access procedure are Required. Automatic logoff and encryption and decryption of ePHI are Addressable.
• Audit controls: mechanisms that record and examine activity in systems that contain or use ePHI.
• Integrity: protect ePHI from improper alteration or destruction, with an addressable mechanism to corroborate that it was not altered.
• Person or entity authentication: verify that whoever seeks access is the one claimed.
• Transmission security: guard against unauthorized access to ePHI in transit, with addressable integrity controls and encryption.

A constructed example

A small clinic's billing vendor stores appointment and claims data in a cloud application. The clinic runs a risk analysis and finds three gaps: shared logins at the front desk, no logging of who opens a record, and unencrypted laptop backups. The fixes map straight to the regulation: unique user IDs, audit controls and encryption (an addressable item it decides to implement). It also checks that the billing vendor has a business associate contract and asks the vendor how it handles its own subcontractors.

What does the rule not say?

It does not prescribe a framework, a tool or a password length. It also does not list a certification you can obtain to prove compliance. Organizations often map the rule to a framework such as NIST CSF or ISO 27001 to turn outcomes into controls, but that mapping is a choice. Rules can change: check HHS for the current status of any proposed updates to the Security Rule before relying on a summary, including this one.

How to check or apply this

1. Inventory where ePHI is created, received, stored and transmitted, including vendors and backups.
2. Run and document the risk analysis. Repeat it when systems or threats change, and tie each finding to a risk management action.
3. For each addressable item, record whether you implemented it, an alternative, or neither, with the reasoning.
4. Check unique user IDs, access removal on termination, audit logging and encryption in transit and at rest.
5. Confirm a written business associate agreement exists for every vendor that touches ePHI.
6. Test the contingency plan, including restore from backup.

Compliance work also covers the software you build or buy. Safeguard's compliance automation and dependency scanning can help track the technical evidence, but they support your program; they do not make an organization compliant or certify it.

Quick check

Sources

• eCFR, 45 CFR 164.306 Security standards: general rules
• eCFR, 45 CFR 164.308 Administrative safeguards
• eCFR, 45 CFR 164.312 Technical safeguards

Last reviewed: 18 October 2026.