HIPAA's Security Rule is a set of required and addressable safeguards for electronic protected health information. A DevOps lead should care about four: risk analysis, access control, audit controls and the business associate agreement terms that flow to subcontractors. Each maps to specific work in infrastructure and delivery.
What does the Security Rule actually require?
The text of 45 CFR 164.308 starts with a security management process: policies and procedures to prevent, detect, contain and correct security violations. It names four implementation specifications as required: risk analysis, risk management, a sanction policy and information system activity review. The risk analysis must be an accurate and thorough assessment of risks to the confidentiality, integrity and availability of electronic protected health information.
What do the technical safeguards say?
Section 164.312 sets standards for access control, audit controls, integrity, authentication and transmission security. Under access control, unique user identification and an emergency access procedure are required. Automatic logoff and encryption and decryption are addressable. Audit controls require mechanisms that record and examine activity in systems that contain or use the information.
"Addressable" does not mean optional. It means you assess whether the measure is reasonable and appropriate, and if not, document why and what you did instead. A DevOps lead should expect that explanation to be read.
Where does the pipeline come in?
Constructed example: a clinic scheduling product runs staging with a copy of production data so that engineers can reproduce bugs. The staging database has shared credentials and no audit logging. Under the rule, that copy is still electronic protected health information, so unique user identification and audit controls apply to it. The better design uses synthetic data in staging and keeps real data only where the controls are documented.
Other pipeline questions follow the same logic. Who can read production logs that may contain patient identifiers? Can an engineer shell into a database node without a trace? Do backups get the same access limits as live data? Does the CI system hold credentials that reach production data?
What happens when a vendor is involved?
Section 164.314 says a business associate contract must provide that the associate will comply with the applicable requirements of the subpart, ensure that subcontractors that handle the information agree to comply, and report to the covered entity any security incident it becomes aware of, including breaches of unsecured protected health information. So your cloud, logging and monitoring vendors that touch such data are subcontractors in the chain, and the contract language must carry down.
What about breach timing?
Section 164.410 says a business associate must notify the covered entity without unreasonable delay and in no case later than 60 calendar days after discovery of a breach. Section 164.404 sets the same outer limit for a covered entity notifying individuals. Contracts commonly set shorter windows, so read yours. Your incident runbook should treat the contract window, not the regulatory outer limit, as the target.
What to do
- Document where electronic protected health information lives: databases, object stores, logs, backups, analytics, support tools.
- Run and write down the risk analysis, then track findings in the same tracker as engineering work.
- Enforce unique identities for every human and service that touches that data, and review them on a schedule.
- Turn on audit logging for data stores and administrative actions, and decide who reviews it.
- For each addressable item, record the decision and the reason.
- Check every vendor in the data path for a signed agreement and subcontractor terms.
- Put the contractual breach notice window into the incident runbook.
Quick check
Is encryption mandatory under the Security Rule?
Section 164.312 lists encryption and decryption as an addressable specification. You must assess it and document your decision and any alternative, rather than skip it silently.
How long does a business associate have to report a breach?
Section 164.410 sets an outer limit of 60 calendar days after discovery, without unreasonable delay. Your contract may require less.
Sources
- 45 CFR 164.308 Administrative safeguards
- 45 CFR 164.312 Technical safeguards
- 45 CFR 164.314 Organizational requirements
- 45 CFR 164.404 Notification to individuals
- 45 CFR 164.410 Notification by a business associate
Last reviewed: 18 October 2026.
