The HIPAA Security Rule requires covered entities and business associates to protect electronic protected health information with administrative, physical and technical safeguards. It is risk based and flexible, but it is not optional. Some specifications are required outright. Others are addressable, which means you must assess them and document your decision.
What is the general duty?
The text at 45 CFR 164.306 sets four goals. Ensure the confidentiality, integrity and availability of all ePHI you create, receive, maintain or transmit. Protect against reasonably anticipated threats. Protect against uses or disclosures not permitted by the Privacy Rule. Make sure your workforce complies.
It also gives flexibility. You may choose measures that fit your size, technical infrastructure, costs and the probability and criticality of risks. Flexibility does not mean you may skip a standard. It means the how is yours to justify.
What are administrative safeguards?
These live in 164.308. The first standard is the security management process: policies to prevent, detect, contain and correct security violations. It contains four required items:
- Risk analysis: an accurate and thorough assessment of risks to ePHI.
- Risk management: measures sufficient to reduce those risks to a reasonable and appropriate level.
- Sanction policy.
- Information system activity review, such as audit logs and access reports.
The section goes on to assigned security responsibility, workforce security (including termination procedures), and information access management. Those are the controls an auditor asks for first, and the risk analysis underpins the rest.
What are physical safeguards?
164.310 covers facility access controls, workstation use and security, and device and media controls. Two items are required: disposal of ePHI and the hardware that holds it, and removal of ePHI from media before reuse. Others, like maintenance records and data backup before moving equipment, are addressable.
What are technical safeguards?
164.312 lists access control, audit controls, integrity, person or entity authentication and transmission security. Unique user identification and an emergency access procedure are required. Automatic logoff and encryption and decryption are addressable, as are integrity and encryption of data in transit.
What does "addressable" really mean?
Many readers treat it as optional. The rule says otherwise. For an addressable specification you must assess whether it is reasonable and appropriate, then implement it if so. If not, you document why and use an equivalent alternative where reasonable. The decision and reasoning belong on paper.
Constructed example: a small clinic with a laptop that never leaves the office decides full disk encryption is not reasonable. An auditor reading the risk analysis would expect the clinic to explain why, for instance by pointing to physical controls and the loss scenarios considered. In practice most teams find encryption cheap enough that the documented answer becomes yes.
How to check or apply this
- Inventory every system that creates, stores or transmits ePHI, including vendors who do so for you.
- Run and date a risk analysis. Update it when systems or vendors change.
- Map each standard in 164.308, 164.310 and 164.312 to a control and an owner.
- For every addressable item, write one paragraph: implemented, or not and why.
- Turn on logging and set a review schedule you will actually keep.
- Revisit the current regulation text before each annual review. Regulations can be amended, and this post reflects the eCFR text fetched on 18 October 2026.
Who has to comply?
The regulation text speaks of covered entities and business associates. A covered entity is typically a health plan, a clearinghouse or a provider that transmits health information electronically. A business associate is a vendor that handles ePHI on a covered entity's behalf, such as a hosting or billing provider. If your software touches ePHI for a customer, expect that customer to ask for a business associate agreement and evidence of the safeguards above. Keep your risk analysis and policies current so you can answer quickly.
Quick check
Is the Security Rule only for hospitals?
No. It applies to covered entities and business associates, which includes vendors who handle ePHI for a covered entity.
Does Safeguard make an organization HIPAA compliant?
No tool does. Compliance depends on your policies, risk analysis and documented decisions. Tools help gather evidence.
Sources
- 45 CFR 164.306, Security standards: general rules
- 45 CFR 164.308, Administrative safeguards
- 45 CFR 164.310, Physical safeguards
- 45 CFR 164.312, Technical safeguards
Last reviewed: 18 October 2026.
