HIPAA technical safeguards checklist: what 164.312 asks for

The HIPAA technical safeguards in 45 CFR 164.312 have five standards: access control, audit controls, integrity, person or entity authentication, and transmission security. Two implementation specifications are required, unique user identification and emergency access. The rest are addressable, which means you assess them and either implement them or document why not.

The five standards at a glance

The rule text is short. Each standard says what outcome you need, and the Security Rule leaves the tooling to you.

• Access control: only authorized people or software programs reach ePHI. Specifications cover unique user identification (required), emergency access procedure (required), automatic logoff (addressable) and encryption and decryption (addressable).
• Audit controls: hardware, software or procedural mechanisms that record and examine activity in systems that contain or use ePHI.
• Integrity: protect ePHI from improper alteration or destruction. One addressable specification asks for a mechanism to authenticate ePHI.
• Person or entity authentication: verify that whoever asks for access is who they claim to be. No specifications are listed.
• Transmission security: guard against unauthorized access to ePHI sent over a network, with addressable integrity controls and encryption.

Turning each standard into something an assessor can look at

A checklist item is only useful if you can point at evidence. Here is a practical version.

1. Access control: an export of user accounts showing every account maps to one person or one named service. A written break-glass procedure. The session timeout settings for each system that shows ePHI.
2. Audit controls: a description of which systems log access to ePHI, where logs go, and who looks at them.
3. Integrity: the checksums, database constraints, versioning or write controls that stop silent change.
4. Authentication: the login method for staff, patients and API clients, including how service accounts are handled.
5. Transmission security: the list of network paths that carry ePHI and the protection on each.

Where teams usually fall short

Shared logins on clinical workstations break the unique identification requirement. Service accounts with no owner break traceability. Logs that exist but nobody reviews will not impress anyone. And "we use HTTPS" rarely covers internal service to service traffic, message queues or file transfers.

Technical safeguards are one slice

Section 164.312 sits next to administrative and physical safeguards. Risk analysis, workforce training and contingency planning live in 164.308. A clean technical checklist does not replace a risk analysis. If you are building the rest of the program, the HIPAA security rule overview is a good companion.

Safeguard's compliance and evidence automation can help gather the screenshots, exports and policy documents that map to these items. It does not make an organization HIPAA compliant on its own.

Quick check

Sources

• 45 CFR 164.312, Technical safeguards (eCFR)

Last reviewed: 19 October 2026.