If you are the first security hire at a company handling health data, learn the Security Rule's structure first: administrative, physical and technical safeguards, each with required and addressable items. Then spend your first month on the risk analysis, a data map and access evidence. Those three unlock almost everything else.
How is the Security Rule organised?
The rule sits in 45 CFR Part 164, Subpart C. Administrative safeguards are in section 164.308, technical safeguards in 164.312, and physical safeguards in between. Each section lists standards, and under many standards sit implementation specifications labelled either Required or Addressable.
You will see this in the text itself. For example, under the security management process, risk analysis and risk management are marked Required, along with a sanction policy and an information system activity review.
What does addressable really mean?
It does not mean optional. You assess whether the item is reasonable and appropriate for your environment. Then you implement it, implement an equivalent measure, or document why neither fits. Encryption specifications in the technical safeguards are addressable, and a reviewer will expect a clear written reason if you do not encrypt.
What is your first month?
Week 1: find the data. Ask where electronic protected health information lives: databases, file stores, logs, support tools, backups, analytics exports, developer laptops. Draw it. Most surprises are copies in places nobody thought about.
Week 2: read what exists. Collect current policies, prior risk assessments, vendor agreements and any past audit or customer questionnaire. Check whether the written process matches actual practice.
Week 3: start the risk analysis. The rule requires an accurate and thorough assessment of risks to confidentiality, integrity and availability of that data. List assets, threats, existing controls and gaps, then rate them. A spreadsheet is fine at first, as long as it is dated and owned.
Week 4: pick quick wins. Typical early fixes are unique user IDs, multi-factor authentication on admin paths, audit logging on data stores, and removal of real data from test environments.
Who do you need on your side?
A privacy officer or legal counsel, because status as a covered entity or business associate and the breach decisions are not yours. An engineering lead who can give you evidence. A leader with budget authority. Find them in week one.
What should you not do?
Do not buy a platform before you have a risk analysis; you will not know what to configure. Do not tell customers you are "HIPAA compliant" as a badge, since there is no government certification and the claim invites scrutiny. Say what you do: encryption in transit and at rest, access controls, audit logging, a signed agreement where applicable.
Do not hide a gap. A documented gap with a dated plan is more defensible than an unwritten one.
What happens when something goes wrong?
Breach notification to individuals must occur without unreasonable delay and no later than 60 calendar days after discovery, per 45 CFR 164.404. Discovery counts from when the breach is known, or would have been known with reasonable diligence. Write down who declares an incident and how fast facts reach the privacy officer.
How to check or apply this
- Build the data map of every place health data lives.
- Collect existing policies, agreements and assessments.
- Start a dated, owned risk analysis.
- Fix unique IDs, logging and encryption gaps first.
- Write the incident runbook with the 60 day limit noted.
- Schedule a review of the analysis every year and after major changes.
Quick check
Is there a HIPAA certificate?
No government certification exists. Vendors sell assessments and badges, which are only evidence, not proof of compliance.
What must be done first?
The risk analysis. The rule marks it Required, and other decisions depend on it.
Sources
- 45 CFR 164.308, administrative safeguards
- 45 CFR 164.312, technical safeguards
- 45 CFR 164.404, notification to individuals
Last reviewed: 18 October 2026.
