To implement HIPAA yourself, confirm whether you are a covered entity or a business associate, name a security official, complete a documented risk analysis, act on it with risk management, put the administrative, physical and technical safeguards in place, sign business associate agreements, train staff and keep your documentation for six years. No government certificate exists in the rule text.
What does the rule require first?
The Security Rule's administrative safeguards at 45 CFR 164.308 start with a security management process. Four items in it are marked required: risk analysis, risk management, a sanction policy and information system activity review. The same section requires assigned security responsibility, meaning one named person. Most everything else in the plan hangs off the risk analysis, so do not skip it or copy a template.
The rule separates implementation specifications into required and addressable. Addressable does not mean optional. It means you assess whether the item is reasonable and appropriate for your environment, and either implement it, implement an alternative, or document why neither applies. We read the rule text on the Cornell Legal Information Institute site on 18 October 2026, because the HHS pages returned access errors.
The nine steps
Step 1: confirm your role and scope. List where electronic protected health information (ePHI) is created, received, stored or transmitted: applications, databases, laptops, backups, email, vendors. Decide whether you are a covered entity or a business associate with your counsel.
Step 2: name the security official. One person, with authority and time, whose name is written in a policy.
Step 3: risk analysis. For each place ePHI lives, list threats and weaknesses, rate likelihood and impact and record current controls. Date it and keep it. Redo it when systems change.
Step 4: risk management. Turn the highest risks into a plan with owners and dates. Record what you accepted and why.
Step 5: workforce controls. The rule lists addressable specifications for authorization and supervision, workforce clearance and termination procedures, and required items such as a sanction policy. In practice: access based on role, background checks where your policy says so, and a same day removal process for leavers. Add security awareness training. The rule's addressable items there include security reminders, protection from malicious software, log in monitoring and password management.
Step 6: incident and contingency planning. Security incident procedures require response and reporting. A contingency plan requires a data backup plan, a disaster recovery plan and an emergency mode operation plan, with testing and revision and criticality analysis as addressable items. Write them, then test a restore.
Step 7: physical and technical safeguards. These cover facility and device controls, access control, audit logs, integrity and transmission security. Cover the basics: unique user IDs, multi factor authentication, encryption at rest and in transit, automatic logoff, audit logging that someone reviews, and device inventory with disposal procedures.
Step 8: business associate agreements. Required written contracts or arrangements with every vendor that handles ePHI for you. Keep a vendor list with the agreement date, and make sure subcontractors are covered.
Step 9: evaluate and document. The rule requires periodic evaluation. Documentation under 164.316 must be kept for six years from creation or last effective date, whichever is later, be available to the people who carry out the procedures, and be reviewed and updated when environmental or operational changes affect security.
What about breaches?
For breaches of unsecured protected health information, 164.404 requires individual notice without unreasonable delay and no later than 60 calendar days after discovery, with a plain language description of what happened, the types of information, steps individuals can take, what you are doing and contact details. A breach is treated as discovered on the first day it is known or would have been known with reasonable diligence. Other rules in the breach notification set may also apply, so write the runbook with counsel.
Mistakes to avoid
- A risk analysis that is only a policy document, or is two years old.
- Treating addressable as optional.
- Missing agreements with small vendors, such as a transcription tool.
- Backups that were never restored.
- Documentation scattered across drives.
What to do
- Map ePHI flows and write the scope.
- Name the security official in writing.
- Run and date the risk analysis.
- Build the risk management plan and review it quarterly.
- Put access, training, logging and encryption in place and keep evidence.
- Write incident, backup and recovery plans, then test them.
- Sign BAAs and keep the vendor list.
- Store all documents in one controlled place for six years.
Quick check
Is there a HIPAA certification?
The rule text we read sets requirements and describes no government certificate. Be careful with private badges and ask what they actually assess.
Does addressable mean optional?
No. You assess it, then implement it, implement an alternative, or document why it is not reasonable and appropriate.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so repeating evidence such as access reviews and technical settings can be collected from connected systems instead of screenshots, with monitoring between assessments. Technical evidence comes from your real code and dependencies: scans, SBOMs and reachability show weaknesses in software that handles ePHI, which feeds the risk analysis. Autonomous remediation can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard helps you prepare and does not make you HIPAA compliant. Book a call.
Sources
- 45 CFR 164.308, administrative safeguards, fetched 18 October 2026.
- 45 CFR 164.316, documentation, fetched 18 October 2026.
- 45 CFR 164.404, individual breach notice, fetched 18 October 2026.
- HHS Security Rule pages returned access errors on 18 October 2026, and the physical and technical safeguard sections were described generally. This is not legal advice.
Last reviewed: 18 October 2026.
