NIST SP 800-66 Rev. 2: how to use it for the HIPAA Security Rule

NIST SP 800-66 Revision 2, published in February 2024, is a resource guide titled Implementing the HIPAA Security Rule. It gives practical guidance to regulated entities of all sizes and maps Security Rule standards to NIST Cybersecurity Framework subcategories and SP 800-53 controls. It is guidance, not law, and following it does not guarantee compliance.

What it is

The publication was written by Jeffrey Marron of NIST. It replaces the 2008 first revision, and covers administrative, physical and technical safeguards, risk assessment and risk management. NIST also points to its Cybersecurity and Privacy Reference Tool, which holds key activities and sample questions drawn from the guide's section 5 tables.

Who benefits

Small practices may find the full SP 800-53 catalog heavy. Larger organizations already using the Cybersecurity Framework gain a crosswalk from what they have to what HIPAA expects. Vendors can use it to explain their controls to covered entity customers in familiar language.

A simple way to use it

1. Pick the Security Rule standard you are working on, for example audit controls.
2. Read the guide's key activities and sample questions for it.
3. Map the standard to the NIST framework subcategory it lists.
4. Record your current control and the evidence for it.
5. Rate the gap, then add it to your risk register.
6. Repeat per standard until the whole rule is covered.

What the mapping does and does not do

A crosswalk helps you reuse existing evidence. If you already track a control against SP 800-53, the mapping shows which Security Rule item it also supports. It does not tell you that a control is good enough in your environment. That judgment comes from your own risk analysis.

Pitfalls

• Treating a mapped control as proof that an addressable item is settled.
• Copying sample questions into a questionnaire without answering them honestly.
• Letting the mapping drift when frameworks update.

For the rule text itself, begin with the technical safeguards checklist. Safeguard's compliance and evidence automation supports mapping evidence to frameworks, including HIPAA.

Quick check

Sources

• NIST SP 800-66 Rev. 2

Last reviewed: 19 October 2026.