HIPAA Security Rule

The HIPAA Security Rule establishes national standards for protecting electronic protected health information (ePHI). It requires covered entities and business associates to implement safeguards ensuring the confidentiality, integrity, and availability of ePHI. The Security Rule is organized into three categories of safeguards.

Administrative Safeguards

Administrative safeguards are policies and procedures managing the selection, development, and implementation of security measures. Key requirements include:

Risk analysis is the foundation. You must conduct a thorough assessment of potential risks and vulnerabilities to ePHI. This is not optional — it is the single most cited deficiency in HIPAA enforcement actions.

Risk management requires implementing measures to reduce identified risks to a reasonable and appropriate level. Your risk management plan should address every risk identified in the analysis.

Workforce training ensures all employees handling ePHI understand security policies and procedures. Training must be documented and conducted regularly.

Contingency planning requires establishing data backup, disaster recovery, and emergency mode operation plans to ensure ePHI remains available.

Physical Safeguards

Physical safeguards protect physical access to electronic information systems and the facilities housing them. Requirements include facility access controls, workstation use policies, workstation security measures, and device and media controls for hardware and electronic media containing ePHI.

Technical Safeguards

Technical safeguards are the technology and related policies protecting ePHI. Key requirements include access controls (unique user identification, emergency access, automatic logoff, encryption), audit controls (recording and examining activity in systems containing ePHI), integrity controls (protecting ePHI from improper alteration or destruction), and transmission security (encryption for ePHI in transit).

Required vs Addressable

Security Rule specifications are either "required" or "addressable." Required specifications must be implemented. Addressable specifications require you to assess whether they are reasonable and appropriate — if so, implement them. If not, document why and implement an equivalent alternative. Addressable does not mean optional.

In the next lesson, we will cover the HIPAA Privacy Rule.