Implementing HIPAA Security Rule Safeguards

When to Use

• When an organization is a covered entity (health plan, clearinghouse, or provider transmitting electronic transactions) or a business associate handling ePHI on their behalf.
• When standing up or maturing controls to protect electronic protected health information.
• When performing the mandatory HIPAA Security Risk Analysis (§164.308(a)(1)(ii)(A)) — the single most-cited gap in OCR enforcement.
• When preparing for an OCR audit/investigation or responding to a suspected breach.
• When drafting, reviewing, or remediating a Business Associate Agreement (BAA).
• When mapping existing security controls to the HIPAA safeguard standards and implementation specifications.

Scope note: this skill covers the Security Rule (ePHI). The Privacy Rule (uses/disclosures of all PHI) and the Breach Notification Rule are related but distinct; this skill touches breach readiness and BAAs where they intersect security.

Prerequisites

• A clear determination of the organization's role (covered entity vs business associate) and where ePHI lives, flows, and is stored (an ePHI data map).
• An asset inventory of systems that create, receive, maintain, or transmit ePHI.
• Knowledge of the current rule's structure (45 CFR §§164.302–318) and the required vs addressable distinction.
• Awareness that a 2025 NPRM proposes significant changes (see Workflow step 7 and references/standards.md) — track but do not assume them as in force.

Workflow

1. Conduct the Security Risk Analysis (§164.308(a)(1)(ii)(A))

This is required and foundational. Inventory ePHI and systems, identify threats and vulnerabilities, assess current controls, determine likelihood and impact, and assign risk levels. (Pair with the NIST 800-30 methodology and HHS's SRA Tool.) Output is a documented, dated risk analysis — the artifact OCR asks for first.

2. Implement Administrative Safeguards (§164.308)

The largest section. Includes the Security Management Process (risk analysis, risk management, sanction policy, information-system activity review), assigned security responsibility (a named Security Official), workforce security, information access management, security awareness and training, security incident procedures, contingency planning (data backup, disaster recovery, emergency-mode operation), evaluation, and BAAs with business associates.

3. Implement Physical Safeguards (§164.310)

Facility access controls, workstation use and workstation security, and device and media controls (disposal, media re-use, accountability, data backup and storage).

4. Implement Technical Safeguards (§164.312)

Access control (unique user ID, emergency access, automatic logoff, encryption/decryption), audit controls, integrity (mechanisms to authenticate ePHI), person/entity authentication, and transmission security (integrity controls + encryption).

5. Resolve "Required" vs "Addressable" specifications

Under the current rule, each implementation specification is Required (must implement) or Addressable (assess whether reasonable and appropriate; if so implement, if not document why and implement an equivalent alternative). Addressable does not mean optional — it means make and document a risk-based decision.

6. Execute Business Associate Agreements (§164.314 / §164.308(b))

Every business associate that touches ePHI needs a BAA binding it to safeguard ePHI, report incidents, and flow requirements to subcontractors. Maintain the BAA inventory.

7. Track the 2025 NPRM proposed changes (NOT yet final)

HHS OCR published an NPRM (Jan 6, 2025) proposing to remove the required/addressable distinction (make nearly all specifications required), and to mandate MFA, encryption of ePHI at rest and in transit, asset inventory and network maps, vulnerability scans every 6 months, annual penetration testing, 72-hour restoration of certain systems/data, and annual risk-analysis updates. These are proposals — the current rule remains in force until a final rule is published and effective. Plan toward them, but comply with what is current.

8. Stand up breach-notification readiness (45 CFR §§164.400–414)

…