How do healthcare organizations protect patient data from cyberattacks?

In the United States, healthcare organizations protect patient data by meeting the HIPAA Security Rule: a documented risk analysis, risk management, and technical safeguards covering access control, audit logs, integrity, authentication and transmission security. The rule sets outcomes, not products, so each organization chooses how to meet them.

What does the rule require first?

Before any tool, the rule requires a risk analysis. Under 45 CFR 164.308, a covered entity or business associate must conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information. That item is marked Required, not Addressable. Risk management follows: put in place security measures sufficient to reduce those risks to a reasonable and appropriate level.

The same section requires a sanction policy for staff who break the rules and procedures to regularly review records of system activity, such as audit logs and access reports.

What are the technical safeguards?

Section 164.312 lists five standards:

• Access control. Allow access only to people and software that have been granted rights. Each user gets a unique identifier (Required). Emergency access procedures are Required. Automatic logoff and encryption are Addressable.
• Audit controls. Record and examine activity in systems that contain or use electronic protected health information.
• Integrity. Protect data from improper alteration or destruction, with an addressable mechanism to confirm data was not altered.
• Person or entity authentication. Verify that whoever seeks access is the one claimed.
• Transmission security. Guard against unauthorized access to data in transit, with integrity controls and encryption as addressable items.

"Addressable" does not mean optional. It means you assess whether the measure is reasonable for your environment, and either implement it or document why an alternative is as effective.

Where do real hospitals get stuck?

Constructed example: a regional clinic group has strong controls on its electronic records system, but a billing contractor connects through a shared login, a radiology workstation runs an old operating system that the vendor will not let them patch, and nobody reviews logs for the scheduling portal.

Each gap maps to a rule. The shared login breaks unique user identification. The old workstation is a risk-analysis item that needs a recorded compensating control, such as isolating it on its own network segment. The unreviewed portal breaks the requirement to review system activity.

Is there guidance beyond the regulation?

The Department of Health and Human Services runs the 405(d) program, which provides the healthcare and public health sector with resources and tools to strengthen its cybersecurity posture, including Health Industry Cybersecurity Practices (HICP). Use it as practical guidance next to the legal text. It is not a substitute for it.

How to check or apply this

1. Confirm you have a current, written risk analysis that covers every system holding patient data, including vendors and medical devices.
2. Give every person and every integration its own identity. Remove shared logins.
3. Turn on audit logging for systems with patient data and assign someone to review it on a schedule.
4. Encrypt data in transit and at rest where reasonable, and record the decision where you choose not to.
5. List devices that cannot be patched and record the compensating control for each.
6. Test emergency access: can clinicians reach records during an outage?
7. Review business associate agreements and confirm vendors can show the same safeguards.

This is general information, not legal advice. Check obligations with your compliance counsel.

Quick check

Sources

• 45 CFR 164.306 Security standards: general rules
• 45 CFR 164.308 Administrative safeguards
• 45 CFR 164.312 Technical safeguards
• HHS 405(d) program

Last reviewed: 18 October 2026.