To protect healthcare data under HIPAA, covered entities and business associates must safeguard electronic protected health information (ePHI) with administrative, physical and technical measures, starting from a documented risk analysis. The rule is flexible about methods but firm about outcomes: confidentiality, integrity and availability.
This post explains the rule text. It does not make anyone compliant, and it is not legal advice.
What does the rule actually say first?
Under 45 CFR 164.306, covered entities and business associates must ensure the confidentiality, integrity and availability of all ePHI they create, receive, maintain or transmit. They must protect against reasonably anticipated threats or hazards, protect against reasonably anticipated impermissible uses or disclosures, and ensure workforce compliance.
The rule allows a flexible approach. Organizations may use any security measures that let them reasonably and appropriately implement the standards, taking into account factors including their size, complexity and capabilities. A small clinic and a hospital system can reach the same goal differently.
Implementation specifications are marked Required or Addressable. Addressable does not mean optional. It means you must assess whether the measure is reasonable and appropriate in your environment and, if not, document why and what you do instead.
What are the administrative safeguards?
Section 164.308 starts with security management. Two items are Required: risk analysis, which is an accurate and thorough assessment of potential risks and vulnerabilities to ePHI, and risk management, which means implementing measures sufficient to reduce those risks to a reasonable and appropriate level. A sanction policy and an information system activity review are also Required. The review means regularly reading records such as audit logs, access reports and security incident tracking reports.
Everything else should follow from the risk analysis. If it is out of date, the rest of the program rests on guesses.
What are the physical and technical safeguards?
Section 164.310 covers physical controls such as facility access controls: policies to limit physical access to systems and the buildings that house them, while allowing authorized access.
Section 164.312 sets the technical standards:
- Access control: only people or programs granted access rights. Unique user identification and an emergency access procedure are Required. Automatic logoff and encryption and decryption are Addressable.
- Audit controls: mechanisms that record and examine activity in systems that use ePHI.
- Integrity: protect ePHI from improper alteration or destruction.
- Person or entity authentication: verify that whoever seeks access is who they claim to be.
- Transmission security: guard against unauthorized access to ePHI sent over a network, with integrity controls and encryption as Addressable items.
What does this look like in a hospital app team?
A constructed example. A hospital's patient portal team ships a feature that lets patients download lab results. The risk analysis flags a new data flow. The team requires unique accounts and multi-factor authentication, encrypts traffic and storage, logs every download with user ID and time, and sets a short session timeout.
Their weekly activity review catches a staff account pulling results for patients outside its department. That is the information system activity review doing its job. Without the logging and the review, the access would have gone unnoticed.
How to check or apply this
- Inventory where ePHI lives, moves and is backed up, including vendors and cloud services.
- Perform or refresh a risk analysis, record the risks, and decide on measures in a written risk management plan.
- Assign a unique ID to every user and service that touches ePHI, and remove shared logins.
- Turn on audit logging for systems with ePHI, and assign someone to review the logs on a schedule.
- For each Addressable item, record your decision and reasoning.
- Encrypt data in transit and at rest unless you have documented a sound reason, and test the emergency access procedure.
- Check the rule text on the eCFR for amendments before each annual review, since rulemaking can change requirements.
Quick check
Does Addressable mean optional?
No. You must evaluate whether the measure is reasonable and appropriate, and if it is not, document why and use an equivalent alternative where appropriate.
What is the first thing a security rule program needs?
A risk analysis. It is a Required implementation specification and the basis for choosing the other safeguards.
Sources
Last reviewed: 18 October 2026.
