HIPAA Security Rule

Definition

The HIPAA Security Rule requires covered entities and business associates to protect the confidentiality, integrity, and availability of electronic protected health information.

In practice

• A team documents the data flow, owner, and evidence for this topic before deciding which control or process to improve.

Who this applies to

• Covered entities that create, receive, maintain, or transmit ePHI
• Business associates that handle ePHI for a covered entity
• Subcontractors that handle ePHI for a business associate

What the rule asks for

• Perform a thorough and accurate risk analysis of potential risks and vulnerabilities.
• Implement reasonable and appropriate administrative, physical, and technical safeguards.
• Maintain policies, procedures, and documentation that support the safeguards.
• Review and update security measures as the environment and risks change.

How teams put it into practice

• Maintain an inventory of systems, applications, users, vendors, and data flows involving ePHI.
• Use access controls, unique user identification, audit controls, and integrity protections appropriate to the risk.
• Test backup restoration and incident response instead of treating written plans as proof of readiness.

Common mistakes

• Calling a checklist a risk analysis without documenting threats, vulnerabilities, likelihood, and impact.
• Assuming encryption alone makes an environment compliant.
• Leaving access reviews, logging, and contingency testing as informal or undocumented activities.

Questions that come up

References

• Security Rule guidance U.S. Department of Health & Human Services
• NIST SP 800-66 Rev. 2 National Institute of Standards and Technology