Electronic health data gets its own safeguard rulebook.

The Security Rule is about protection, not permission. It applies only to health information held or sent electronically, and asks you to keep it confidential, intact and available. It does not prescribe products; it sets goals and expects you to choose measures that fit your size and risk.

Spelled out: Security Standards for the Protection of Electronic Protected Health Information, 45 CFR Part 164 Subpart C.

This is the rule that turns into engineering work. Everything starts with a risk analysis: an accurate and thorough look at the threats to your electronic health data and how likely and harmful each is. From there come safeguards in three groups: administrative (risk management, a security official, training, incident procedures, contingency plans), physical (facility access, workstation and device controls) and technical (access control, audit controls, integrity, authentication, transmission security). Some implementation specifications are required; others are addressable, which means you assess them and either implement them, use an equivalent, or document why neither is reasonable. Addressable never means optional. Business associates are directly liable under this Rule.

45 CFR 164.308, 164.310 and 164.312

The administrative, physical and technical safeguards, each with its implementation specifications.

45 CFR 164.316

Written policies and procedures, retained for six years counted from the date they were created or last in force.

The risk analysis report

The first document OCR usually asks for in an investigation.

A SOC 2 or ISO 27001 mapping

Customers often ask how existing controls cover the Rule's safeguards.

HIPAA Privacy Rule

The Privacy Rule governs who may use or share health data in any form and patients' rights. The Security Rule governs how electronic health data is protected.

Security risk assessment tool

HHS offers a free tool to help small providers. Using it does not by itself satisfy the risk analysis; the analysis must be accurate and thorough for your environment.

• Inventory every system that creates, receives, keeps or sends electronic health data, including backups and logs.
• Run and document the risk analysis, then a risk management plan that tracks each risk to a decision.
• For each addressable specification, record what you did and why.
• Review the analysis when systems change, not only once a year.

• GuideThe HIPAA Security RuleThe three safeguard families that protect electronic PHI, and what addressable means.
• GuideThe HIPAA security risk analysisThe required analysis, how to run it, and what to keep.
• GuideHIPAA and SOC 2 togetherWhat one report can evidence for the other, and where it stops.

Sources: 45 CFR Part 160 and Part 164 Subparts A and C, Sections 164.302 to 164.318; HHS guidance on risk analysis under the HIPAA Security Rule; HHS notice of proposed rulemaking on the HIPAA Security Rule (2025).