The three kinds of safeguard
- Administrative (§164.308): risk analysis and management, workforce security, training, incident procedures, contingency plan, evaluation.
- Physical (§164.310): facility access, workstation use and security, device and media controls.
- Technical (§164.312): access control, audit controls, integrity, authentication, transmission security.
Start with the risk analysis
§164.308(a)(1)(ii)(A) requires an accurate and thorough assessment of risks to the confidentiality, integrity and availability of electronic health information. The rest of your programme depends on it.
Business associates
Anyone handling this information on your behalf must sign a business associate agreement, and is directly subject to the Security Rule.
A proposed overhaul
In January 2025, HHS proposed a major update to the Security Rule. Until a final rule is published, the current rule stays in force: check the proposal's status before you plan around it.
Documentation and breaches
- Keep the policies and required records for six years (§164.316(b)(2)).
- Notify a breach of unsecured information without unreasonable delay and within 60 calendar days of discovery (§§164.404 to 164.408).
- Breaches affecting 500 people or more also need notice to HHS at the same time and, in some cases, to the media.
Questions
- Is there a HIPAA certification?
- No official one exists. HHS does not certify companies. Third parties offer assessments, but those are not government certification.
- What are addressable specifications?
- You must assess them and implement them if reasonable and appropriate, or document why not and adopt an equivalent where appropriate. They are not optional.