US
HIPAA Security Rule
HIPAA Security Rule (45 CFR Part 164, Subpart C)
45 CFR 164.302-318
18 controls · 3 domains · 36 sub-controls
Mandatory for: US federal law
About this framework
The HIPAA Security Rule is the US standard for protecting electronic health information. It requires healthcare organisations and their partners to apply administrative, physical, and technical safeguards to keep patient data secure.
Who needs this
Mandatory for US healthcare providers, health plans, and the vendors that handle patient data.
Cross-framework coverage
Controls in HIPAA Security Rule also cover:
Dubai ISR 14 shared
NCA ECC-2 14 shared
NCA OTCC 14 shared
NIST CSF 14 shared
Qatar NIA 14 shared
See how HIPAA Security Rule connects to the rest → the Security Universe
Control domains
administrative-safeguards · Administrative Safeguards 9
164.308(a)(1)
Security Management Process
4 sub-controls
- 164.308(a)(1)#1 Risk Analysis
- 164.308(a)(1)#2 Risk Management
- 164.308(a)(1)#3 Sanction Policy
- 164.308(a)(1)#4 Information System Activity Review
164.308(a)(2)
Assigned Security Responsibility
164.308(a)(3)
Workforce Security
3 sub-controls
- 164.308(a)(3)#1 Authorization and/or Supervision
- 164.308(a)(3)#2 Workforce Clearance Procedure
- 164.308(a)(3)#3 Termination Procedures
164.308(a)(4)
Information Access Management
3 sub-controls
- 164.308(a)(4)#1 Isolating Health care Clearinghouse Function
- 164.308(a)(4)#2 Access Authorization
- 164.308(a)(4)#3 Access Establishment and Modification
164.308(a)(5)
Security Awareness and Training
4 sub-controls
- 164.308(a)(5)#1 Security Reminders
- 164.308(a)(5)#2 Protection from Malicious Software
- 164.308(a)(5)#3 Log-in Monitoring
- 164.308(a)(5)#4 Password Management
164.308(a)(6)
Security Incident Procedures
1 sub-control
- 164.308(a)(6)#1 Response and Reporting
164.308(a)(7)
Contingency Plan
5 sub-controls
- 164.308(a)(7)#1 Data Backup Plan
- 164.308(a)(7)#2 Disaster Recovery Plan
- 164.308(a)(7)#3 Emergency Mode Operation Plan
- 164.308(a)(7)#4 Testing and Revision Procedure
- 164.308(a)(7)#5 Applications and Data Criticality Analysis
164.308(a)(8)
Evaluation
164.308(b)(1)
Business Associate Contracts and Other Arrangement
1 sub-control
- 164.308(b)(1)#1 Written Contract or Other Arrangement
physical-safeguards · Physical Safeguards 4
164.310(a)(1)
Facility Access Controls
4 sub-controls
- 164.310(a)(1)#1 Contingency Operations
- 164.310(a)(1)#2 Facility Security Plan
- 164.310(a)(1)#3 Access Control and Validation Procedures
- 164.310(a)(1)#4 Maintenance Records
164.310(b)
Workstation Use
164.310(c)
Workstation Security
164.310(d)(1)
Device and Media Controls
4 sub-controls
- 164.310(d)(1)#1 Disposal
- 164.310(d)(1)#2 Media Re-use
- 164.310(d)(1)#3 Accountability
- 164.310(d)(1)#4 Data Backup and Storage
technical-safeguards · Technical Safeguards 5
164.312(a)(1)
Access Control
4 sub-controls
- 164.312(a)(1)#1 Unique User Identification
- 164.312(a)(1)#2 Emergency Access Procedure
- 164.312(a)(1)#3 Automatic Logoff
- 164.312(a)(1)#4 Encryption and Decryption
164.312(b)
Audit Controls
164.312(c)(1)
Integrity
1 sub-control
- 164.312(c)(1)#1 Mechanism to Authenticate Electronic Protected Health Information
164.312(d)
Person or Entity Authentication
164.312(e)(1)
Transmission Security
2 sub-controls
- 164.312(e)(1)#1 Integrity Controls
- 164.312(e)(1)#2 Encryption
Ready to assess against HIPAA Security Rule?
Start free trial →