The HIPAA Security Rule protects electronic health information held or sent by covered entities and their business associates. It groups its standards into administrative, physical and technical safeguards, and each standard is either required or addressable. This list covers the standards by safeguard.
Free account needed to download. You come straight back to the file.
Who it is for. US healthcare providers, health plans and clearinghouses, and the business associates that handle electronic health information for them. That includes Indian IT, billing and outsourcing companies that work for US healthcare clients.
What this list covers. HIPAA Security Rule, 45 CFR 164.308 to 164.316: standards by safeguard: 20 standards. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it requires |
|---|---|---|
| 164.308(a)(1) | Security management process | Assess the risks to electronic health information, manage them, apply sanctions for breaches of policy and review activity records. |
| 164.308(a)(2) | Assigned security responsibility | Name one person responsible for developing and running the security programme. |
| 164.308(a)(3) | Workforce security | Make sure staff have appropriate access, are cleared for it and lose it when they leave. |
| 164.308(a)(4) | Information access management | Authorise access to health information in line with job roles, and set and review access rights. |
| 164.308(a)(5) | Security awareness and training | Train staff, give security reminders, and cover malware protection, login monitoring and password management. |
| 164.308(a)(6) | Security incident procedures | Identify, respond to and document security incidents, and limit their harm. |
| 164.308(a)(7) | Contingency plan | Keep data backups, a disaster recovery plan and an emergency mode operation plan, and test them. |
| 164.308(a)(8) | Evaluation | Review the security measures periodically, and when the environment or operations change. |
| 164.308(b) | Business associate contracts | Get written assurances from every business associate that handles electronic health information for you. |
| Ref | Control | What it requires |
|---|---|---|
| 164.310(a) | Facility access controls | Limit physical access to systems and the buildings that hold them, with plans, validation and maintenance records. |
| 164.310(b) | Workstation use | Specify how workstations that touch health information may be used and what environment they sit in. |
| 164.310(c) | Workstation security | Protect workstations from unauthorised physical access. |
| 164.310(d) | Device and media controls | Control the receipt, movement, re-use and disposal of hardware and media that hold health information. |
| Ref | Control | What it requires |
|---|---|---|
| 164.312(a) | Access control | Give each user a unique identity, provide emergency access, log users off automatically and encrypt where reasonable. |
| 164.312(b) | Audit controls | Record and examine activity in systems that contain or use health information. |
| 164.312(c) | Integrity | Protect health information from improper alteration or destruction, and be able to detect it. |
| 164.312(d) | Person or entity authentication | Verify that a person or system seeking access is who it claims to be. |
| 164.312(e) | Transmission security | Guard against unauthorised access to health information sent over a network, with integrity checks and encryption where reasonable. |
| Ref | Control | What it requires |
|---|---|---|
| 164.314 | Organizational requirements | Put security terms into business associate contracts and into group health plan documents where they apply. |
| 164.316 | Policies, procedures and documentation | Keep written security policies and procedures, retain the documentation for six years and review it. |
A required specification must be implemented. An addressable one must be assessed: implement it if reasonable and appropriate, or document why not and what you did instead. Addressable does not mean optional.
It can. An Indian company that creates, receives, maintains or sends electronic health information for a US covered entity is a business associate, and is bound by the Security Rule through its contract and directly under the regulation.
No government body certifies HIPAA compliance. Vendors may show an independent assessment, but the legal duty is to meet the rule.
No. Breach notification is a separate rule. In general, affected people must be told without unreasonable delay and within 60 days of discovery. Read the Breach Notification Rule for detail.