Glossary
HIPAA Security Rule
Also called: 45 CFR Part 164, Subpart C
In one sentence
The HIPAA Security Rule is the federal regulation that sets the administrative, physical and technical safeguards healthcare providers and their vendors must use to protect electronic patient information.
HIPAA has several parts. The Privacy Rule covers who may use and share patient information. The Breach Notification Rule covers what to do when it leaks. The Security Rule covers how electronic patient information (ePHI) must be protected. It applies to covered entities — providers, health plans and clearinghouses — and to their business associates.
The rule is organized into three groups of safeguards. Administrative safeguards are the management side: a risk assessment, security policies, workforce training, a named security official and contingency plans. Physical safeguards cover facilities and devices: who can get into the server closet, how workstations are positioned and how old hard drives are disposed of. Technical safeguards are the IT controls: unique logins, automatic logoff, audit logs, integrity controls and transmission security.
Each standard is marked either required or addressable. Addressable doesn't mean optional — it means you assess whether the control is reasonable for your practice, implement it if it is, and document an equivalent alternative (and why) if it isn't. The rule is deliberately flexible so a three-person dental office isn't held to a hospital's budget.
As of this writing, HHS has proposed a major update (published January 6, 2025) that would make most safeguards mandatory, including encryption and multi-factor sign-in. It is not final, and HHS's regulatory agenda now lists final action no earlier than 2027 — check HHS for the latest. Our article on the proposed changes explains what may be coming.
Example: a medical practice that has never written down its security decisions can still have decent controls in place. The Security Rule also expects the paperwork — the risk analysis, policies and records — to show it.
Related terms
- ePHI (electronic protected health information)ePHI is protected health information that is created, stored, received or sent in electronic form — the data the HIPAA Security Rule exists to protect.
- Security risk assessmentA security risk assessment is a structured review of where your sensitive data lives, what could go wrong with it, how likely and harmful that would be, and what you'll do about it.
- Business associate agreement (BAA)A BAA is the written contract HIPAA requires between a covered entity (like your practice) and any vendor that creates, receives, stores or transmits patient information on your behalf.
- MFA (multi-factor authentication)MFA means signing in with something you know (a password) plus something you have or are (a phone app, security key or fingerprint), so a stolen password alone isn't enough.
- Encryption at restScrambling stored data — on laptops, servers, phones or in the cloud — so it’s unreadable to anyone without the key.
- Incident response planA written, step-by-step plan for what your business does when a security incident happens — who to call, what to shut off and what to record.