The HIPAA Security Rule (45 CFR Part 164, Subpart C) applies to covered entities and their business associates. It requires implementation of Administrative, Physical, and Technical Safeguards to protect electronic protected health information (ePHI). Safeguards are either Required (must implement) or Addressable (must implement if reasonable and appropriate, or document why not).

Administrative Safeguards

  • Security Management Process (R): Conduct a risk analysis; implement a risk management programme; have sanction policies; perform information system activity reviews.
  • Assigned Security Responsibility (R): Designate a security official responsible for HIPAA compliance.
  • Workforce Security (A): Implement authorisation/supervision procedures, workforce clearance procedures, and termination procedures.
  • Information Access Management (A): Restrict access to ePHI based on job function. Document access authorisation processes.
  • Security Awareness and Training (A): Train workforce on security policies annually. Include reminders for malicious software, login monitoring, and password management.
  • Security Incident Procedures (R): Maintain incident response and reporting procedures. Log all security incidents.
  • Contingency Plan (R): Data backup plan, disaster recovery plan, emergency mode operation plan, and testing/revision procedures.
  • Evaluation (R): Periodic technical and non-technical evaluation of security measures.
  • Business Associate Contracts (R): Sign BAAs with all business associates that access ePHI.

Physical Safeguards

  • Facility Access Controls (A): Limit physical access to ePHI systems. Implement visitor control and facility maintenance records.
  • Workstation Use (R): Specify proper workstation functions and physical surroundings for workstations accessing ePHI.
  • Workstation Security (R): Implement physical safeguards for workstations (clean-desk policy, screen locks, restricted access).
  • Device and Media Controls (A): Manage disposal, re-use, accountability, and data backup for hardware and electronic media containing ePHI.

Technical Safeguards

  • Access Control (R): Unique user identification; automatic logoff; encryption/decryption of ePHI.
  • Audit Controls (R): Hardware, software, and procedural mechanisms to record and examine activity in systems containing ePHI.
  • Integrity (A): Protect ePHI from improper alteration or destruction. Use electronic mechanisms to authenticate ePHI.
  • Person or Entity Authentication (R): Verify that users seeking access to ePHI are who they claim to be. MFA is best practice.
  • Transmission Security (A): Implement encryption for ePHI in transit (TLS 1.2+). Guard against unauthorised interception.

Common HIPAA Security Rule Findings in OCR Audits

  • No enterprise-wide risk analysis performed (the most cited violation).
  • Insufficient risk management following the risk analysis.
  • Missing or unsigned Business Associate Agreements.
  • No security awareness training programme.
  • Lack of access controls and audit logs for ePHI systems.