HIPAA Security Rule
The federal regulation at 45 CFR Part 164 Subpart C that requires safeguards for ePHI.
1 min read · Last reviewed May 23, 2026
At a glance
- Category
- HIPAA & Privacy
- Primary sources
- 4
- Workspace handoff
- sra studio →
Where this comes up
Privacy officers and practice managers handle this — patient rights requests, accounting of disclosures, BAA reviews with new vendors, breach risk assessments after an incident, and OCR responses when a complaint lands. The 60-day breach-notification clock starts at discovery, not at investigation close.
Full definition
What it is in practice
The Security Rule requires covered entities and business associates to ensure the confidentiality, integrity, and availability of ePHI. It is structured around three safeguard categories — administrative, physical, and technical — and a set of required and addressable implementation specifications.
How it shows up in your practice
The Security Rule does not prescribe specific technologies; it requires the practice to perform a Security Risk Analysis, then implement reasonable and appropriate safeguards based on the result. NIST SP 800-66 Rev. 2 is the federal companion implementation guide.
Sources
- HHS — HIPAA Security Rulehttps://www.hhs.gov/hipaa/for-professionals/security/index.html
- 45 CFR 164.308 — Administrative safeguardshttps://www.ecfr.gov/current/title-45/section-164.308
- 45 CFR 164.312 — Technical safeguardshttps://www.ecfr.gov/current/title-45/section-164.312
- NIST SP 800-66 Rev. 2 — HIPAA Security Rule Implementation Guidehttps://csrc.nist.gov/pubs/sp/800/66/r2/final
Run your Security Risk Analysis in SRA Studio
Open sra studio →Related terms
- SecuritySecurity Risk AnalysisThe accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI required by the HIPAA Security Rule.
- SecurityAdministrative SafeguardsPolicies and procedures designed to manage the selection, development, implementation, and maintenance of security measures protecting ePHI.
- SecurityPhysical SafeguardsPhysical measures, policies, and procedures to protect a covered entity's electronic information systems and related buildings and equipment from natural and environmental hazards and unauthorized intrusion.
- SecurityTechnical SafeguardsTechnology and the policy and procedures for its use that protect ePHI and control access to it.
- HIPAA & PrivacyePHI (Electronic Protected Health Information)PHI that is created, received, maintained, or transmitted in electronic form.
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- GlossaryePHI (Electronic Protected Health Information)PHI that is created, received, maintained, or transmitted in electronic form.
- GlossaryAdministrative SafeguardsPolicies and procedures designed to manage the selection, development, implementation, and maintenance of security measures protecting ePHI.
- GlossaryPhysical SafeguardsPhysical measures, policies, and procedures to protect a covered entity's electronic information systems and related buildings and equipment from natural and environmental hazards and unauthorized intrusion.
- GlossarySecurity Risk AnalysisThe accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI required by the HIPAA Security Rule.
- ComplianceAnnual HIPAA Training Curriculum (What to Cover + How to Document)A 2026 annual HIPAA training curriculum for small healthcare practices — eight required modules under 45 CFR 164.530(b) and 45 CFR 164.308(a)(5), with documentation templates.
- RegulationNIST Cybersecurity Framework 2.0The 2024 update to the NIST CSF added the Govern function alongside Identify, Protect, Detect, Respond, and Recover — providing a common language for organizational cybersecurity risk management.
- SRAHIPAA Contingency Plan for a Small PracticeWhat the Security Rule contingency plan standard at 45 CFR 164.308(a)(7) actually requires, including data backup, disaster recovery, emergency mode operation, and testing — for a small practice.
- BillingBusiness Associate Agreement Checklist for Small PracticesA working checklist for small practices to identify which vendors need a Business Associate Agreement, what clauses the BAA must contain, and how to track them.
This glossary entry is a research aid for billing and compliance staff. It does not provide legal, medical, or financial advice and does not replace counsel. References cited link to primary sources at HHS, OCR, CMS, eCFR, NIST, and the relevant payer or industry body.