HIPAA Security Rule vs Privacy Rule: A Plain-English Map

The two rules sit in different subparts of the same Part

Both rules live inside 45 CFR Part 164:

• Subpart C — Security Rule at 164.302 through 164.318. Governs electronic protected health information (ePHI). Sets administrative, physical, and technical safeguards plus policies, procedures, and documentation.
• Subpart E — Privacy Rule at 164.500 through 164.534. Governs all PHI in any form — paper, electronic, oral. Sets the rules for use, disclosure, patient rights, notice, and administrative requirements.

Subpart D is the Breach Notification Rule. Subpart A defines terms. Subpart B is preemption.

Different scopes of PHI

• The Privacy Rule applies to PHI in any medium.
• The Security Rule applies only to ePHI — PHI created, received, maintained, or transmitted in electronic form.

A paper chart misplaced on a counter is a Privacy Rule issue. A USB drive of patient records lost in the parking lot is both: a Privacy Rule disclosure and a Security Rule failure of the device and media controls at 164.310(d)).

What the Privacy Rule actually controls

Use and disclosure rules at 164.502 and following. The headline provisions:

• Treatment, payment, and operations uses without authorization
• Public-interest exceptions (public health, abuse reporting, law enforcement, judicial proceedings, etc.)
• Authorization-required disclosures (most marketing, sale of PHI, most psychotherapy notes)
• Minimum-necessary standard
• Notice of Privacy Practices at 164.520
• Patient rights: access (164.524), amendment (164.526), accounting of disclosures (164.528), request for restrictions (164.522), confidential communications
• Administrative requirements at 164.530: Privacy Official, training, complaint process, sanctions, mitigation, documentation

What the Security Rule actually controls

Safeguard standards at three layers:

• Administrative safeguards at 164.308: security management process (risk analysis, risk management, sanction policy, information system activity review), Assigned Security Responsibility, Workforce Security, Information Access Management, Security Awareness and Training, Security Incident Procedures, Contingency Plan, Evaluation, Business Associate Contracts.
• Physical safeguards at 164.310: facility access controls, workstation use and security, device and media controls.
• Technical safeguards at 164.312: access control, audit controls, integrity, person or entity authentication, transmission security.

Plus organizational requirements at 164.314 (BACs and group health plan documents) and policies, procedures, and documentation at 164.316.

Which rule does the SRA satisfy

The Security Risk Analysis at 164.308(a)(1)(ii)(A)(1)(ii)(A)) is a Security Rule requirement. It governs ePHI specifically.

The Privacy Rule does not require a parallel "Privacy Risk Analysis." It does require:

• Designation of a Privacy Official (164.530(a)))
• A complaint process (164.530(d)))
• Training of workforce (164.530(b)))
• Sanctions (164.530(e)))
• Mitigation (164.530(f)))
• Reasonable safeguards on PHI (164.530(c)))
• Notice of Privacy Practices and policies and procedures

A well-built compliance binder addresses both. The SRA proper is the Security Rule artifact; the broader binder also captures the Privacy Rule administrative pieces.

Where they overlap operationally

• Training. Privacy Rule training and Security Rule training are separate requirements, typically delivered together.
• Sanctions. Both rules require a sanction policy.
• Workforce changes. Privacy Rule training on policy updates and Security Rule access termination procedures both trigger on the same employee event.
• Breach response. The Breach Notification Rule cross-references both rules' violations.
• Documentation retention. Both require six-year retention of policies, procedures, and the records of compliance work — 164.316(b)) and 164.530(j)).

Two officials, not one

The Security Rule requires an Assigned Security Responsibility at 164.308(a)(2)(2)). The Privacy Rule requires a Privacy Official at 164.530(a)). In a small practice the same person can hold both, but the appointments are separate and both should be in writing.

What about the proposed Security Rule update

HHS published a notice of proposed rulemaking to update the Security Rule, available through the OCR HIPAA Rulemaking page. The proposed rule would tighten several specifications (including making certain currently-addressable controls required and adding new technology-specific obligations). As of the last review date on this article it is in proposed status, not final. The current Security Rule still controls.

Restraint about claims

The two rules are technical regulations administered by HHS Office for Civil Rights. No tool or trainer "completes" either rule. The practice's program is a continuing obligation.

How D3rx fits

D3rx SRA Binder Studio is structured around the Security Rule specification tree but also collects the Privacy Rule administrative pieces (Privacy Official designation, complaint procedure log, sanction policy, training records). It is a point-in-time administrative documentation aid; the practice remains responsible for the substance.

Next steps

See where your practice currently stands with the free 5-question readiness check, or review the full workflow and pricing on the main SRA page.