HIPAA Security Rule: Safeguards, Implementation Specifications, and Risk Analysis (45 CFR Part 164 Subpart C)

The HIPAA Security Rule (codified at 45 CFR Part 164, Subpart C, §§ 164.302–164.318) is the federal regulation that establishes national standards for protecting the confidentiality, integrity, and availability of electronic protected health information (ePHI). While the HIPAA Privacy Rule governs permissible uses and disclosures of protected health information across all media (paper, oral, and electronic), the Security Rule applies specifically to ePHI that a HIPAA covered entity or business associate creates, receives, maintains, or transmits.

What Is the HIPAA Security Rule and What Is Its Primary Goal?

Issued under the Administrative Simplification provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Security Rule requires health plans, health care clearinghouses, covered health care providers, and their business associates to operationalize administrative, physical, and technical safeguards around ePHI systems. Under the General Rules at 45 CFR § 164.306(a), every regulated organization must meet four core statutory objectives:

1. Ensure the confidentiality, integrity, and availability of all ePHI the covered entity or business associate creates, receives, maintains, or transmits.
2. Protect against any reasonably anticipated threats or hazards to the security or integrity of such information.
3. Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under Subpart E (the Privacy Rule).
4. Ensure compliance with Subpart C by its workforce.

Recognizing that regulated entities range from solo ambulatory clinics and academic clinical trial sites to multi-hospital academic medical centers and cloud informatics vendors, 45 CFR § 164.306(b) establishes a flexibility of approach. When deciding which security measures to deploy, an organization must weigh four statutory factors (§ 164.306(b)(2)): (i) its size, complexity, and capabilities; (ii) its technical infrastructure, hardware, and software security capabilities; (iii) the costs of security measures; and (iv) the probability and criticality of potential risks to ePHI.

What Does the HIPAA Security Rule Cover?

Under 45 CFR § 164.302 and § 160.103, the Security Rule covers all individually identifiable health information that is transmitted by electronic media or maintained in electronic media (ePHI). In clinical research and academic medical center environments, covered electronic media include:

• Electronic storage media: Enterprise Electronic Health Record (EHR) databases, laboratory information management systems (LIMS), PACS imaging archives, cloud storage buckets, institutional research servers, and removable media (magnetic tape, optical discs, USB flash drives, and workstation hard drives) when they hold ePHI under a covered entity or hybrid entity health care component.
• Transmission media: Internet connections, institutional intranets, virtual private networks (VPNs), dial-up lines, private leased lines, and physical movement of transportable electronic storage media containing identifiable clinical records.

Paper records that are never stored or transmitted electronically—as well as synchronous voice-to-voice telephone conversations and traditional paper-to-paper facsimile transmissions—fall outside the Security Rule’s definition of ePHI, though they remain protected under the Privacy Rule. For academic universities designated as hybrid entities, the Security Rule governs ePHI held within the designated health care component and any research computing enclave acting on its behalf, whereas de-identified datasets meeting 45 CFR § 164.514(a)–(b) are outside HIPAA’s scope. For broader clinical trial context, see HIPAA in clinical research.

Required vs. Addressable Implementation Specifications (45 CFR § 164.306(d))

Each safeguard standard in 45 CFR §§ 164.308, 164.310, and 164.312 is accompanied by specific implementation specifications labeled either Required (R) or Addressable (A). A frequent compliance misconception is treating “Addressable” as optional.

• Required (R) specifications (§ 164.306(d)(2)): The regulated entity must implement the specification exactly as prescribed in the regulation.
• Addressable (A) specifications (§ 164.306(d)(3)): The regulated entity must formally assess whether the implementation specification is a reasonable and appropriate safeguard in its environment, with reference to its risk analysis and the likely contribution of the specification to protecting ePHI. Based on that assessment, the entity must either: (A) implement the specification if reasonable and appropriate; or (B) if implementing the specification is not reasonable and appropriate, document why it would not be reasonable and appropriate and implement an equivalent alternative measure if reasonable and appropriate.

What Are the Three Categories of Safeguards in the HIPAA Security Rule?

The Security Rule organizes its operational requirements into three safeguard sections—Administrative (§ 164.308), Physical (§ 164.310), and Technical (§ 164.312)—supported by organizational requirements (§ 164.314) and documentation rules (§ 164.316). The table below maps all standards and their Required (R) or Addressable (A) implementation specifications directly from 45 CFR Part 164, Subpart C.

Safeguard Category & CFR Citation	Standard Name	Implementation Specifications (R = Required, A = Addressable)	Clinical Research & Informatics Application
Administrative 45 CFR § 164.308(a)(1)	Security Management Process	Risk Analysis (R); Risk Management (R); Sanction Policy (R); Information System Activity Review (R)	Inventorying EHR, EDC, and imaging data flows; reviewing audit logs across clinical research databases.
Administrative 45 CFR § 164.308(a)(2)	Assigned Security Responsibility	Standard functions as its own requirement (R)	Designating a named HIPAA Security Official responsible for institutional security policies.
Administrative 45 CFR § 164.308(a)(3)	Workforce Security	Authorization and/or Supervision (A); Workforce Clearance Procedure (A); Termination Procedures (A)	Revoking EHR and clinical data warehouse credentials when study coordinators or postdocs depart.
Administrative 45 CFR § 164.308(a)(4)	Information Access Management	Isolating Health Care Clearinghouse Functions (R); Access Authorization (A); Access Establishment and Modification (A)	Role-based access control restricting investigators to IRB-approved protocol cohorts.
Administrative 45 CFR § 164.308(a)(5)	Security Awareness and Training	Security Reminders (A); Protection from Malicious Software (A); Log-in Monitoring (A); Password Management (A)	Mandatory phishing, malware, and authentication hygiene training for clinical and research personnel.
Administrative 45 CFR § 164.308(a)(6)	Security Incident Procedures	Response and Reporting (R)	Documented incident response playbooks escalating suspected breaches under 45 CFR Part 164 Subpart D.
Administrative 45 CFR § 164.308(a)(7)	Contingency Plan	Data Backup Plan (R); Disaster Recovery Plan (R); Emergency Mode Operation Plan (R); Testing and Revision Procedures (A); Applications and Data Criticality Analysis (A)	Maintaining verifiable, restorable backups of longitudinal clinical and trial source data.
Administrative 45 CFR § 164.308(a)(8)	Evaluation	Periodic Technical and Non-Technical Evaluation (R)	Re-evaluating security controls when migrating on-premises clinical servers to cloud enclaves.
Administrative 45 CFR § 164.308(b)(1)	Business Associate Contracts and Other Arrangements	Written Contract or Other Arrangement (R)	Executing business associate agreements for research vendors hosting ePHI.
Physical 45 CFR § 164.310(a)(1)	Facility Access Controls	Contingency Operations (A); Facility Security Plan (A); Access Control and Validation Procedures (A); Maintenance Records (A)	Badge access, visitor logs, and physical maintenance logs for data centers and clinical research suites.
Physical 45 CFR § 164.310(b)–(c)	Workstation Use & Workstation Security	Standards function as their own requirements (R)	Physical placement, privacy screens, and cable locks for clinical charting terminals and mobile carts.
Physical 45 CFR § 164.310(d)(1)	Device and Media Controls	Disposal (R); Media Re-use (R); Accountability (A); Data Backup and Storage (A)	Cryptographic erasure or physical destruction (per NIST SP 800-88) of drives before decommission or re-use.
Technical 45 CFR § 164.312(a)(1)	Access Control	Unique User Identification (R); Emergency Access Procedure (R); Automatic Logoff (A); Encryption and Decryption (A)	Prohibiting shared study logins; configuring session timeouts and AES encryption for ePHI at rest.
Technical 45 CFR § 164.312(b)	Audit Controls	Standard functions as its own requirement (R)	Hardware, software, and procedural mechanisms that record and examine activity in ePHI systems.
Technical 45 CFR § 164.312(c)(1)	Integrity	Mechanism to Authenticate ePHI (A)	Checksums, digital signatures, and cryptographic hashes verifying ePHI has not been improperly altered.
Technical 45 CFR § 164.312(d)	Person or Entity Authentication	Standard functions as its own requirement (R)	Multi-factor authentication, tokens, or biometric verification confirming user identity before access.
Technical 45 CFR § 164.312(e)(1)	Transmission Security	Integrity Controls (A); Encryption (A)	Enforcing TLS for web APIs, FHIR endpoints, and secure file transfer of clinical datasets.

Who Is Responsible for Enforcing the HIPAA Security Rule?

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) enforces the HIPAA Security Rule. Although the Centers for Medicare & Medicaid Services (CMS) originally administered Security Rule enforcement when the rule took effect in April 2005, the Secretary of HHS delegated Security Rule administration and enforcement authority to OCR in July 2009 so that Privacy, Security, and Breach Notification enforcement sit under a single agency.

Under the HITECH Act of 2009 and the 2013 HIPAA Omnibus Final Rule, OCR has direct statutory authority to investigate complaints, conduct compliance reviews and audits, and impose tiered civil money penalties (45 CFR Part 160, Subparts C–E) against both covered entities and business associates. When potential criminal violations of HIPAA occur (42 U.S.C. § 1320d-6), OCR refers cases to the U.S. Department of Justice (DOJ). Additionally, state attorneys general hold authority under the HITECH Act to bring civil actions on behalf of state residents for violations of the HIPAA Privacy and Security Rules.

How Do You Conduct a HIPAA Security Risk Assessment?

Conducting an accurate and thorough Risk Analysis under 45 CFR § 164.308(a)(1)(ii)(A) is the foundational step of Security Rule compliance, and failure to perform an organization-wide risk analysis is one of the most frequently cited findings in OCR enforcement settlements. NIST Special Publication 800-66 Revision 2 (Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide, published February 2024) outlines an eight-step risk assessment methodology:

1. Prepare for the assessment: Define the organizational scope and identify all locations, cloud environments, systems, and third-party business associates that create, receive, maintain, or transmit ePHI.
2. Identify realistic threats: Catalog human, natural, environmental, and technical threat sources (e.g., ransomware, credential theft, insider misuse, hardware failure, power outages) relevant to each ePHI environment.
3. Identify potential vulnerabilities and predisposing conditions: Review technical configurations, unpatched software, missing encryption, physical facility gaps, and workflow weaknesses across workstations, servers, APIs, and medical devices.
4. Determine the likelihood of a threat exploiting a vulnerability: Estimate probability (qualitatively or quantitatively) considering existing preventative controls.
5. Determine the impact of a threat exploiting a vulnerability: Evaluate the severity of loss of confidentiality, integrity, or availability of ePHI.
6. Determine the level of risk: Combine likelihood and impact ratings into a structured risk matrix to prioritize findings.
7. Document the risk assessment results: Record the complete asset inventory, threat-vulnerability pairs, risk ratings, and remediation decisions in an auditable risk register retained for at least six years under 45 CFR § 164.316(b)(2)(i).
8. Transition to Risk Management (§ 164.308(a)(1)(ii)(B)): Execute a prioritized risk management plan that reduces identified risks to a reasonable and appropriate level.

How Often Should HIPAA Security Rule Risk Assessments Be Conducted?

The text of 45 CFR § 164.308(a)(1)(ii)(A) and § 164.308(a)(8) does not prescribe a single fixed calendar interval (such as every 365 days) for all entities; instead, the regulation requires that risk analysis and security evaluation be ongoing and periodic, and performed whenever environmental or operational changes affect the security of ePHI (for example, deploying a new EHR or clinical trial management system, adopting cloud storage, or experiencing a security incident). However, healthcare organizations participating in the CMS Promoting Interoperability Program must conduct or review a security risk analysis at least once during each calendar-year EHR reporting period to satisfy the Protect Patient Health Information objective.

What Is the ONC Security Risk Assessment Tool?

The ONC Security Risk Assessment (SRA) Tool is a free, downloadable application (available for Windows and iOS, alongside an Excel workbook companion) jointly developed by the Assistant Secretary for Technology Policy / Office of the National Coordinator for Health Information Technology (ASTP/ONC) and HHS OCR. Built specifically for small and medium-sized health care practices and business associates, the SRA Tool walks compliance teams through multiple-choice questionnaires mapped directly to 45 CFR Part 164 Subpart C standards, flags areas of vulnerability across administrative, physical, and technical safeguards, and generates a documented risk assessment report. Use of the ONC SRA Tool is voluntary and does not by itself guarantee HIPAA compliance, as organizations must still verify that all local ePHI repositories and custom workflows are evaluated and remediated.

Common Misunderstandings in Clinical and Research Environments

• Confusing “Addressable” with “Optional”: Leaving encryption at rest (§ 164.312(a)(2)(iv)) or in transit (§ 164.312(e)(2)(ii)) unimplemented without a written risk-based justification and an equivalent alternative control violates 45 CFR § 164.306(d)(3). Furthermore, under the HIPAA Breach Notification Rule (45 CFR § 164.402), ePHI encrypted in accordance with NIST guidance is considered “secured,” exempting the entity from breach notification obligations if a device is lost or stolen.
• Scoping the Risk Analysis Only to the Primary EHR: OCR routinely penalizes covered entities that assess their central EHR while omitting research file shares, REDCap instances, imaging workstations, biomedical devices, or cloud backup repositories that hold ePHI.
• Relying on Vendor “HIPAA Certified” Marketing Claims: Neither HHS nor OCR certifies software products as “HIPAA compliant.” Even when a research database or cloud platform provides encryption and audit logging, the covered entity remains legally responsible for configuring access controls, reviewing logs, and executing a Business Associate Agreement.

Frequently Asked Questions

What is the HIPAA Security Rule?

The HIPAA Security Rule (45 CFR Part 164, Subpart C) is a federal regulation establishing national standards to protect individuals’ electronic protected health information (ePHI) that is created, received, maintained, or transmitted by a HIPAA covered entity or business associate.

What does the HIPAA Security Rule cover?

The Security Rule covers exclusively electronic protected health information (ePHI)—identifiable health information stored on electronic media or transmitted over electronic networks—and requires administrative, physical, and technical safeguards to ensure its confidentiality, integrity, and availability.

Who is responsible for enforcing the HIPAA Security Rule?

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) enforces the HIPAA Security Rule through complaint investigations, compliance reviews, and civil money penalties, while criminal violations are referred to the U.S. Department of Justice (DOJ).

What are the three categories of safeguards in the HIPAA Security Rule?

The three categories are Administrative Safeguards (45 CFR § 164.308, such as risk analysis, workforce security, and contingency planning), Physical Safeguards (45 CFR § 164.310, such as facility access and device/media controls), and Technical Safeguards (45 CFR § 164.312, such as access control, audit controls, integrity, authentication, and transmission security).

How do you conduct a HIPAA security risk assessment?

Following 45 CFR § 164.308(a)(1)(ii)(A) and NIST SP 800-66 Rev. 2, an organization inventories where all ePHI is created, received, maintained, or transmitted, identifies realistic threats and vulnerabilities, evaluates the likelihood and impact of each risk, documents the risk levels, and implements a risk management plan to reduce risks to a reasonable and appropriate level.

How often should HIPAA Security Rule risk assessments be conducted?

45 CFR § 164.308(a)(1)(ii)(A) and § 164.308(a)(8) require ongoing review and periodic re-evaluation whenever environmental or operational changes affect ePHI security; additionally, providers attesting under the CMS Promoting Interoperability Program must conduct or review their security risk analysis annually for each reporting period.

What is the ONC Security Risk Assessment Tool?

The ONC Security Risk Assessment (SRA) Tool is a free desktop and tablet application developed jointly by ASTP/ONC and HHS OCR that guides small and medium-sized healthcare providers and business associates through a structured, question-based assessment mapped to the HIPAA Security Rule.

Sources

• Electronic Code of Federal Regulations (eCFR) / Legal Information Institute — 45 CFR Part 164, Subpart C: Security Standards for the Protection of Electronic Protected Health Information (§§ 164.302–164.318) (https://www.law.cornell.edu/cfr/text/45/part-164/subpart-C)
• National Institute of Standards and Technology (NIST) — NIST Special Publication 800-66 Revision 2: Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide (February 2024) (https://csrc.nist.gov/pubs/sp/800/66/r2/final)
• Assistant Secretary for Technology Policy / Office of the National Coordinator for Health Information Technology (ASTP/ONC) & HHS OCR — Security Risk Assessment (SRA) Tool (https://healthit.gov/privacy-security/security-risk-assessment-tool/)