Written and maintained by CASRAI Editorial Board
Last updated
The HIPAA Technical Safeguards, codified at 45 CFR § 164.312 within the HIPAA Security Rule (45 CFR Part 164, Subpart C), define the mandatory technology controls, software mechanisms, and cryptographic protections that HIPAA Covered Entities and Business Associates must implement to protect electronic protected health information (ePHI) across EHR databases, telehealth platforms, cloud storage, and clinical research repositories.
What Are the Five HIPAA Technical Safeguards Under 45 CFR § 164.312?
Under 45 CFR § 164.304, Technical Safeguards are defined as “the technology and the policy and procedures for its use that protect electronic protected health information and control access to it.” Section 164.312 organizes these obligations into five core standards containing nine implementation specifications, each designated under 45 CFR § 164.306(d) as either Required (R) or Addressable (A):
| 45 CFR § 164.312 Standard | Implementation Specification | Statutory Status | NIST SP 800-66 Rev. 2 Technical Control Examples |
|---|---|---|---|
| 1. Access Control § 164.312(a)(1) |
Unique User Identification — § 164.312(a)(2)(i) | Required | Individual IAM accounts; prohibition of shared nurse-station or coordinator logins |
| Emergency Access Procedure — § 164.312(a)(2)(ii) | Required | Audited “Break-the-Glass” EHR override workflows and offline disaster failover | |
| Automatic Logoff — § 164.312(a)(2)(iii) | Addressable | Idle session timeouts, tap-badge workstation lock, and OAuth token expiration | |
| Encryption and Decryption — § 164.312(a)(2)(iv) | Addressable | AES-256 / FIPS 140-3 full-disk, database, and cloud object storage encryption at rest | |
| 2. Audit Controls § 164.312(b) |
(Standard applies directly; no sub-specifications) | Required | Immutable SIEM logs recording ePHI read, write, query, print, and export events |
| 3. Integrity § 164.312(c)(1) |
Mechanism to Authenticate ePHI — § 164.312(c)(2) | Addressable | SHA-256 checksums, digital signatures, and Merkle tree provenance proofs |
| 4. Person or Entity Authentication § 164.312(d) |
(Standard applies directly; no sub-specifications) | Required | Phishing-resistant Multi-Factor Authentication (MFA), FIDO2/WebAuthn, and mTLS |
| 5. Transmission Security § 164.312(e)(1) |
Integrity Controls — § 164.312(e)(2)(i) | Addressable | Message Authentication Codes (HMAC) and TLS packet integrity verification |
| Encryption — § 164.312(e)(2)(ii) | Addressable | TLS 1.2 / TLS 1.3 for HL7 FHIR APIs, IPsec VPN tunnels, and S/MIME email encryption |
Crucial Compliance Rule on “Addressable” Specifications: Under 45 CFR § 164.306(d)(3), Addressable never means optional. An organization must implement every addressable specification as written unless a formal written Risk Analysis demonstrates that the control is not reasonable and appropriate in its specific environment—in which case the entity must document that rationale in writing and implement an equivalent alternative security measure that achieves the statutory standard. Furthermore, under the HITECH Act Breach Notification Rule (45 CFR § 164.402), encrypting ePHI at rest and in transit in accordance with NIST Special Publication 800-111 and NIST SP 800-52 / 800-88 provides regulatory “safe harbor” by rendering the data “unusable, unreadable, or indecipherable to unauthorized individuals.”
How Do Access Controls and Audit Controls Work Under HIPAA Technical Safeguards?
In hospital EHRs and clinical research data management platforms, the five technical standards operate as an interdependent defense-in-depth pipeline (detailed in NIST Special Publication 800-66 Revision 2, Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule):
- Identity Proofing, Authentication (§ 164.312(d)), and Unique User ID (§ 164.312(a)(2)(i)): Before any session begins, the system verifies the user or API service account via multi-factor authentication (MFA) or mutual TLS (mTLS) certificates and binds the session to a unique identifier.
- Authorization via RBAC vs. ABAC (§ 164.312(a)(1)): Once authenticated, Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) policies enforce the HIPAA Minimum Necessary principle by restricting chart and database access to users with an active treatment relationship or an approved IRB protocol assignment. When an urgent clinical override is needed, the required Emergency Access Procedure (§ 164.312(a)(2)(ii)) provides a Break-the-Glass workflow.
- Continuous Audit Logging (§ 164.312(b)): Every successful and failed login, patient chart open, HL7 FHIR resource query, eCRF update, and Break-the-Glass override is written to a tamper-evident audit log capturing the timestamp, unique user ID, source IP, patient identifier, and action performed.
What Are Examples of Technical Safeguards in HIPAA? Compliance Checklist
Information security officers and clinical research informatics teams preparing for an HHS Office for Civil Rights (OCR) audit or HITRUST CSF certification verify the following technical checklist:
- Access Control Checklist: Enforce unique user IDs across all EHRs, EDC systems, and database servers; disable dormant accounts within 24 hours of termination; document and test Break-the-Glass emergency access procedures; configure automatic workstation and web-session logoff (typically 5–15 minutes of inactivity); and enable AES-256 encryption at rest across all endpoints, mobile devices, and cloud buckets.
- Audit & Integrity Checklist: Centralize application, database, and FHIR API access logs into an immutable SIEM; synchronize all server clocks via Network Time Protocol (NTP); and apply cryptographic hashing (SHA-256/HMAC) or electronic signatures to detect unauthorized modification of ePHI.
- Authentication & Transmission Checklist: Require phishing-resistant MFA for all remote, web portal, and privileged administrative access; enforce TLS 1.2 or TLS 1.3 across all external and internal network transmissions containing ePHI; and disable legacy unencrypted protocols (such as plain HTTP, FTP, and unencrypted Telnet or HL7 v2 MLLP without TLS wrappers).
Frequently Asked Questions
What are the five HIPAA Technical Safeguards under 45 CFR § 164.312?
The five HIPAA Technical Safeguards codified at 45 CFR § 164.312 are: (1) Access Control (§ 164.312(a)(1)), (2) Audit Controls (§ 164.312(b)), (3) Integrity (§ 164.312(c)(1)), (4) Person or Entity Authentication (§ 164.312(d)), and (5) Transmission Security (§ 164.312(e)(1)).
What are examples of Technical Safeguards in HIPAA?
Concrete examples of HIPAA Technical Safeguards include unique clinician login IDs, multi-factor authentication (MFA), Role-Based and Attribute-Based Access Control (RBAC/ABAC), Break-the-Glass emergency EHR access workflows, automatic workstation inactivity logoffs, AES-256 encryption of ePHI at rest, TLS 1.2/1.3 encryption for data in transit, SHA-256 data integrity checksums, and immutable SIEM audit logs.
How do Access Controls and Audit Controls work under HIPAA Technical Safeguards?
Access Controls (§ 164.312(a)(1)) act as the preventive gatekeeper—requiring unique user identification, emergency access procedures, automatic logoff, and encryption so only authorized users and software programs can view or modify ePHI. Audit Controls (§ 164.312(b)) act as the detective accountability layer—recording tamper-evident logs of every login, chart view, modification, and Break-the-Glass override for routine security monitoring and breach forensics.
