Written and maintained by CASRAI Editorial Board
Last updated
Chief information security officers (CISOs), hospital privacy directors, and clinical research infrastructure engineers searching for NIST SP 800-66 (and NIST 800-66 Rev 2) rely on the federal cybersecurity resource guide to translate the technology-neutral legal mandates of the HIPAA Security Rule into verifiable engineering controls. Published by the National Institute of Standards and Technology in February 2024 (DOI: 10.6028/NIST.SP.800-66r2, updating the 2008 Revision 1), NIST Special Publication 800-66 Revision 2—titled Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide—serves as the authoritative bridge connecting 45 CFR Part 164 Subpart C to the NIST Cybersecurity Framework (CSF), NIST SP 800-53 Rev. 5, and the Department of Health and Human Services (HHS) Healthcare and Public Health Cybersecurity Performance Goals (HPH CPGs).
What Is NIST SP 800-66 Rev. 2 for HIPAA Security?
Because the HIPAA Security Rule (45 CFR §§ 164.306–164.316) was drafted to remain flexible and scalable across solo physician practices and multi-hospital academic medical centers, the regulation states what security objectives must be achieved to protect electronic Protected Health Information (ePHI) without prescribing specific cryptographic algorithms, firewall architectures, or audit log schemas. NIST SP 800-66 Rev. 2 fills that operational gap by providing three core components:
- A Structured ePHI Security Risk Assessment (SRA) Methodology: Step-by-step guidance (aligned with NIST SP 800-30 Rev. 1) for inventorying ePHI assets and data flows, identifying internal and external threat sources, evaluating technical and organizational vulnerabilities, determining likelihood and impact combinations, and documenting a prioritized risk management plan under 45 CFR § 164.308(a)(1).
- Standard-by-Standard Key Activities and Sample Assessment Questions: For every Required and Addressable implementation specification across HIPAA Administrative Safeguards (45 CFR § 164.308), Physical Safeguards (§ 164.310), and HIPAA Technical Safeguards (45 CFR § 164.312), Appendix E of NIST SP 800-66 Rev. 2 lists concrete engineering activities and audit questions (replacing the legacy stand-alone NIST HIPAA Security Rule Toolkit).
- Public Law 116-321 (HITECH Act Section 13412) Statutory Recognition: Enacted in January 2021 (42 U.S.C. § 17941), Public Law 116-321 requires the HHS Office for Civil Rights (OCR) to consider a regulated entity’s prior 12-month continuous implementation of “recognized security practices”—explicitly defined by statute to include approaches under Section 2(c)(15) of the NIST Act (the NIST Cybersecurity Framework and NIST SP 800-66) and Section 405(d) of the Cybersecurity Act of 2015—as a mitigating factor that can reduce Civil Monetary Penalties (CMPs) and shorten OCR audit durations following a breach.
How Does NIST 800-66 Map HIPAA Technical and Administrative Safeguards to the NIST CSF and SP 800-53?
To allow health systems and research universities to maintain a single unified control catalog rather than separate compliance checklists for HIPAA, federal grants, and cloud hosting, NIST SP 800-66 Rev. 2 cross-walks each 45 CFR Part 164 Subpart C section directly to NIST Cybersecurity Framework (CSF) subcategories and NIST SP 800-53 Revision 5 controls:
| HIPAA Security Rule Standard (45 CFR) | NIST SP 800-66 Rev. 2 Key Operational Activities | Mapped NIST CSF Function / Category | Mapped NIST SP 800-53 Rev. 5 Control Family |
|---|---|---|---|
| § 164.308(a)(1) Security Management Process (Risk Analysis & Risk Management) | Inventory all systems creating, receiving, maintaining, or transmitting ePHI; execute Threat × Vulnerability risk scoring; track remediation to closure. | ID.AM (Asset Management), ID.RA (Risk Assessment), GV.RM (Risk Management) |
RA-2, RA-3, RA-5, PM-9, CM-8 |
| § 164.308(a)(6) Security Incident Procedures & § 164.308(a)(7) Contingency Plan | Establish incident response playbooks, immutable offline/air-gapped ePHI backups, disaster recovery plans, and emergency mode operation testing. | RS.RP (Response Planning), RC.RP (Recovery Planning), PR.IP-4 (Backups) |
IR-4, IR-6, IR-8, CP-2, CP-4, CP-9, CP-10 |
| § 164.310(a)(1)–(d)(1) Physical Safeguards (Facility, Workstation, Device & Media Controls) | Enforce badge/biometric data center access, workstation screen-lock timeouts, medical device physical tethering, and NIST SP 800-88 media sanitization before disposal. | PR.AC-2 (Physical Access), PR.DS-3 (Asset Disposal), PR.IP-5 |
PE-2, PE-3, PE-6, MP-2, MP-4, MP-6 |
| § 164.312(a)(1) Access Control & § 164.312(d) Person or Entity Authentication | Assign unique user IDs, configure emergency “break-glass” EHR access with post-hoc audit, enforce automatic logoff, encrypt ePHI at rest, and require phishing-resistant Multi-Factor Authentication (MFA). | PR.AC-1, PR.AC-4 (Least Privilege), PR.AC-7 (MFA), PR.DS-1 (Data at Rest) |
AC-2, AC-3, AC-6, AC-11, IA-2, IA-5, SC-28 |
| § 164.312(b) Audit Controls & § 164.312(c)(1) Integrity | Capture tamper-evident system, EHR, and FHIR API access logs; centralize SIEM ingestion; validate cryptographic hashes/digital signatures on ePHI records. | DE.AE (Anomalies & Events), DE.CM (Continuous Monitoring), PR.PT-1 (Audit Logs) |
AU-2, AU-3, AU-6, AU-9, AU-12, SI-7 |
| § 164.312(e)(1) Transmission Security | Encrypt all ePHI transmitted over external or untrusted networks using TLS 1.2/1.3 (NIST SP 800-52 Rev. 2) or IPsec VPN tunnels. | PR.DS-2 (Data in Transit Protection), PR.AC-5 (Network Integrity) |
SC-8, SC-12, SC-13, SC-23 |
What Are the HHS Healthcare and Public Health Cybersecurity Performance Goals (HPH CPGs) and Section 405(d)?
Alongside NIST SP 800-66 Rev. 2, federal healthcare cybersecurity governance relies on two complementary HHS initiatives that operationalize the NIST Cybersecurity Framework for healthcare:
1. Cybersecurity Act of 2015 Section 405(d) and HICP
Under Section 405(d) of the Cybersecurity Act of 2015 (6 U.S.C. § 1533(d)), Congress directed the Secretary of HHS to convene a joint public–private task force (working with the Health Sector Coordinating Council [HSCC]) to publish voluntary, consensus-based cybersecurity practices tailored to healthcare delivery organizations. The HHS 405(d) Program publishes Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients (HICP), which identifies the top five healthcare cyber threats (e-mail phishing, ransomware, loss/theft of equipment or data, insider accidental/intentional data loss, and attacks against connected medical devices) and maps 10 mitigating cybersecurity practices scaled separately for small, medium, and large healthcare organizations.
2. The 20 HHS Healthcare and Public Health Cybersecurity Performance Goals (HPH CPGs)
In January 2024, HHS released the Healthcare and Public Health Sector-Specific Cybersecurity Performance Goals (HPH CPGs)—cross-walked directly to NIST SP 800-66 Rev. 2 and HICP—to establish a prioritized baseline split into 10 Essential Goals and 10 Enhanced Goals:
- The 10 Essential HPH CPGs (Foundational Hygiene): (1) Mitigate known exploited vulnerabilities (CISA KEV patching), (2) Email security (DMARC/DKIM/SPF and anti-phishing), (3) Multifactor authentication (MFA) on all external and privileged access, (4) Basic cybersecurity training for workforce, (5) Strong encryption of ePHI in transit and at rest, (6) Revoke credentials immediately for departing workforce members, (7) Basic incident planning and preparedness exercises, (8) Unique credentials (eliminating shared or default passwords), (9) Separate user and privileged administrator accounts, and (10) Vendor and Business Associate cybersecurity supply-chain requirements.
- The 10 Enhanced HPH CPGs (Defense-in-Depth Maturity): (1) Comprehensive hardware/software/IoMT asset inventory, (2) Third-party vulnerability disclosure program, (3) Third-party incident reporting timelines in contracts, (4) Regular cybersecurity penetration testing and red-team exercises, (5) Network segmentation isolating EHRs and clinical biomedical devices, (6) Centralized log collection (SIEM), (7) Centralized incident planning across clinical and IT operations, (8) Baseline configuration management, (9) Proactive audit log monitoring and anomaly detection, and (10) Cyber threat hunting based on threat intelligence indicators.
