Put NIST 800-66 HIPAA security guidance into practice with less effort

NIST SP 800-66 Rev. 2 is a cybersecurity resource guide from the US National Institute of Standards and Technology for implementing the HIPAA Security Rule. Published in February 2024, it explains each Security Rule standard and implementation specification, and gives key activities, descriptions and sample questions that help regulated entities of all sizes protect electronic protected health information against reasonably anticipated threats and impermissible disclosures.

No. NIST 800-66 is voluntary guidance and does not change or add to the HIPAA Security Rule. What is mandatory is the Security Rule itself, which applies to covered entities and business associates handling ePHI. Following the guide is a recognised way to show a structured, reasonable approach to meeting the rule, but organisations may choose other methods that satisfy the rule's standards and implementation specifications.

NIST SP 800-66 is written for HIPAA regulated entities: covered entities such as healthcare providers, health plans and healthcare clearinghouses, and business associates that create, receive, maintain or transmit ePHI on their behalf. It is also useful for technology suppliers selling into US healthcare, security teams running a HIPAA risk analysis, and consultants or auditors assessing Security Rule safeguards.

NIST 800-66 Rev. 2 covers every standard in the HIPAA Security Rule at 45 CFR 164.308 to 164.316: administrative, physical and technical safeguards, organisational requirements, and policies, procedures and documentation. It includes guidance on risk assessment and risk management, key activities and sample questions for each standard, and mappings to the NIST Cybersecurity Framework and SP 800-53 Rev. 5 controls, published through NIST's Cybersecurity and Privacy Reference Tool.

Rev. 2 replaces the 2008 Rev. 1 with updated guidance written for today's threats and technologies. It adds a fuller section on risk assessment and risk management, refreshes the key activities and sample questions for each Security Rule standard, maps the rule to the NIST Cybersecurity Framework and SP 800-53 Rev. 5, and lists further NIST and other resources that regulated entities can draw on.

There are no penalties for not following NIST 800-66 itself, because it is guidance. Penalties apply to breaches of the HIPAA Security Rule, which the HHS Office for Civil Rights enforces through investigations, resolution agreements, corrective action plans and civil money penalties. Using the guide helps show that safeguards were chosen through a documented risk analysis, which OCR commonly examines in investigations.

NIST 800-66 is specific to protecting ePHI under the HIPAA Security Rule, while ISO 27001 is a certifiable information security management system standard and SOC 2 is an attestation report on controls. Many safeguards overlap, such as risk assessment, access control, logging, encryption and incident response, so controls built for one can provide evidence for the others when mapped carefully.

Yes, on request. NIST 800-66 is mapped in OneClickComply's control library and available on request rather than live as a standard framework today. Once enabled, you can track the Security Rule standards against shared controls, collect evidence automatically from connected tools, generate policies and use our in-house audit team through Ask an Auditor for guidance on your HIPAA programme.