Meet HIPAA Security Rule safeguards with evidence that stays current

The HIPAA Security Rule is the US federal regulation at 45 CFR Part 164 Subpart C that sets national standards for protecting electronic protected health information (ePHI). It requires covered entities and business associates to ensure the confidentiality, integrity and availability of ePHI through administrative, physical and technical safeguards, supported by organisational requirements and written policies, procedures and documentation. It is enforced by the HHS Office for Civil Rights.

Covered entities and their business associates must comply. Covered entities are health plans, health care clearinghouses and health care providers that conduct standard electronic transactions. Business associates are organisations, such as cloud, software and IT service providers, that create, receive, maintain or transmit ePHI on a covered entity's behalf. Since the HITECH Act and the 2013 Omnibus Rule, business associates and their subcontractors are directly liable for Security Rule compliance.

The Security Rule covers only electronic protected health information and focuses on safeguards: risk analysis, access control, audit logging, integrity, transmission security, contingency planning and similar measures. The Privacy Rule covers protected health information in every form, including paper and spoken information, and governs how it may be used and disclosed and what rights patients have. Both sit within the HIPAA Administrative Simplification regulations at 45 CFR Parts 160 and 164.

It is still a proposed rule, and the current Security Rule remains in force. HHS published the proposal in the Federal Register on 6 January 2025 and the comment period closed on 7 March 2025. It would remove the distinction between required and addressable specifications and make measures such as encryption, multi-factor authentication and an asset inventory explicit. The 2026 Unified Agenda moved it to long-term actions, with final action projected for July 2027.

The HHS Office for Civil Rights can impose civil money penalties in four tiers based on culpability, from lack of knowledge to uncorrected wilful neglect, with amounts adjusted annually for inflation. OCR frequently settles cases through resolution agreements that combine a payment with a multi-year corrective action plan, and a missing or inadequate risk analysis is one of the most common findings. Knowingly obtaining or disclosing health information in breach of HIPAA can also lead to criminal prosecution.

Required implementation specifications must be implemented as written. Addressable specifications must still be assessed: the organisation implements the specification if it is reasonable and appropriate, or documents why it is not and implements an equivalent alternative measure where reasonable. Addressable never means optional. Encryption of ePHI at rest and in transit is currently addressable, which is one of the points the proposed 2025 update would change.

There is no HIPAA certification, but ISO 27001 and SOC 2 overlap heavily with the Security Rule's safeguards, including risk assessment, access control, logging, incident response and business continuity. Many organisations reuse their ISO 27001 or SOC 2 controls as evidence for HIPAA and some commission a SOC 2 report that includes HIPAA criteria. Neither replaces the Security Rule's specific needs, such as an ePHI risk analysis and business associate agreements.

Yes, on request. The HIPAA Security Rule is mapped in OneClickComply's control library, so its administrative, physical and technical safeguards can be linked to the same controls, policies and automated evidence you use for frameworks such as ISO 27001 and SOC 2. Contact the team to enable it. OneClickComply helps you prepare and maintain evidence, but compliance remains your organisation's responsibility and no body issues a HIPAA certification.