What Is the HIPAA Security Rule?

The HIPAA Security Rule is a set of standards created to protect electronic protected health information (ePHI). Enacted under the Health Insurance Portability and Accountability Act (HIPAA), the Security Rule specifically addresses the technical and non-technical safeguards that organizations, known as covered entities, must implement to secure ePHI.

The Security Rule applies to any healthcare provider, health plan, or healthcare clearinghouse that transmits health information in electronic form. Unlike the HIPAA Privacy Rule, which governs the overall protection of PHI in all formats, the Security Rule focuses solely on ePHI. It requires covered entities to ensure the confidentiality, integrity, and availability of ePHI, guarding against potential threats, unauthorized access, or misuse of the data.

The Security Rule is structured to be flexible and scalable, allowing organizations of different sizes and capabilities to implement appropriate protections.

This is part of a series of articles about HIPAA compliance.

What Is PHI?

Defining what classifies protected health information (PHI) is critical for a covered entity. Essentially, PHI is any individually identifiable health information.

You may also encounter the acronym ePHI or e-PHI, or electronic protected health information. Electronic protected health information is protected health information stored or accessed in an electronic format. Common examples include:

  • Treatment reports
  • Test results
  • Prescription information
  • Any information that includes the name
  • Phone numbers
  • Addresses
  • Social security numbers
  • Medical records numbers
  • Health insurance details

What Are the Three Standards of the HIPAA Security Rule?

The HIPAA Security Rule is organized around three primary standards:

  1. Administrative Safeguards:These are the policies and procedures designed to manage the selection, development, implementation, and maintenance of security measures to protect ePHI. Key components include conducting risk assessments, assigning security responsibilities, developing security policies, and providing workforce training.
  2. Physical Safeguards:These involve the protection of physical access to electronic information systems and the facilities where they are housed. Physical Safeguards cover access controls, device and media controls, and workstations, ensuring that only authorized individuals have access to sensitive areas and equipment.
  3. Technical Safeguards:These are the technology and policies that protect ePHI and control access to it. Technical Safeguards include implementing access controls, audit controls, integrity controls, and transmission security measures. They ensure that ePHI is accessed only by authorized individuals and remains unaltered during storage or transmission.

How to Comply with HIPAA Security Rule: Compliance Checklist

Below are the main steps required to comply with each of the three standards of the HIPAA Security Rule.

Complying with Administrative Safeguards

  1. Conduct a Risk Analysis: To comply with the Administrative Safeguards under the HIPAA Security Rule, organizations must first conduct a comprehensive risk analysis. This involves identifying potential risks to the confidentiality, integrity, and availability of ePHI, assessing all areas where ePHI is stored, accessed, or transmitted, and documenting the findings to establish a baseline for future assessments.
  2. Develop a Risk Management Plan: After identifying the risks, organizations must develop and implement a risk management plan. This plan outlines specific actions to mitigate identified risks, prioritizing these actions based on the severity of each risk and its potential impact on ePHI. The plan should also include the selection of security measures tailored to the organization’s size, complexity, and operational capabilities.
  3. Appoint a Security Officer: A critical step in compliance is appointing a Security Officer responsible for overseeing the development and implementation of security policies and procedures. The Security Officer acts as the main point of contact for all security-related issues and ensures that the organization’s security measures are aligned with HIPAA requirements.
  4. Implement Workforce Training: Workforce training is essential for compliance. All employees, from executives to front-line staff, must be trained on the organization’s security policies and procedures. This training should be continuous, with regular updates to address new threats and technological changes, ensuring employees can recognize and report potential security incidents.
  5. Establish Incident Response Procedures: Organizations must have procedures for managing and responding to security incidents, including a clear incident response plan. This plan should detail steps to take in the event of a breach, such as containment, investigation, remediation, and reporting. Regular testing and updating of the plan are necessary to ensure it remains effective against evolving threats.
  6. Conduct Regular Evaluations: Regular evaluations of security measures are essential to maintaining compliance. These evaluations assess the effectiveness of current safeguards and identify areas needing improvement. The evaluation process should be dynamic, incorporating feedback from past incidents and changes in the organization’s risk profile.

Complying with Physical Safeguards

  1. Control Access to Facilities: To comply with the Physical Safeguards, organizations must focus on protecting the physical environment where ePHI is accessed, stored, or transmitted. This begins with implementing access controls, such as locked doors, security badges, and biometric systems, to ensure only authorized personnel can enter sensitive areas.
  2. Monitor and Document Access: Organizations must monitor and document who enters and exits areas containing ePHI. This can be achieved through visitor logs, security cameras, and other monitoring systems. Regular reviews of these records are crucial to detect and address any unauthorized access attempts.
  3. Secure Workstations: Workstation security is another key aspect of Physical Safeguards. Organizations must ensure that workstations used to access ePHI are secure, which involves placing computers in safe locations, using privacy screens to prevent unauthorized viewing, and implementing automatic screen locks to protect unattended devices.
  4. Manage Mobile Device Security: Mobile devices pose unique security challenges due to their portability. Organizations must implement security measures such as encryption, remote wiping capabilities, and strict access controls on mobile devices. Employees should be trained on these security protocols and the procedures to follow if a device is lost or stolen.
  5. Manage Hardware and Media Lifecycle: Proper management of the lifecycle of hardware and media containing ePHI is crucial. Organizations need procedures for the secure disposal or reuse of equipment like hard drives and USB drives, including using certified data destruction services or physical destruction methods to ensure ePHI cannot be recovered.
  6. Implement Environmental Security Controls: Environmental security controls are vital for protecting physical infrastructure. This includes measures such as fire suppression systems, climate control, and emergency power solutions that help safeguard against environmental threats like fires, floods, or power outages, thereby maintaining the availability and integrity of ePHI.

Complying with Technical Safeguards

  1. Implement Access Controls: Technical Safeguards focus on technologies and policies that protect ePHI from unauthorized access, alteration, or destruction. Implementing robust access controls is essential, including assigning unique user IDs to track access and using role-based access to ensure users only access necessary information based on their job functions.
  2. Establish Emergency Access Procedures: Organizations must establish and document emergency access procedures to ensure authorized individuals can access ePHI during emergencies. These procedures should be regularly tested to ensure they are effective in crisis situations.
  3. Deploy Audit Controls: Audit controls are a critical component of Technical Safeguards. Organizations must use systems that log user access, changes to ePHI, and security-related events. Regular review of audit logs is necessary to detect unauthorized activities, and logs must be protected from tampering to maintain their integrity.
  4. Maintain ePHI Integrity: To maintain the integrity of ePHI, organizations should use integrity controls like checksums or hash functions to prevent data alteration or corruption. If an integrity breach is detected, processes must be in place to recover and verify the original ePHI.
  5. Ensure Transmission Security: Transmission security is essential for protecting ePHI when transmitted electronically. Encryption is a primary technology for safeguarding ePHI during transmission, making data unreadable without the appropriate decryption keys. Organizations should also employ secure communication channels like VPNs or TLS.
  6. Continuously Monitor and Update Technical Safeguards: Continuous monitoring and updating of technical safeguards are necessary to address new vulnerabilities and threats. This includes applying software patches, updating encryption protocols, and conducting regular security assessments to ensure all technical measures remain effective against the latest threats.

What Is a Covered Entity?

Covered Entities (CE) are organizations that handle PHI or e-PHI during day-to-day business operations.  A Covered Entity must abide by HIPAA regulations, including the HIPAA Security Rule, which are enforced by the HSS.

The U.S. Department of Health and Human Services (HHS) officially defines a Covered Entity as belonging to one of the following groups:

  • Healthcare Providers – such as doctors, dentists, nursing homes, pharmacies, etc.
  • Health Plans – health insurance companies, HMOs, Medicare, Medicaid, etc.
  • Clearinghouses – transcription services, etc.

How Are Business Associates Affected by the HIPAA Security Rule?

Business Associates are organizations that work with Covered Entities in handling e-PHI or PHI. Just as a Covered Entity must abide by HIPAA regulations in handling e-PHI or PHI, so too must any Business Associate they work with. Atlantic.Net is a Business Associate of each healthcare organization with whom we process, store, manage or otherwise deal with electronic protected health information.

What is a Business Associate (BAA)?
Therefore, we are legally obliged to sign a contract of service with each organization to guarantee our HIPAA compliance status. We outline our security policies and procedures and our administrative, physical, and technical safeguards that detail how we maintain the confidentiality, integrity, and availability of electronic protected health information.

HIPAA Security Rule vs. Privacy Rule: What Is the Difference?

The HIPAA Security Rule focuses exclusively on protecting electronic protected health information (ePHI) by setting standards for how ePHI must be stored, accessed, and transmitted securely. It mandates administrative, physical, and technical safeguards that covered entities and business associates must implement to ensure the confidentiality, integrity, and availability of ePHI.

The HIPAA Privacy Rule applies more broadly, covering all forms of protected health information (PHI), whether it is electronic, paper-based, or oral. The Privacy Rule sets standards for how PHI can be used and disclosed, establishing individuals’ rights over their health information, such as the right to access their records or request corrections.

While the Security Rule deals with how ePHI is protected, the Privacy Rule governs how PHI is shared, emphasizing the need for patient consent and limiting unauthorized disclosures.

Secure HIPAA Compliant Hosting

Are you in need of an infrastructure that can protect the health data of your organization? At Atlantic.Net, we can offer a secure HIPAA-Compliant Hosting solution. Get a free consultation today, or get started with a free trial today!

Learn more about our HIPAA-compliant web hosting and HIPAA cloud hosting solutions.

Written by Richard Bailey

Linux, Cloud, and Lead IT Consultant with 30 years of experience.  Graduate of the University of Bradford, England. Enthusiastic about Technology, Automation, and Infrastructure as Code. Passionate writer, keen to understand and disseminate as much technical knowledge as possible

This article was updated with the most recent information on September 3, 2024.

Read More About HIPAA Compliance