The HIPAA Security Rule, 45 CFR Part 164 Subpart C, which sets administrative, physical and technical safeguards for electronic protected health information held by covered entities and business associates. The pillar covers every standard and implementation specification, plus buyer guides on risk analysis, cost, vendors, audits and the pending rule changes.
The nine administrative safeguard standards in 45 CFR 164.308 and their implementation specifications: risk analysis and management, workforce and access management, training, incident response, contingency planning, evaluation and business associate assurances.
The four physical safeguard standards in 45 CFR 164.310 and their implementation specifications: facility access, workstation use and security, and device and media controls including disposal and re-use.
The five technical safeguard standards in 45 CFR 164.312 and their implementation specifications: access control, audit controls, integrity, person or entity authentication and transmission security, including encryption.
The two organizational standards in 45 CFR 164.314: what business associate contracts and other arrangements must contain, and the plan document requirements for group health plans and their sponsors.
The two standards in 45 CFR 164.316: written policies and procedures for every Security Rule requirement, and documentation with its three required specifications on six-year retention, availability and updates.
HIPAA Security Rule obligations for vendors that handle PHI for covered entities: whether you are a business associate, subcontractors, health app developers, managed IT providers, billing and practice management companies, and how covered entities assess vendors.
Doing and maintaining the HIPAA risk analysis OCR asks for first: the free HHS tool, the risk management plan, mapping where ePHI lives, how often to update, and what OCR's enforcement record shows about risk analysis failures.
Cross-cutting technical questions buyers ask about the Security Rule: encryption, multi-factor authentication, passwords, audit logs and backup and disaster recovery, with what the current rule requires and what the proposed rule would change.
What happens when ePHI is exposed: security incidents versus breaches, the four-factor risk assessment, notification to individuals, media and HHS, business associate duties, reporting through the OCR portal and ransomware.
How the Security Rule plays out for different regulated entities, using HHS guidance and OCR enforcement cases: small practices, hospitals and health systems, health plans and their administrators, and imaging and diagnostic providers.
Frameworks that help meet and evidence the HIPAA Security Rule: recognized security practices under the 2021 HITECH amendment, HHS's 405(d) HICP practices and performance goals, and NIST SP 800-66.
Running ePHI systems on cloud or your own infrastructure: AWS and Azure business associate terms, what HIPAA hosting providers must sign and do, open-source tools for Security Rule safeguards, and on-premises responsibilities.
Getting outside help with the HIPAA Security Rule: what consultants do and cost, outsourcing the security official role, what to outsource, and what a third-party HIPAA assessment can and cannot show.
Buyer guides for organizations asked to prove HIPAA Security Rule compliance: what a HIPAA certification is and is not, risk analysis, cost, vendor obligations, business associate agreements, OCR enforcement, penetration testing, penalties and the pending rule changes.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.