The nine administrative safeguard standards in 45 CFR 164.308 and their implementation specifications: risk analysis and management, workforce and access management, training, incident response, contingency planning, evaluation and business associate assurances.
The umbrella administrative standard that requires policies and procedures to prevent, detect, contain and correct security violations, and anchors the four required specifications: risk analysis, risk management, sanction policy and information system activity review.
The required risk analysis: an accurate and thorough assessment of risks and vulnerabilities to all ePHI. Covers what OCR expects a risk analysis to contain, the free HHS SRA Tool, and why OCR's Risk Analysis Initiative makes this the most enforced specification.
The required follow-through on the risk analysis: implementing security measures that bring identified risks and vulnerabilities down to a reasonable and appropriate level, and the risk management plan OCR expects to see.
The required sanction policy: applying appropriate sanctions to workforce members who fail to follow security policies and procedures, and how to document and apply it consistently.
The required, regular review of system activity records such as audit logs, access reports and security incident tracking reports. The administrative counterpart to the audit controls standard in 164.312(b).
The standard that requires naming one security official responsible for developing and implementing the Security Rule policies and procedures. It has no separate implementation specifications.
The standard for making sure every workforce member has appropriate access to ePHI and that those without authorized access cannot obtain it. Parent of three addressable specifications: authorization and supervision, clearance, and termination.
Addressable procedures for authorizing or supervising workforce members who work with ePHI or in places where it can be accessed, such as maintenance staff or trainees.
Addressable procedures for deciding that a workforce member's access to ePHI is appropriate, for example screening before access is granted. The risk analysis sets how deep screening should go.
Addressable procedures for removing access to ePHI when someone leaves or their arrangement ends, or when a clearance determination says access should stop. Covers offboarding evidence and timing.
The standard for authorizing access to ePHI in line with the Privacy Rule's minimum necessary approach. Parent of one required specification (isolating clearinghouse functions) and two addressable ones (access authorization, establishment and modification).
The required specification that applies only when a health care clearinghouse sits inside a larger organization: the clearinghouse's ePHI must be protected from unauthorized access by the rest of that organization.
Addressable policies and procedures for granting access to ePHI, for example through access to a workstation, transaction, program or process. Defines who approves access and on what basis.
Addressable policies and procedures to establish, document, review and modify each user's access rights based on the access authorization policy. The specification behind periodic access reviews.
The standard requiring a security awareness and training program for the whole workforce, including management. Parent of four addressable specifications: reminders, malware protection, log-in monitoring and password management.
Addressable periodic security updates to the workforce, such as notices about new threats or policy changes, delivered between formal training sessions.
Addressable procedures for guarding against, detecting and reporting malicious software. Sits under training, so it covers both the technical controls and what staff are taught to spot and report.
Addressable procedures for monitoring log-in attempts and reporting discrepancies, such as repeated failed log-ins. Distinct from broader activity review because it targets authentication events.
Addressable procedures for creating, changing and safeguarding passwords. The current rule does not set a password length or rotation interval, so the risk analysis decides.
The standard and its single required specification, response and reporting: identifying and responding to suspected or known security incidents, mitigating harmful effects, and documenting incidents and outcomes.
The standard for responding to emergencies such as fire, vandalism, system failure or natural disaster that damage systems holding ePHI. Parent of three required plans (backup, disaster recovery, emergency mode) and two addressable activities.
The required procedures to create and maintain retrievable exact copies of ePHI. Covers what must be backed up, how retrievability is shown, and how it relates to the device-level backup in 164.310(d).
The required procedures to restore any loss of data after an emergency. The current rule sets no recovery time; the 2025 proposal would set 72 hours for critical systems.
The required procedures that keep critical business processes running, while protecting ePHI, during an emergency. Different from disaster recovery: it covers operating during the event, not restoring afterward.
Addressable procedures for periodically testing and revising contingency plans, such as restore tests and tabletop exercises, and feeding results back into the plans.
Addressable assessment of which applications and data matter most, used to set backup, recovery and emergency mode priorities for the rest of the contingency plan.
The standard requiring periodic technical and nontechnical evaluation of how well security policies and procedures meet the Security Rule, first against the rule and then after environmental or operational changes. The closest the rule comes to an audit.
The administrative standard that lets a covered entity, or a business associate for its subcontractors, hand ePHI to a vendor only after obtaining satisfactory assurances, documented through a written contract or other arrangement (required).
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.