Cross-cutting technical questions buyers ask about the Security Rule: encryption, multi-factor authentication, passwords, audit logs and backup and disaster recovery, with what the current rule requires and what the proposed rule would change.
Whether HIPAA requires encrypting ePHI at rest and in transit: the addressable encryption specifications, HHS FAQ 2001, how encryption to HHS guidance avoids breach notification, the NIST publications cited, full disk encryption limits and the proposed mandate.
What the current Security Rule says about authentication and MFA, OCR's guidance on authentication, a credential stuffing penalty that shows the risk, CISA's view on phishing-resistant MFA, and the proposed rule's MFA requirement.
What HIPAA does and does not say about passwords: the addressable password management specification, no length or rotation rule, log-in monitoring, unique user IDs, and NIST SP 800-63B as the reference most programs adopt.
What the Security Rule requires for audit logs: the audit controls standard, regular information system activity review, insider snooping cases where logging failed, what to track, documentation retention and the proposed audit trail standard.
The contingency plan specifications behind HIPAA backup and DR: exact retrievable copies, restoring lost data, emergency mode operation, testing and criticality analysis, HHS ransomware advice on offline backups, and the proposed 72-hour restore requirement.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.