The five technical safeguard standards in 45 CFR 164.312 and their implementation specifications: access control, audit controls, integrity, person or entity authentication and transmission security, including encryption.
The technical standard that systems holding ePHI allow access only to people or software granted rights under information access management. Parent of two required specifications (unique user ID, emergency access) and two addressable ones (automatic logoff, encryption).
The required assignment of a unique name or number to each user so activity can be tied to an individual. Rules out shared accounts for ePHI access.
The required procedures for getting necessary ePHI during an emergency, such as break-glass accounts, and how their use is controlled and reviewed.
Addressable electronic procedures that end a session after a set period of inactivity. The rule leaves the timeout to the entity's risk analysis.
Addressable mechanism to encrypt and decrypt ePHI, generally read as protection for stored data (transmission encryption is in 164.312(e)). Covers when not encrypting can be justified and the 2025 proposal to make it mandatory.
The standard requiring hardware, software or procedural mechanisms that record and examine activity in systems containing or using ePHI. The logging foundation that information system activity review depends on.
The standard requiring policies and procedures that protect ePHI from improper alteration or destruction, for stored data. Parent of one addressable specification: a mechanism to authenticate ePHI.
Addressable electronic mechanisms, such as checksums or digital signatures, that show stored ePHI has not been altered or destroyed without authorization.
The standard requiring procedures to verify that anyone or anything seeking access to ePHI is who it claims to be. The current text does not mandate multi-factor authentication; the 2025 proposal would.
The standard for guarding ePHI against unauthorized access while it travels over an electronic communications network. Parent of two addressable specifications: integrity controls and encryption.
Addressable security measures that make sure ePHI sent over a network is not improperly modified without detection until it is disposed of.
Addressable mechanism to encrypt ePHI in transit whenever deemed appropriate, such as TLS for web, email and API traffic, and the 2025 proposal to require it.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.