HIPAA vs CIS Controls

HIPAA vs CIS Controls: which to pursue first for ePHI

A covered entity or business associate choosing a control baseline should start from a clear answer: HIPAA is the binding obligation, and it has no certification. The Security Rule requires protection of electronic protected health information, but it does not prescribe the technical controls. The CIS Controls are a voluntary set of 153 prioritized Safeguards in 18 Controls, and they can carry much of the technical work that the Security Rule's standards call for. Neither one replaces the other. CIS states that its Controls do not replace any regulatory or compliance scheme, and HHS states that no Security Rule standard requires certification. Adopting CIS Controls alone does not prove HIPAA compliance.

For most organizations with a small security team, the practical starting point is Implementation Group 1, which CIS describes as essential cyber hygiene and a minimum standard for every enterprise. IG1 contains 56 Safeguards. Use it to build the technical floor quickly, then map each Safeguard to the Security Rule standards it supports, such as access control, audit controls and security incident procedures. Be explicit about the gap: the risk analysis required under 45 CFR 164.308(a)(1)(ii)(A), the documentation standards in 164.316 and the workforce and contingency decisions in Appendix A are not covered by any single CIS Safeguard. Assign owners for those items separately. Confirm the current mapping against the CIS Controls Navigator for v8.1 before you rely on it in a risk file.

Pursue both when the organization handles ePHI at scale, holds sensitive data beyond health records, or has contractual obligations that ask for a named control framework. In that case, move from IG1 toward IG2 on systems that process ePHI, and use the risk analysis to decide which additional Safeguards matter. Ask your assessor or internal auditor which evidence they will accept for each HIPAA addressable specification, because the documented rationale for an alternative measure under 45 CFR 164.306(d) is the proof OCR will look for, not the CIS label. A useful first check is to list every ePHI system and confirm that each one has an IG1 owner and a documented risk decision.

How HIPAA and the CIS Controls differ on scope, structure and licensing

This table compares the HIPAA Security Rule and CIS Controls v8.1 on who must comply, legal status, structure, prioritization, licensing and regulatory standing. Read each row as a question to answer for your own program, since the two documents answer different questions about the same systems.

Dimension	HIPAA Security Rule	CIS Controls v8.1
Who must comply	Covered entities and business associates must comply for electronic protected health information (45 CFR 164.302).	No legal obligation. Any organization may use the Controls to improve its own cybersecurity.
Legal status	Federal regulation at 45 CFR Part 164 Subpart C, enforced by HHS OCR through complaints, compliance reviews and audits.	Voluntary practice guidance published by a US nonprofit. CIS states the Controls do not replace any regulatory, compliance or authorization scheme.
Structure	18 standards across administrative, physical and technical safeguards, with 36 implementation specifications, plus organizational and documentation standards.	18 Controls containing 153 Safeguards. Each Safeguard maps to one asset class, one security function and its Implementation Groups.
Required versus addressable	14 specifications are required and 22 are addressable. For addressable ones, the entity documents why it is not implemented and adopts an equivalent measure if appropriate.	Every Safeguard is a recommended action. Implementation Groups set which Safeguards apply to an organization, not whether they are mandatory.
Prioritization	Flexible and scalable: the entity decides how to meet each standard, and risk analysis is a required specification (45 CFR 164.308(a)(1)(ii)(A)).	Built in tiers: IG1 has 56 Safeguards, IG2 adds 74 for 130 in total, and IG3 adds the remaining 23 for all 153.
Verification method	No HIPAA certification exists. HHS does not recognize private certifications, so proof comes from documentation and OCR review.	CIS Controls Assessment Specification defines what to measure for each Safeguard, but CIS says it covers what to measure, not how.
Licensing and use	Regulation text is public law. Use of the text carries no license conditions.	Creative Commons Attribution-NonCommercial-NoDerivatives 4.0. Commercial use requires prior CIS approval, so confirm terms before embedding the text in a product or service.
What neither document says	HIPAA does not name specific technical controls, so the entity must choose them. Confirm any tool or setting with your privacy and security counsel.	CIS does not state which Safeguards satisfy a HIPAA standard. Use CIS's published mapping to the HIPAA text and validate it with your compliance lead.

How the CIS mapping to the HIPAA text works and where it stops

The CIS Controls Navigator for v8.1 includes a mapping to the HIPAA regulation text (2013), so a team that already runs CIS Safeguards can see which of them line up with HIPAA provisions. That mapping is a navigation aid. It tells you where a Safeguard and a HIPAA provision touch the same subject, which is useful for building a traceability matrix and for deciding which CIS Safeguards to implement first. CIS states that the Controls do not replace any regulatory, compliance or authorization scheme, so the mapping does not turn a CIS implementation into HIPAA compliance. Confirm the mapping's version and coverage yourself: check that the Navigator entry cites the 2013 text, list which Security Rule standards and implementation specifications it touches, and record any HIPAA provisions it leaves blank.

A mapping shows correspondence, not sufficiency. It cannot prove that a Safeguard satisfies an addressable specification in 45 CFR 164.306(d), because that determination depends on your risk analysis under 45 CFR 164.308(a)(1)(ii)(A), your documented reasoning and any equivalent alternative measure you chose. Nor does a mapping equal an equivalence finding. CIS publishes it as a reference, and listing a Safeguard against a HIPAA provision does not mean HHS accepts the Safeguard as meeting that provision. The same caution applies to every mapping in the Navigator, so treat the entries as starting points for your own evidence, not as proof you can hand to OCR.

Practically, a covered entity or business associate should run a short review before relying on the mapping in an audit file. Pick a sample of Security Rule standards, trace each to the mapped Safeguards, and ask whether the Safeguard's CIS Assessment Specification measures and metrics would produce evidence an examiner can read. Where the mapping is thin, such as in documentation and workforce standards that CIS Safeguards describe only indirectly, plan your own policies and procedures. Keep the mapping version in your records, because the Navigator is updated and an entry you cite today may change.

Where CIS Controls work overlaps HIPAA safeguards

HIPAA sets the Security Rule standards for ePHI but leaves the method open, so CIS Safeguards are a practical way to build the controls behind several of them. The overlap is strongest in areas where a CIS Safeguard and a HIPAA standard describe the same operational outcome, but every pairing must be checked against the regulation text and your own environment.

Risk analysis inputs

The HIPAA risk analysis is a required implementation specification that asks for an accurate and thorough assessment of risks to ePHI. CIS Controls v8.1 starts with asset inventory and software inventory, and those lists are the inputs a risk analysis needs to know where ePHI lives. Check whether your inventory covers systems that store, process or transmit ePHI, including cloud services and endpoints. The CIS inventory Safeguards do not perform the risk analysis for you.

Access control and authentication

HIPAA access control standards require technical policies that limit ePHI access to authorized people and software, and it leaves the specific mechanisms to the entity. CIS Safeguards on account management, access granting and revocation, and multi-factor authentication address the same outcome. Confirm which Safeguards your IG level requires and how they map to the access control and person or entity authentication standards in your own risk analysis.

Audit logging and monitoring

HIPAA's audit controls standard requires hardware, software and procedural mechanisms that record and examine activity in systems containing ePHI. CIS Safeguards on audit log collection, retention and review cover much of this ground. Confirm which systems produce logs that capture ePHI access, how long logs are kept under your own policies, and who reviews them. The CIS Controls do not define a retention period for you.

Data protection and encryption

HIPAA's integrity and transmission security standards require protection of ePHI in transit and against improper alteration, with encryption treated as an addressable specification. CIS data protection Safeguards cover data inventory, classification, encryption and secure disposal. Check that your data classification identifies ePHI explicitly, and document the reasoning for any addressable encryption decision, since the CIS Safeguard alone does not record that justification.

Incident response and recovery

HIPAA's security incident procedures standard requires identifying, responding to and documenting security incidents, and its contingency plan standards require backup and recovery of ePHI. CIS Controls v8.1 includes Respond and Recover security functions with Safeguards on incident response planning, testing and data recovery. Confirm that your incident plan covers ePHI breach assessment and that your recovery Safeguards are tested against ePHI systems specifically.

Governance and workforce security

HIPAA requires designated security responsibility, workforce security and security awareness training. CIS v8.1 adds 25 Safeguards with the Govern function, aligned to NIST CSF 2.0, which cover policy, roles and oversight. Check that the governance Safeguards you adopt name an accountable security official and that workforce training content addresses ePHI handling, since the CIS text is general and not written to the Security Rule's terms.

How recognized security practices under the 2021 HITECH amendment apply

Covered entities are health plans, health care clearinghouses and covered health care providers. The 2021 amendment requires OCR to consider whether recognized security practices were in place for the prior 12 months when it applies certain enforcement and audit activities. The practical question is what the entity can show for that window, not only what its policies say. HHS publishes its Security Rule guidance material as the starting point for that review.

Dated evidence for the 12-month window: Keep records showing which practices ran, when they started and who reviewed them, so the look-back period can be reconstructed.
Risk analysis as the anchor: The required risk analysis under 45 CFR 164.308(a)(1)(ii)(A) is the first document an examiner will expect. Link each adopted practice to the risks it identifies.
CIS mapping as a working aid: A CIS-to-HIPAA mapping can show which Safeguards support which Security Rule standards, but the mapping does not replace your own analysis.
Operating records: Access reviews, patch logs and incident response exercises show that a practice operated, which is stronger than a document that only describes it.

Check with counsel how your documentation would be weighed under the amendment before you cite any framework in an audit response.

Who assesses HIPAA and CIS Controls, and what each produces

This table compares who checks compliance with HIPAA and with the CIS Controls, and what each check produces. Read it to see that HIPAA produces no certificate and that CIS Controls measurement is a method you apply, not a certification of your organization. The main takeaway is that the two sets of evidence answer different questions.

Question	HIPAA Security Rule	CIS Controls v8.1
Who assesses	HHS Office for Civil Rights through complaint investigations, compliance reviews and audits	Your own team or a third party you engage; no CIS assessment of your organization is supplied as a standard step
What it produces	Findings and possible enforcement outcomes, not a certificate or attestation	Internal measurement of each Safeguard using the CIS Controls Assessment Specification, which covers what to measure, not how
Private certificates accepted by HHS	No; HHS does not endorse or recognize private organizations' certifications	Not applicable; CIS does not issue a certificate of HIPAA compliance
Recent federal audit activity	OCR's 2024 to 2025 HIPAA audits reviewed 50 covered entities' and business associates' compliance with provisions most relevant to hacking and ransomware	No comparable federal audit program; CIS mappings are maintained by CIS for reference
Accredited service providers	Not applicable to HIPAA itself; confirm any third-party HIPAA review you buy is a service, not a certification	CIS Controls Accreditation, run with CREST, accredits SecureSuite member organizations offering implementation, auditing or assessment services
Application fees for accreditation	Not applicable	CIS lists an application fee of $1,500 for CREST members and $2,500 for non-members (CIS Controls Accreditation)
What to confirm before buying	Ask whether a vendor claims a HIPAA certification and how that claim relates to OCR findings	Ask whether a provider holds CIS Controls Accreditation and which Safeguards its scope covers

Doing both: start with IG1, then close the HIPAA gaps

This sequence gives a covered entity or business associate a documented, risk-driven baseline that satisfies HIPAA's required specifications while using CIS Safeguards as the working control set. The output is a traceable map from each Safeguard to the Security Rule standards it supports, with the addressable decisions recorded.

Confirm ePHI scope and complete the risk analysis
Start by inventorying where electronic protected health information is created, received, maintained or transmitted, including systems run by business associates. The entity's security or compliance lead owns this step, with input from IT operations and clinical or claims teams. The risk analysis is a required implementation specification under 45 CFR 164.308(a)(1)(ii)(A), so it must be an accurate and thorough assessment of risks to confidentiality, integrity and availability. It is done when the ePHI systems list, the threats and vulnerabilities, and the likelihood and impact ratings are written down and approved by leadership.
Map IG1 Safeguards to Security Rule standards
Take the 56 IG1 Safeguards and map each one to the HIPAA standards in 45 CFR 164.308, 164.310, 164.312, 164.314 and 164.316. CIS maintains a HIPAA mapping in its Navigator, which is a starting point to verify against your own environment, not a substitute for your analysis. Record which Safeguards cover each standard and where a standard has no IG1 coverage. The output is a traceable matrix that a reviewer can follow in both directions.
Document addressable decisions under 164.306(d)
For each addressable implementation specification, decide whether it is reasonable and appropriate in your environment. If it is not, document why and implement an equivalent alternative measure where that is reasonable and appropriate, as 45 CFR 164.306(d) requires. The security or compliance lead signs off on each decision, and legal or privacy counsel reviews any decision that narrows a safeguard. The step is complete when every addressable specification has a recorded yes, no-with-rationale or alternative entry.
Add IG2 and IG3 Safeguards where risk requires
Review the risk analysis results and select IG2 or IG3 Safeguards that address risks IG1 does not cover, such as larger or more complex environments, sensitive data stores or targeted threats. IG2 adds 74 Safeguards to IG1 and IG3 adds the remaining 23, so the additions should be justified by named risks rather than adopted in full. Security architects and system owners implement the additions, and the output is an updated Safeguard map that shows the risk each added Safeguard addresses.
Test Safeguards against the assessment specification
Use the CIS Controls Assessment Specification for v8.1 to define what evidence shows each Safeguard is implemented, including inputs, operations, measures and metrics. The specification says what to measure but not how, so the team must define the test procedures and sampling in its own environment. Internal reviewers or an independent assessor run the tests and record results. The step closes when each Safeguard has a test result and any gaps are logged with owners.
Keep evidence reusable across programs
Store evidence once in a shared repository, tagged by Safeguard ID and HIPAA standard, so one artifact answers both the CIS map and the HIPAA documentation requirements in 164.316. Owners refresh evidence on a schedule they set and record the date and reviewer. The check is that a reviewer can pick any HIPAA standard, trace it to the Safeguards and find current evidence without rebuilding it. This also reduces duplicated work if other frameworks are added later.
Review the baseline when the rule changes
HHS proposed a major Security Rule revision on January 6, 2025 (90 FR 898, RIN 0945-AA22), with comments due March 7, 2025. As of October 2026 no final rule has been published, and the Unified Agenda lists final action as projected for July 2027. Assign an owner to track the Federal Register and revise the HIPAA mapping, addressable decisions and evidence set when a final rule is published. Confirm the current status with HHS before relying on any projected date.

What do buyers ask before hiring help for HIPAA and CIS Controls?

Does a CIS Controls program satisfy HIPAA?

No. A CIS Controls program can support a HIPAA Security Rule program, but it does not satisfy HIPAA by itself. HIPAA sets standards and implementation specifications under 45 CFR Part 164 Subpart C, and CIS states that the Controls do not replace any regulatory, compliance or authorization scheme. CIS maintains a mapping to the HIPAA text, which helps you trace which Safeguards address which HIPAA provisions. The mapping is not a certification, and HHS states that no Security Rule standard requires certification and that HHS does not endorse or recognize private certifications. You still need a documented risk analysis under 45 CFR 164.308(a)(1)(ii)(A), decisions on each addressable specification, and evidence that the program operates.

What drives the cost of a HIPAA and CIS Controls engagement?

The main drivers are the number of ePHI systems in scope, the number of Safeguards you select, and the volume of evidence you must collect. Scope is the largest lever: each system that creates, receives, maintains or transmits ePHI adds asset inventory, configuration review and testing work. Safeguard count rises as you move from Implementation Group 1 (56 Safeguards) to Implementation Group 2 (130 in total) or Implementation Group 3 (all 153). Documentation of addressable decisions is a recurring cost because each decision must be reviewed when systems change. Ask a provider to price these components separately: scoping and gap assessment (one-time), remediation and configuration work (one-time), and ongoing monitoring, evidence refresh and reviews (recurring). Request the written scope before comparing quotes.

How long does a HIPAA and CIS Controls program take to implement?

No researched duration applies to this work, so confirm timing in a written quote rather than relying on a general estimate. The schedule depends on how many ePHI systems are in scope, how current your asset inventory and risk analysis already are, and how many Safeguards you select. Ask the provider to break the timeline into scoping, gap assessment, remediation, evidence collection and handover, and to state which tasks depend on your staff or on vendor responses. Ask what happens if the risk analysis must be redone because systems changed during the engagement.

What does the work need from our own staff?

Expect your staff to supply access, decisions and context that no outside team can supply. The usual inputs are an accurate asset inventory, system owners who can describe data flows for ePHI, access to configuration and logs, and a named decision-maker for each addressable implementation specification. Under 45 CFR 164.306(d), the entity must decide whether an addressable specification is reasonable and appropriate, document why, and implement an equivalent alternative if one is reasonable. Only your organization can make and sign those decisions. Ask the provider which tasks they perform, which they support, and which remain with your team.

Can our internal team run a HIPAA and CIS Controls program without outside help?

Yes, many teams do, provided they have the skills and time to cover the work. The Security Rule is technology neutral and scalable, and CIS says the Controls are free for any organization to use to improve its own cybersecurity, so internal use carries no licensing barrier. The harder questions are whether staff can perform a defensible risk analysis, document addressable decisions consistently, and collect evidence that holds up under an OCR complaint investigation or compliance review. NIST SP 800-66 Rev. 2 provides a resource guide with key activities and sample questions for each standard, and it is informational rather than legally binding. Outside help is most useful for scoping, independent review of your decisions, and a gap assessment before an audit.

How does CIS licensing affect commercial use of the Controls?

CIS Controls content is licensed under Creative Commons Attribution-NonCommercial-NoDerivatives 4.0, and commercial use requires CIS's prior approval. CIS states that the Controls are free for any organization to use to improve its own cybersecurity. In practice, using the Controls to run your own HIPAA program is internal use. Building a paid service or product on the Controls text, or redistributing modified versions, falls under the commercial terms. Ask any provider whether they hold the approvals their work requires, and read the CIS Controls Assessment Specification terms of use before reusing its measures in client deliverables. This is a licensing question for counsel, so confirm the position for your specific use.

Does DeployOpen issue a HIPAA certificate or CIS Controls certification?

No. There is no HIPAA certification to issue, and DeployOpen does not issue audit reports, attestations or certifications. DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted platforms in your own infrastructure, and it prepares systems, controls and evidence for compliance assessments. Independent auditors and certification bodies perform any formal assessment. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and ongoing support and continuous testing are available as retainers. DeployOpen does not publish a price list, so a quote follows from the written scope.

What to confirm in your environment before choosing a baseline

Before you map anything to the CIS Controls, confirm where electronic protected health information actually lives. Start with an inventory of every system that creates, receives, maintains or transmits ePHI, including EHR databases, backups, file shares, email, analytics copies and endpoints used by clinical and billing staff. The Security Rule requires an accurate and thorough risk analysis under 45 CFR 164.308(a)(1)(ii)(A), and that analysis can only be as complete as this inventory. Under CIS v8.1, the asset classes Devices, Software, Data, Users, Network and Documentation give you a practical way to tag each system, so confirm which Safeguards apply to which asset class in your environment before you claim coverage.

Next, identify every business associate that touches ePHI, including cloud hosts, managed service providers, billing clearinghouses and support vendors with remote access. Ask each one which Safeguards they operate, which they inherit from you, and what evidence they can provide. A CIS mapping to the HIPAA regulation text does not transfer obligations to a vendor, so the contract and the business associate agreement must still define who does what. Also confirm which CIS mapping version your assessors and customers expect. The Navigator covers v8.1, and you should check whether any contract or auditor refers to an earlier release before you cite a Safeguard number in a policy or a risk register.

Finally, check the regulatory horizon and your documentation. HHS proposed a major Security Rule revision on January 6, 2025, and as of October 2026 no final rule has been published, so ask counsel whether the proposal would change the baseline you are building and how you would track it. For documentation, OCR's HIPAA audit program reviews compliance with Security Rule provisions, so plan to show your risk analysis, risk management decisions, policies, the documented reason for each addressable specification you did not implement as written, and evidence that controls operate in practice. Use the CIS Controls Navigator to see which Safeguards map to each HIPAA section, then confirm those mappings with your own compliance lead rather than treating them as legal conclusions.

How DeployOpen scopes HIPAA and CIS Controls readiness

DeployOpen plans, implements, documents and supports self-hosted open-source platforms inside the client's own infrastructure, so HIPAA and CIS Controls work starts from your systems and ePHI flows rather than a generic template. Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work begins.

How we scope

Written scope names the systems, ePHI data flows and business associates included in the HIPAA readiness work.
Scope states which CIS Controls Safeguards and Implementation Group are targeted, with the mapping to Security Rule standards documented.
Scope lists the risk analysis inputs the client supplies, so each assumption is visible before work starts.
Scope sets out what is excluded, such as policy legal review or any assessment performed by an outside party.

How we build

Technical controls are configured on the client's own cloud accounts, data centers or air-gapped networks against agreed Safeguards.
Security testing of in-scope applications, APIs and infrastructure checks whether implemented controls work as documented.
Each Safeguard is traced to its Security Rule standard and implementation specification, including addressable decisions and their documented rationale.
Logging, access and backup configurations are hardened and recorded so evidence can be collected during review.

How we hand over

Deliverables include configuration documentation, the control mapping and the evidence collection procedures agreed in scope.
Documentation explains which items the client's compliance lead, legal counsel or an outside assessor must still confirm.
Runbooks and training for the client's operators are delivered so the controls can be run after the engagement closes.
Handover states clearly that DeployOpen prepares evidence but does not issue HIPAA certification or audit reports.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the initial fixed-scope work.
Retainers can cover periodic re-mapping when CIS Controls or HHS guidance changes, if the client asks for it in writing.
Support can extend to preparing evidence for a risk analysis refresh or an OCR audit request, scoped in advance.
Any change to scope, such as a new ePHI system, is priced and agreed in writing before the work starts.

HIPAA vs CIS Controls