HIPAA vs NIST 800-171: which to pursue first when you hold both ePHI and CUI
HIPAA is driven by law and NIST SP 800-171 is driven by contract. The Security Rule at 45 CFR Part 164 Subpart C applies to electronic protected health information held by covered entities and business associates, and the HHS Office for Civil Rights enforces it through complaint investigations, compliance reviews and audits. NIST SP 800-171 applies to controlled unclassified information in nonfederal systems because a federal contract or grant requires it, so the starting point is the clause in each agreement. For a research hospital or health IT contractor holding both, the practical answer is to pursue both programs at once on one shared control inventory. Map every system to the obligation that governs it, and flag the systems that hold both data types, since those carry both sets of requirements.
The two frameworks differ in how much room they give you. The Security Rule is flexible: 22 of its 36 implementation specifications are addressable, which means you assess whether each one is reasonable and appropriate, document the decision, and adopt an equivalent measure where needed. That suits a broad covered entity with varied systems. SP 800-171 Rev. 3 is prescriptive, with 97 requirements in 17 families, and it asks the nonfederal organization to assign any organization-defined parameter values that the federal agency leaves open. HIPAA has no certification, because HHS states that no Security Rule standard requires certifying compliance and it does not recognize private certifications. Your CUI assessment, by contrast, depends on the contract, so the evidence you produce for the contract is the proof that counts for that obligation.
How HIPAA Security Rule and NIST SP 800-171 differ on scope, structure and proof
This table compares who must comply, how each rule is structured, how much flexibility it allows, how it is enforced, what penalties apply and what proof it produces. Read each row as a question to answer for your own ePHI and CUI systems, since many health organizations with federal work must satisfy both sets of obligations.
| Factor | HIPAA Security Rule (45 CFR Part 164 Subpart C) | NIST SP 800-171 (CUI under contracts) |
|---|---|---|
| Who must comply | Covered entities and business associates must comply for electronic protected health information (45 CFR 164.302). | Obligations arrive through federal contracts and grants. 32 CFR 2002.14(h)(2) requires agencies to use SP 800-171 when setting CUI protection requirements on nonfederal systems. |
| Structure | 18 standards across administrative, physical and technical safeguards, with 36 implementation specifications, plus organizational and documentation standards in sections 164.314 and 164.316. | 97 requirements in 17 families in Rev. 3. Contracts currently reference Rev. 2 with 110 requirements in 14 families, so confirm which version your contract names. |
| Flexibility | Addressable specifications (22 of 36) require a documented assessment of reasonableness and an equivalent alternative measure where appropriate (45 CFR 164.306(d)). | Rev. 3 uses organization-defined parameters. If the federal agency does not assign values, the nonfederal organization must assign them to complete the requirement. |
| Enforcement | HHS OCR enforces through complaint investigations, compliance reviews and audits, including the 2024 to 2025 audits of 50 entities focused on hacking and ransomware provisions. | Enforcement runs through contract terms. DFARS 252.204-7012 requires reporting within 72 hours of discovering a cyber incident and review for evidence of compromise of covered defense information. |
| Penalty facts | Inflation-adjusted civil money penalties for penalties assessed on or after January 28, 2026 range from $145 to $2,190,294 per violation, with a calendar-year cap of $2,190,294 (45 CFR 102.3). | No federal civil penalty schedule is supplied in this comparison. Confirm with the contracting officer which remedies, such as termination or withheld payments, the contract and clauses allow. |
| Proof produced | No HIPAA certificate exists. HHS does not endorse or recognize private certifications, and those do not prevent a later violation finding (HHS FAQ 2003). | Proof depends on the program in force. CMMC Level 2 assessments are performed by C3PAOs and Level 3 by DCMA DIBCAC under 32 CFR Part 170, while a contract may instead require self-attestation. Confirm which applies. |
Who must comply with HIPAA and who must meet NIST 800-171
The first question is which obligation attaches to which data. HIPAA applies by law: covered entities and business associates must comply with the Security Rule for electronic protected health information under 45 CFR 164.302. NIST SP 800-171 applies by contract or grant. Under 32 CFR 2002.14(h)(2), federal agencies must use SP 800-171 when they set requirements for protecting CUI on nonfederal systems, and those requirements reach the recipient through the award's clauses. Neither trigger depends on the other, so an organization can be bound by both for different data sets. Build a data inventory that tags each system and data flow as ePHI, CUI, both or neither, and record the legal or contractual basis for each tag.
A research hospital is the clearest case of overlap. Its clinical systems hold ePHI as a covered entity, while a federally funded study may place CUI in the same research network, file shares or analytics environment. (This is an illustrative example.) In that network, HIPAA's flexible standards and the prescriptive SP 800-171 requirements both apply to the same hosts. The decision to make is architectural: either isolate the CUI in a bounded enclave that carries the 800-171 scope, or raise the whole research network to the 800-171 baseline. A health IT contractor often faces the enclave choice directly, with its CUI in a separate environment and its ePHI handled under business associate agreements with customers. The enclave limits where 800-171 applies, but it does not move ePHI out of HIPAA's reach wherever the contractor's services store or process it.
The version in force matters as much as the scope. The DoW's Class Deviation 2026-O0025, Revision 3, signed 3 September 2026, has contracting officers use a revised DFARS 252.204-7012 that names SP 800-171 Revision 2. The deviation cites a 13 July 2026 DoW CIO memorandum that requires baseline compliance with Rev. 2 while CMMC Phase 2 is suspended. A FAR overhaul proposed rule published 23 June 2026 would instead require SP 800-171 Rev. 3 with organization-defined parameter values published by the DoW CIO. That rule was not final as of October 2026. Confirm with each contracting officer which clause, deviation and revision each contract, task order or grant incorporates, and whether any modification changes it. Also confirm how DFARS 252.204-7012's 72-hour reporting duty for cyber incidents will be coordinated with your HIPAA incident and breach procedures, and involve counsel on both.
Where HIPAA and NIST 800-171 controls overlap in practice
These six areas recur in both control sets, so one body of evidence can often answer both. Treat every listed mapping as a starting point: NIST does not check the correctness of non-NIST mappings, and a listed mapping is not an equivalence claim, so you must verify coverage against your own systems.
Access control
HIPAA's technical safeguards in 45 CFR 164.312(a) require unique user identification and emergency access procedures, and NIST SP 800-171's 03.01 family covers account management, least privilege and session control for CUI systems. The CIS Controls Navigator lists mappings between these areas, but a mapping only points to candidate controls. Confirm that one account model satisfies both sets, including admin roles, session settings, and whether shared or service accounts fall inside each scope.
Audit logging
The audit controls standard in 164.312(b) requires mechanisms that record and examine activity in systems that hold ePHI, while the 03.03 audit and accountability family in SP 800-171 sets logging and review requirements for CUI. Both frameworks depend on the same log sources, so one pipeline can serve both if its coverage matches each boundary. Log scope must match both boundaries. Set retention separately for each obligation, and confirm who reviews the logs and how often.
Incident response and reporting
HIPAA's security incident procedures in 164.308(a)(6) and the 03.06 incident response family in SP 800-171 both require detection, response and documented handling. The clocks differ. DFARS 252.204-7012 requires reporting within 72 hours of discovery of a cyber incident affecting covered defense information, while HIPAA breach notification follows its own rules outside the Security Rule. Map one runbook to two reporting clocks, then confirm each deadline and recipient with counsel.
Media and physical protection
HIPAA's physical safeguards in 164.310 cover facility access, workstation use, and device and media controls, including disposal and reuse of media that hold ePHI. SP 800-171 addresses similar ground in its 03.08 media protection and 03.10 physical protection families for CUI. Backup tapes, laptops and removable drives are where the two scopes most often overlap. Inventory every media type that holds both ePHI and CUI, and confirm that the disposal method meets both sets.
Configuration and risk assessment
The Security Rule requires an accurate and thorough risk analysis under 164.308(a)(1)(ii)(A), and SP 800-171 includes configuration management (03.04) and risk assessment (03.11) families. Risk findings can feed both programs, but SP 800-171A Rev. 3 prescribes examine, interview and test methods that HIPAA does not. Ask whether one risk register can record findings against both control sets, and whether baseline configurations are documented for systems in each scope.
System security planning
Section 164.316 requires written policies and procedures that stay current, and NIST SP 800-66 Rev. 2 gives key activities and sample questions for implementing them. SP 800-171 Rev. 3 added a Planning family, so a system security plan is now a named requirement area for CUI. Use one system security plan with two boundaries that names the ePHI and CUI systems, the owner of each control, and the review cadence, and record any organization-defined parameters you must set where the federal agency has not.
Who assesses each framework and what the assessment produces
This table compares who checks HIPAA Security Rule compliance and NIST SP 800-171 requirements under federal contracts, and what proof each process produces. Read it to see which obligations are enforced by a regulator, which by a contracting agency, and where a dual-track program must keep separate evidence.
| Element | HIPAA Security Rule | NIST SP 800-171 under contract |
|---|---|---|
| Who enforces or assesses | HHS Office for Civil Rights through complaint investigations, compliance reviews and audits | Contracting agency sets the requirement; self-assessment or CMMC assessment by a C3PAO (Level 2) or DCMA DIBCAC (Level 3) under 32 CFR 170.17 and 170.18 |
| Recent audit activity | OCR's 2024 to 2025 HIPAA audits review 50 covered entities' and business associates' compliance with provisions most relevant to hacking and ransomware | Assessment scope follows the contract and CUI handling; confirm current Level and phase status with the contracting officer |
| Assessment method | OCR examines documented compliance with required and addressable specifications; NIST SP 800-66 Rev. 2 is an informational guide | SP 800-171A Rev. 3 uses determination statements with examine, interview and test methods |
| Proof produced | No HIPAA certificate exists; HHS does not endorse private certifications, so evidence is your documentation and OCR findings | CMMC Level 2 or Level 3 certification or a self-assessed score tied to the contract; no HIPAA-style certificate |
| Assessment cycle | No fixed cycle in supplied facts; confirm expected review timing with OCR guidance and your own risk analysis | Set by the contract and CMMC rules; confirm the assessment validity period and reporting duties in your contract |
| Penalty exposure | Civil money penalties under 45 CFR 102.3; inflation-adjusted range for penalties assessed on or after January 28, 2026 runs from $145 to $2,190,294 per violation | Contract remedies and False Claims Act exposure apply; confirm specific remedies with counsel and your contract clauses |
| Reporting clock | Breach notification duties apply under HIPAA rules; confirm timing requirements with counsel | DFARS 252.204-7012 requires reporting within 72 hours of discovery of a cyber incident to DoD |
| Who to ask | OCR guidance and your privacy and security counsel | Contracting officer, DoD CIO guidance and the CMMC program rules in 32 CFR Part 170 |
Why the NIST 800-171 version and the HIPAA rule update both matter
Your control inventory has to survive two version changes at once. On the federal side, NIST withdrew SP 800-171 Rev. 2 on 14 May 2024, yet CMMC Level 2 still assesses DoD contractors against its 110 requirements in 14 families. The DoW Class Deviation 2026-O0025, Revision 3, signed 3 September 2026, has contracting officers use a revised DFARS 252.204-7012 that names Rev. 2 explicitly, citing a 13 July 2026 DoW CIO memorandum that requires baseline compliance with Rev. 2 while CMMC Phase 2 is suspended. Rev. 3 contains 97 requirements in 17 families, numbered 03.01.01 to 03.17.03, and introduces organization-defined parameters (ODPs) that you may have to assign yourself if the agency does not. A FAR overhaul proposed rule of 23 June 2026 would move contractors to Rev. 3 with ODP values published by the DoW CIO, but it was not final as of October 2026.
The HIPAA side is also unsettled. HHS proposed a major Security Rule revision on 6 January 2025 (90 FR 898, RIN 0945-AA22), with comments due 7 March 2025. As of October 2026 no final rule has been published, and the latest Unified Agenda lists the rule under Long-Term Actions with final action projected for July 2027. Until then, the current 45 CFR Part 164 Subpart C text governs, so a proposed change is a planning input, not a requirement. Ask your privacy and security counsel which provisions of the proposal would touch the same systems you already assess under 800-171.
Build the inventory so either change can be absorbed without a rewrite. Record each control once, with its owner, evidence source and system boundary, and tag it to both the 800-171 requirement and the HIPAA standard it supports. Keep a separate field for the Rev. 2 and Rev. 3 numbering and for any ODP values you have set. Before you commit effort, confirm in writing with the contracting officer which revision and DFARS clause your contracts reference, and confirm HIPAA direction with current HHS Security Rule guidance and your own compliance counsel.
How to run both programs in one order without duplicating evidence
This sequence sets data boundaries and the contract revision first, then builds one control inventory that carries evidence for both HIPAA and NIST SP 800-171. Each step produces an artifact the next step reuses. The timing depends on your scope and contract terms, not on fixed durations.
Confirm which data sits in which boundary
Identify where ePHI and CUI are created, stored, processed, transmitted and backed up. Pay attention to shared systems such as identity, logging, email and backup, because these often touch both data types. The privacy or compliance lead should work with system owners and the contracting officer's requirements to draw the boundary. Done means a boundary diagram and data flow register that both program owners have signed off, listing each system as ePHI, CUI, both or neither.
Map HIPAA and 800-171 requirements to one inventory
Use NIST SP 800-66 Rev. 2 to read what each HIPAA standard expects, then align those standards with the 800-171 requirements that cover the same controls. Use published crosswalks, such as the CIS Controls Navigator mappings to both 800-171 Rev. 2 and Rev. 3, as starting points only, because NIST does not check the correctness of non-NIST mappings. Done means one control inventory where each row names the HIPAA citation, the 800-171 requirement ID, a control owner and the evidence source.
Close required HIPAA specifications and confirm contract revision
Implement the required specifications first, since the Security Rule's 36 implementation specifications include 14 required ones that carry no alternative. In parallel, get written confirmation from the contracting officer of which SP 800-171 revision governs. DoW Class Deviation 2026-O0025, Revision 3 names Rev. 2 explicitly, while the June 2026 FAR overhaul proposal would require Rev. 3, and that rule was not final as of October 2026. Done means a gap register for required items and the revision confirmation filed in the contract record.
Document each addressable decision under 164.306(d)
For each of the 22 addressable specifications, assess whether it is reasonable and appropriate in your environment. If it is not implemented as written, record why and implement an equivalent alternative measure where that is reasonable and appropriate. Where an 800-171 requirement already addresses the same risk, reference it in the decision record so the reasoning appears once. The security or privacy officer approves each record. Done means a decision record for every addressable specification, with the rationale and any alternative measure linked to the inventory row.
Assign organization-defined parameter values
This step applies when Rev. 3 governs, because it introduced organization-defined parameters. NIST's OSCAL catalog defines 88 ODPs across 50 of the 97 requirements, and NIST does not assign their values. If the federal agency does not specify them, your organization must, so set values that match your HIPAA review cycles, retention periods and incident procedures. Ask the contracting officer whether DoW-published values will apply, since the proposed FAR rule refers to them. Done means an ODP register, approved by the control owners, cross-referenced to the inventory.
Test controls and tag evidence once
Assess each control once using the examine, interview and test methods in SP 800-171A Rev. 3, which includes the test method for 93 of the 97 requirements. Collect each artifact a single time, such as a configuration export, access review or training record, and tag it to every HIPAA citation and 800-171 requirement it supports. Gaps found here feed back into the inventory and the gap register. Done means an evidence index in which each artifact appears once, carries both tags and has a named owner and collection date.
Prepare evidence packages for assessor and OCR
Build separate packages from the same evidence index: one for the contract assessor and one for OCR, which enforces the Security Rule through complaint investigations, compliance reviews and audits. OCR's 2024 to 2025 audits focus on provisions most relevant to hacking and ransomware, so include those in the OCR package. If the contract covers DFARS 252.204-7012, add the incident review and the reporting path, since the clause requires rapid reporting within 72 hours of discovery. Done means both packages reviewed by counsel, with the decision records and ODP register attached.
What buyers ask before hiring outside help for HIPAA and NIST 800-171
What drives the cost and effort of HIPAA and NIST 800-171 work?
The main drivers are the size of the boundary, the number of systems that handle ePHI or CUI, and how many addressable decisions must be documented. HIPAA cost depends on how many electronic systems hold ePHI, how many business associates touch it, and whether your risk analysis and documentation already exist. NIST 800-171 cost depends on how many nonfederal systems process CUI, which contract version applies, and how mature your evidence is. Outside help is paid for planning, implementation, documentation and evidence preparation, and those costs are largely one-time with recurring work for reviews and changes. Ask any provider for a written quote that lists the systems in scope, the deliverables and the assumptions behind each line, since DeployOpen issues quotes only from an agreed written scope.
Can our own team run HIPAA and NIST 800-171 work without outside help?
Yes, many organizations do the work in-house, and the decision depends on capacity and on who owns the evidence. HHS states that the Security Rule has no certification requirement, so a HIPAA program is built and documented by your own workforce if you choose. NIST SP 800-66 Rev. 2 and SP 800-171 Rev. 3 with SP 800-171A Rev. 3 give detailed guidance you can work from. Outside help is most useful when the team lacks time, when CUI and ePHI share systems, or when an independent review of your evidence is needed. DeployOpen plans, implements, documents and prepares evidence for these programs, but it does not issue audit reports, attestations or certifications.
What does the work need from our staff and systems?
The work needs named owners for each system, access to configuration and logs, and people who can answer questions about data flows. Expect to supply an inventory of systems that store, process or transmit ePHI or CUI, current policies, network diagrams and access records. For NIST 800-171, you also need to assign organization-defined parameter values where the federal agency has not set them, because the nonfederal organization must assign them to complete a requirement. Confirm with your contracting officer which contract clauses and SP 800-171 revision apply, and confirm your own system owners and change records before work starts.
Does HIPAA require certification?
No. HIPAA has no certification, and HHS states that no Security Rule standard requires an entity to certify compliance. HHS does not endorse or recognize private certifications, and such certifications do not prevent HHS from later finding a violation. The Office for Civil Rights enforces the Security Rule through complaint investigations, compliance reviews and audits, and its 2024 to 2025 HIPAA audits review 50 covered entities and business associates. The proof you should prepare is documented risk analysis, policies, the reasoning behind each addressable decision and evidence that controls operate. Outside help can prepare that evidence, but no provider can certify HIPAA compliance for you.
Who pays for a CMMC assessment and what should a quote include?
Your organization pays for its own readiness work, and the assessment itself is paid to the assessor, which is a C3PAO for Level 2 or DCMA DIBCAC for Level 3 under 32 CFR 170.17 and 170.18. Those assessments are separate from outside preparation work, so a preparation quote does not include the certification assessment. A useful quote lists the in-scope systems, the SP 800-171 requirements covered, the evidence to be prepared, the handling of organization-defined parameters, the testing and documentation deliverables, and what is excluded. Ask whether the price covers one review cycle or ongoing support, since ongoing support is offered as a retainer. Confirm the current assessment fees directly with the assessment body, because this page does not state them.
How long does a HIPAA or NIST 800-171 program take?
Duration depends on boundary size, evidence maturity and how many decisions need management sign-off. The number of systems in scope matters most, followed by whether a current risk analysis and system inventory already exist. NIST SP 800-171 Rev. 3 has 97 requirements in 17 families, and SP 800-171A Rev. 3 adds determination statements and test methods, so the assessment workload scales with the number of CUI systems. Most DeployOpen engagements are fixed-scope, so the timeline is agreed in writing before work starts. Ask for milestones tied to specific deliverables, not a single end date, and confirm contract deadlines with your contracting officer.
Which should we start first, HIPAA or NIST 800-171?
Start with the program that carries the nearest binding obligation, and build the shared controls once. If a federal contract or grant already requires NIST 800-171 for CUI, that contract usually sets the earlier deadline and the stricter test. If HIPAA is the only obligation today, a documented risk analysis is the foundation for both. Many controls, such as access control, audit logging and incident response, can serve both programs, but the HIPAA addressable decisions and the NIST prescriptive requirements still need separate documentation. Map your current controls to both sets before choosing a sequence, and confirm the applicable SP 800-171 revision in your contract.
How does DFARS 72-hour reporting interact with HIPAA breach processes?
They run on separate clocks and go to different recipients, so one incident can trigger both. DFARS 252.204-7012 requires a contractor to rapidly report within 72 hours of discovery of any cyber incident affecting covered defense information, and to report through dibnet.dod.mil. HIPAA breach notification follows its own rules for ePHI, including notice to affected individuals and HHS. Your incident response plan should identify which systems hold ePHI, which hold CUI, and which people decide on each report. Confirm with counsel how the two notices are sequenced and what each must contain, because this page does not set out those notification rules in full.
What to confirm with your contracting officer and compliance team
Start by confirming the exact contract clause and the SP 800-171 revision it names. Do not assume the revision from the program name. DFARS 252.204-7012 is the clause most DoD contractors will see, and the supplied facts show that its revision status has moved in 2026: a DoW class deviation dated 3 September 2026 names Revision 2 explicitly, while a proposed FAR overhaul would require Revision 3 with organization-defined parameter values published by the DoW CIO. Ask the contracting officer which revision applies to each contract, whether any task order sets a different standard, and whether a CMMC level is in the contract. Ask the same question of your compliance team, because a contract that cites Revision 3 changes the requirement set your assessor will use.
Next, establish whether CUI and ePHI share systems. Map every system, database, backup and support account that stores or processes either data type, and record which ones hold both. A shared system carries both obligations, while a separated enclave can carry only the CUI obligations and reduce the ePHI footprint. Confirm the CUI category's authority with the contracting officer or the agency's CUI program, because 32 CFR 2002.14(h)(2) allows the category's own authority to prescribe other safeguards. Also ask who sets the ODP values for Revision 3 requirements. If the federal agency does not specify them, the nonfederal organization must assign them, so an undocumented choice can become a gap in the assessment.
Finally, confirm how the work will be assessed and how OCR may review it. Ask whether the contract requires a self-assessment, a third-party assessment or a government-run certification, and who will perform it. For HIPAA, no certificate exists and HHS does not recognize private certifications, so ask your compliance team which evidence they will present to OCR during its 2024 to 2025 audit program or a complaint investigation. Record the answers in writing and keep them with the System Security Plan, since a verbal understanding will not hold up at assessment or in an incident review.
How DeployOpen scopes readiness for HIPAA and NIST 800-171
DeployOpen is a Chainscore Labs company that plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure. For organizations that hold both ePHI and CUI, we start by agreeing which systems fall under each control set, then build one evidence base that serves both obligations where the requirements overlap.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts
- We map which systems hold ePHI, which hold CUI, and which handle both, so boundaries are set before controls are chosen
- We confirm which NIST SP 800-171 Rev. 2 or Rev. 3 version your contract requires, since contracting officers may name one
- We record the Security Rule addressable specifications you propose to handle as alternative measures, with written reasoning
How we build
- We implement the Security Rule safeguards and SP 800-171 requirements on your own cloud accounts, data centers or air-gapped networks
- We document organization-defined parameter values for SP 800-171 Rev. 3 and confirm them with the federal customer where they apply
- We configure logging, access control, encryption and incident response procedures and test them against both control sets
- We keep a single control register that links each HIPAA and SP 800-171 requirement to the same implemented evidence
How we hand over
- We deliver written system documentation, control mappings, procedures and evidence collection steps for your assessors
- We run security testing against the in-scope systems and document findings, remediation and retest results
- We document each control set separately so an OCR review or a DoD assessment can each be answered from the same records
- We explain what remains your responsibility, including policy approval, workforce training and the assessment itself
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, and we can align them with contract or audit dates
- We update mappings when HHS finalizes a Security Rule revision or when NIST or DoD changes the applicable SP 800-171 version
- We confirm with your compliance counsel and assessors how the readiness work is used, since DeployOpen does not issue audit reports or certifications
- We review changes to in-scope platforms and records the impact on both HIPAA and CUI controls
Sources and further reading
- 45 CFR Part 164 Subpart C, Security Standards for the Protection of Electronic Protected Health Information ↗
- Appendix A to Subpart C of Part 164, Security Standards: Matrix ↗
- NIST SP 800-66 Rev. 2, Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide ↗
- NIST SP 800-171 Rev. 3 ↗
- NIST FAQ: SP 800-171 Rev. 3 and SP 800-171A Rev. 3 ↗
- HHS FAQ 2003: Are we required to certify our organization's compliance with the standards? ↗
