In an age where data breaches and cyberattacks against healthcare organizations are increasingly common, protecting sensitive patient information is critical. The Health Insurance Portability and Accountability Act (HIPAA) is the backbone of health information privacy and security in the United States, and the HIPAA Security Rule is the part of it that specifically safeguards electronic protected health information (ePHI).
This guide explains what the Security Rule requires today, who must comply, how required and addressable safeguards work, what the proposed Security Rule update would change, and how organizations can put the rule into practice. It's written for compliance officers, security leaders, and IT teams at covered entities and business associates.
Status update (November 2026): HHS published a proposed overhaul of the HIPAA Security Rule in the Federal Register on January 6, 2025. As of November 2026, it is still a proposed rule, not a final one. The latest federal regulatory agenda lists July 2027 as the target date for a final rule (RIN 0945-AA22), and that date is not binding. Until a final rule is published, the current Security Rule is the one the HHS Office for Civil Rights (OCR) enforces. We explain the proposed changes in a separate section below and will update this article when a final rule is released.
What is the HIPAA Security Rule?
The HIPAA Security Rule establishes national standards to protect electronic protected health information that covered entities and business associates create, receive, maintain, or transmit. It requires administrative, physical, and technical safeguards that ensure the confidentiality, integrity, and availability of ePHI and protect it against reasonably anticipated threats and unauthorized uses or disclosures.
The rule is codified at 45 CFR Part 160 and Part 164, Subparts A and C. Congress passed HIPAA in 1996, and the Department of Health and Human Services (HHS) published the Security Rule in February 2003. To quote HHS, "compliance with the Security Rule was required as of April 20, 2005 (April 20, 2006 for small health plans)." The Health Information Technology for Economic and Clinical Health (HITECH) Act and the 2013 Omnibus Rule later made business associates directly liable for Security Rule compliance.
HIPAA Security Rule vs. HIPAA Privacy Rule
The Security Rule is one of several HIPAA rules, and it's often confused with the HIPAA Privacy Rule. The Privacy Rule sets standards for how all protected health information, in any form, may be used and disclosed, and it gives patients rights over their health records. The Security Rule is narrower: it covers only electronic PHI and focuses on the security standards and safeguards that keep it confidential, intact, and available. A third rule, the Breach Notification Rule, requires notification after a breach of unsecured PHI, and breaches affecting 500 or more individuals are published on the HHS breach portal. Together, these rules define what HIPAA compliance means for covered entities and business associates.
The Security Rule is flexible by design. It doesn't prescribe specific technologies. Instead, each organization must choose reasonable and appropriate measures based on its size, complexity, technical infrastructure, the cost of security measures, and the likelihood and impact of risks to ePHI.
Key terms and definitions associated with the Rule
Covered entities: Health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically in connection with HIPAA transactions. These organizations are directly subject to HIPAA rules.
Business associates: Persons or entities that perform functions or activities on behalf of a covered entity, or provide services to a covered entity, that involve the use or disclosure of protected health information. Examples include cloud hosting providers, billing companies, IT service providers, and SaaS vendors that handle ePHI.
Electronic protected health information (ePHI): Individually identifiable health information that is created, stored, transmitted, or received in electronic form or on electronic media.
Risk analysis: An accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. It is the foundation of every other Security Rule decision.
Who must comply with the Security Rule?
The Security Rule applies to covered entities and their business associates:
Health plans: Health insurance companies, employer-sponsored group health plans, HMOs, and government-funded programs such as Medicare, Medicaid, and military and veterans' health programs.
Healthcare clearinghouses: Organizations that process nonstandard health information into standard formats (or vice versa) for other entities.
Healthcare providers: Providers that submit HIPAA transactions electronically, such as claims. This includes doctors, dentists, chiropractors, psychologists, clinics, nursing homes, and pharmacies.
Business associates and their subcontractors: Any vendor that creates, receives, maintains, or transmits ePHI on a covered entity's behalf, including healthtech and SaaS companies.
The Centers for Medicare & Medicaid Services provides a Covered Entity Decision Tool to help organizations determine whether they are covered entities.
HIPAA Security Rule requirements: the three safeguards
The Security Rule's standards are organized into three groups of safeguards, plus organizational and documentation requirements.
Safeguard | Regulation | What it covers | Examples |
|---|---|---|---|
Administrative safeguards | 45 CFR 164.308 | Policies and procedures that manage the selection, implementation, and maintenance of security measures and workforce conduct | Security management process (risk analysis and risk management), a designated security official, workforce training, security incident procedures, contingency planning, periodic evaluation |
Physical safeguards | 45 CFR 164.310 | Physical protection of electronic information systems, buildings, and equipment from natural hazards and unauthorized intrusion | Facility security plan and access controls that limit physical access, workstation security, device and media controls, disposal and reuse of electronic media |
Technical safeguards | 45 CFR 164.312 | Technology and related policies that protect ePHI and control access to it | Unique user IDs, access controls, audit controls, integrity controls, person or entity authentication, transmission security, encryption |
Organizational requirements | 45 CFR 164.314 | Contracts and arrangements with business associates and group health plans | Business associate agreements that require safeguards for ePHI |
Policies and documentation | 45 CFR 164.316 | Written policies, procedures, and records of required actions | Documentation retained for six years and reviewed periodically |
Required vs. addressable implementation specifications
Many Security Rule standards include implementation specifications, and each one is labeled either required or addressable (45 CFR 164.306(d)).
Required specifications must be implemented. Examples include risk analysis, risk management, a sanction policy, information system activity review, data backup and disaster recovery plans, and unique user identification.
Addressable specifications are not optional. The organization must assess whether each one is reasonable and appropriate for its environment. If it is, the organization implements it. If not, it must document why and implement an equivalent alternative measure where reasonable. Encryption of ePHI at rest and in transit, automatic logoff, and security reminders are all addressable today.
In practice, most organizations encrypt ePHI because few can justify not doing it, and unencrypted data that is lost or stolen typically becomes a reportable breach. The proposed Security Rule update would remove the required/addressable distinction and make almost all specifications mandatory.
The proposed HIPAA Security Rule update: what would change
On December 27, 2024, HHS announced a Notice of Proposed Rulemaking (NPRM) to strengthen the Security Rule. It was published in the Federal Register on January 6, 2025, and the public comment period closed on March 7, 2025. HHS received thousands of comments, and several industry groups have asked HHS to withdraw or significantly revise the proposal.
None of the changes below are in force. They describe what the rule would require if it is finalized as proposed, and the final rule may differ.
Area | Current Security Rule | Proposed rule (not final) |
|---|---|---|
Implementation specifications | Required and addressable | Almost all specifications required, with limited exceptions |
Encryption | Addressable | Required for ePHI at rest and in transit, with limited exceptions |
Multi-factor authentication | Not specifically required | Required, with limited exceptions |
Penetration testing | Not explicitly required | At least once every 12 months |
Vulnerability scanning | Not explicitly required | At least once every six months |
Asset inventory and network map | Not explicitly required | Written inventory and network map of systems that affect ePHI, reviewed at least every 12 months and after relevant changes |
Disaster recovery | Contingency plan required | Ability to restore relevant systems and data within 72 hours |
Compliance audits | Periodic evaluation | Compliance audit at least once every 12 months |
Workforce access changes | Access procedures required | Notify relevant entities within 24 hours when a workforce member's access is changed or terminated |
Business associates | Business associate agreements | Written verification of business associates' technical safeguards at least every 12 months |
The proposal would also require network segmentation, anti-malware protection, removal of extraneous software, and disabling network ports in accordance with the organization’s risk analysis. It would introduce separate technical controls for backup and recovery of ePHI and relevant electronic information systems. These measures are described in the HHS summary of the proposed changes; they are not newly effective requirements under the current Security Rule.
Even before a final rule, many of these controls already reflect what OCR expects to see in a sound risk analysis and risk management program. Organizations that adopt them now will be better protected and closer to compliance with whatever version is finalized.
Watch: Blaze explains the proposed HIPAA Security Rule changes. The video covers the proposal; the status and current requirements are explained above.
Consequences of non-compliance
Non-compliance with the HIPAA Security Rule can lead to civil monetary penalties, corrective action plans, criminal charges in cases of knowing misuse of health information, and lasting damage to patient trust. A data breach is also expensive on its own: IBM's 2025 Cost of a Data Breach report again found healthcare to be the costliest industry for breaches.
OCR uses four penalty tiers based on the organization's level of culpability. The amounts are adjusted for inflation in 45 CFR 102.3. HHS did not make an inflation adjustment for 2026, so the amounts from the 2025 adjustment still apply:
Tier | Culpability | Minimum per violation | Maximum per violation |
|---|---|---|---|
1 | Did not know and, by exercising reasonable diligence, would not have known | $145 | $73,011 |
2 | Reasonable cause, not willful neglect | $1,461 | $73,011 |
3 | Willful neglect, corrected within 30 days | $14,602 | $73,011 |
4 | Willful neglect, not corrected within 30 days | $73,011 | $2,190,294 |
The calendar-year cap for violations of an identical provision is $2,190,294. Under a 2019 notice of enforcement discretion, OCR applies lower annual caps to tiers 1 to 3.
Enforcement cases show that a missing or inadequate risk analysis is the most common finding. In early 2023, Banner Health agreed to pay $1.25 million after a 2016 hack. OCR found:
No analysis to determine risks and vulnerabilities to ePHI across the organization
Insufficient monitoring of information system activity to protect against a cyberattack
No authentication process to safeguard ePHI
No security measures to protect ePHI from unauthorized access during electronic transmission
Since 2024, OCR's Risk Analysis Initiative has produced a steady stream of settlements, including four ransomware-related resolution agreements announced in April 2026. In each case, the organization had not conducted an accurate and thorough risk analysis. You can review current cases on the HHS resolution agreements page.
How to implement the HIPAA Security Rule
1. Conduct a risk analysis
Risk analysis is a required implementation specification under the security management process standard (45 CFR 164.308(a)(1)(ii)(A)) and the first step in implementing the Security Rule. Identify where ePHI is created, received, stored, and transmitted across your information systems, including cloud services, mobile devices, medical devices, and vendors. Then assess threats, vulnerabilities, likelihood, and impact for each. Document the risk assessment and update it when your environment changes. HHS and ONC offer a free Security Risk Assessment Tool that smaller healthcare providers can use as a starting point.
2. Manage the risks you identified
Risk management is also required. Implement security measures that reduce identified risks to a reasonable and appropriate level, prioritized by severity. Tailor them to your organization's size, complexity, and technical infrastructure, and record decisions on every addressable specification.
3. Write and maintain policies and procedures
Document your security policies, procedures, and actions, and keep that documentation for six years from its creation or the date it was last in effect. Review and update it periodically and after operational or environmental changes.
4. Train your workforce
Security awareness and training is a standard under the administrative safeguards. Train all workforce members on their responsibilities, phishing, password management, and incident reporting, and make the training ongoing rather than a one-time exercise. Apply your sanction policy consistently when workforce members don't comply.
5. Manage business associates
Sign business associate agreements with every vendor that handles ePHI and confirm that their safeguards match the risk. For healthtech and SaaS vendors, a recent penetration test report or attestation letter is often the most practical evidence.
6. Test your safeguards
The Security Rule requires periodic technical and nontechnical evaluations of your security measures (45 CFR 164.308(a)(8)). The current rule doesn't explicitly require penetration testing, but testing is one of the most effective ways to verify that access controls, authentication, audit controls, and transmission security work as intended. Penetration testing and vulnerability assessments:
Simulate real attacks against applications, APIs, cloud environments, and networks that store or process ePHI
Expose vulnerabilities, misconfigurations, and weaknesses before attackers find them
Provide evidence for your risk analysis, risk management decisions, and periodic evaluations
Verify that patches and fixes actually closed the issues
The proposed rule would require vulnerability scanning every six months and penetration testing every 12 months, so building that cadence now is a low-regret decision. Our HIPAA penetration testing guide explains scoping, frequency, and the evidence auditors and customers expect, and our article on penetration testing frequency covers how often to test. For healthcare providers and healthtech vendors, our healthcare penetration testing page shows how we scope and report these engagements.
7. Review and audit regularly
Compliance with the Security Rule is an ongoing process, not a one-off project. Review audit logs, access rights, and incident records, repeat the risk assessment when systems change, and use the results to improve your security measures. A culture of compliance, where staff understand their role in protecting ePHI and report issues openly, makes every other safeguard more effective.
Optional further viewing: OCR’s presentation on how HIPAA Security Rule safeguards help defend against cyberattacks examines breach investigations and common attack vectors. Published in October 2023, it provides background on safeguards rather than the proposed rule changes.
Conclusion
The HIPAA Security Rule turns the protection of ePHI into concrete obligations: a documented risk analysis, risk management, administrative, physical, and technical safeguards, and ongoing evaluation. The current rule gives organizations flexibility through addressable specifications, but OCR's enforcement focus on risk analysis, and the proposed update, show where expectations are heading.
Organizations that treat HIPAA compliance as an ongoing program, test their safeguards regularly, and hold their business associates to the same standard will be best placed for both today's rule and whatever the final update requires.
