HIPAA Security Rule
The HIPAA Security Rule establishes standards for protecting electronic protected health information (ePHI). It requires covered entities and business associates to implement administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of ePHI. Unlike the Privacy Rule, which covers all PHI, the Security Rule applies specifically to electronic data.
Key Points
Requires a risk analysis to identify threats to ePHI (this is the #1 audit finding when missing)
Safeguards are divided into three categories: administrative, physical, and technical
Some specifications are 'required' and others are 'addressable' (must implement or document why an alternative is equivalent)
Workforce members must have unique user IDs and appropriate access levels
Audit controls must record and examine activity in systems containing ePHI
ePHI must be encrypted in transit and at rest (addressable but strongly recommended)
Key Areas
Administrative Safeguards
Risk analysis, workforce security, access management, training
Physical Safeguards
Facility access, workstation use, device controls
Technical Safeguards
Access control, audit controls, integrity, transmission security
Organizational Requirements
Business associate contracts, group health plans
Key Provisions
Administrative Safeguards
The largest section. Covers risk analysis, workforce security, access management, security awareness training, incident procedures, contingency planning, and evaluation.
Physical Safeguards
Facility access controls, workstation use and security, and device and media controls. Covers everything from server room locks to laptop disposal.
Technical Safeguards
Access controls (unique user IDs, emergency access), audit controls, integrity controls, person/entity authentication, and transmission security (encryption).
Policies and Documentation
All security policies must be documented, retained for 6 years, and made available to workforce members. If it's not written down, it doesn't exist for audit purposes.