HIPAA Security Rule
The Health Insurance Portability and Accountability Act's Security Rule sets administrative, physical, and technical safeguards for electronic protected health information (ePHI), enforced by HHS's Office for Civil Rights.
HIPAA itself dates to 1996, but its Security Rule — the part that actually governs cybersecurity practice — sets requirements across three safeguard categories: administrative (risk analysis, workforce training, contingency planning), physical (facility access controls, device and media controls), and technical (access control, audit controls, integrity controls, transmission security). It applies to "covered entities" (health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically) and their "business associates" — vendors who handle ePHI on a covered entity's behalf under a Business Associate Agreement (BAA).
HHS proposed a significant update to the Security Rule in January 2025 that would make several currently "addressable" safeguards mandatory — including multi-factor authentication and encryption of ePHI at rest and in transit — and add more prescriptive technical requirements generally. As a proposed rule, it is not yet in force; organizations should track its status with HHS directly rather than assume it is already a binding requirement.
Who is impacted
Covered entities (health plans, healthcare clearinghouses, healthcare providers who transmit health information electronically) and their business associates — which in practice includes most software vendors, cloud providers, and billing services that touch health data on a covered entity's behalf.
Requirements
A documented risk analysis and risk management process; workforce security and training; contingency planning (backup, disaster recovery, emergency mode operation); access control, audit controls, and transmission security for ePHI; and a signed Business Associate Agreement wherever a vendor handles ePHI on a covered entity's behalf.
Key deadlines
HIPAA Security Rule compliance date
Proposed Security Rule update published (NPRM)
Executive guides & research
HIPAA: The Complete Executive Guide
The Privacy Rule, Security Rule, and Breach Notification Rule explained — safeguard categories, Business Associate Agreements, and the proposed Security Rule update's current status.
Templates & checklists
Glossary
Addressable Safeguard
A HIPAA Security Rule safeguard an organization must assess and either implement, implement an equivalent alternative to, or document why it isn't reasonable — not optional, despite the name, but more flexible than a "required" safeguard. HHS's 2025 proposed rule would convert several addressable safeguards to required ones.
Business Associate Agreement (BAA)
The contract HIPAA requires between a covered entity and any vendor ("business associate") that creates, receives, maintains, or transmits protected health information on the covered entity's behalf.
Related regulations
Related
Stay ahead of HIPAA changes
Get Regulatory Alerts the moment something about HIPAA Security Rule changes — new deadlines, guidance updates, enforcement actions.