Security Rule Safeguard Register
Lists the 22 Security Rule standards and their 41 implementation specifications in plain words, required or addressable, with an owner and the evidence to keep.
Available soon
- Format
- Excel
- Size
- 78 KB
- Length
- 14 sheets
- Version
- 1.1
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | The Register sheet lists the standards of the Security Rule (45 CFR 164, Subpart C) as HS-01 to HS-22, each followed by its implementation specifications (HS-01.1 and so on). Every standard that applies to your organisation must be met, and none is optional (HR-03); a few apply only to some organisations (the clearinghouse row under HS-04, and the group health plan standard HS-20). Filter by level, family or Required or Addressable. |
| 2 | Required means implemented: size, cost and the other factors in 164.306(b) may shape how you implement it, never whether (HR-04). Addressable means assessed: if the safeguard is reasonable and appropriate in your environment you implement it; if it is not, you document why and implement an equivalent alternative measure if that is reasonable and appropriate. Addressable never means optional, and is never skipped without a record (HR-05). |
| 3 | Answer "Applies to our environment?" on each row. The question is about the situation the row describes: the clearinghouse row only if you are a clearinghouse, the group health plan standard only if you are a group health plan, and for a hybrid entity only the health care components (HR-22), except HS-19 and HS-20 (164.314), which apply to the whole entity (164.105(a)(1)). For No or Hybrid component only, write the reason under "Implemented how" and have counsel confirm it. Never answer No to avoid an addressable specification; record a decision instead. |
| 4 | Name an owner for each row, starting from the suggested role. Under "Implemented how" write what you actually do, so a reviewer can check it. Pick a status: Not started, Planned, In place, Operating, Not applicable. The status is your own statement, not a finding. |
| 5 | Fill one record on the Addressable Decisions sheet for each of the 22 addressable specifications, in the eight fields AD-01 to AD-08 (HR-06). The "Addressable decision record" column on the Register sheet links to it. |
| 6 | Use the Responsibility sheet to settle who owns which standards, who takes part in decisions HD-01 to HD-06, and to record the security official's written designation (HS-02). |
| 7 | Read the Privacy Rule Pointers sheet before you finish the access rows (HS-04 and HS-14). The Counts sheet counts rows and never adds a score or a percentage. |
| 8 | Review the register at least every [[12]] months (the pack's default; the Rule sets no interval but asks for periodic review of documentation, kept six years) and when a system, supplier or risk changes. Delete the EXAMPLE row on the Addressable Decisions sheet before use. The EXAMPLE sheet is an illustration and can be deleted. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
This document helps a security team see what the HIPAA Security Rule and the breach notification rules ask of an organisation like yours, and what it could show. It is not legal advice. It does not say that you are compliant with HIPAA or that you are certified, and the Rules provide no certificate of compliance. Whether HIPAA applies to your organisation, in which role, and what a breach or a contract requires are for counsel to confirm. The notification deadlines are in P09 (RD-17 to RD-20) and P18, and are not repeated here.
The register restates the Security Rule in our own words. It is not the Rule. The text of 45 CFR Part 164 governs (see the Limits sheet).
Evidence: the "Evidence to keep" column names the records a reviewer would expect and the matching items of the HIPAA Documentation & Evidence Checklist (EV-01 to EV-30). EV-26, EV-27, EV-28, EV-30 belong to no single standard and are in that checklist only.
EXAMPLE: Acme Corp (EXAMPLE), as at 2026-09-30. The EXAMPLE sheet shows 17 register rows filled in for it, and the Addressable Decisions sheet one record, for HS-14.4. The Register sheet itself is blank.
Tailoring — small organisation: one person may own many rows and be the security official too. Keep each row filled.
Tailoring — IT run by a service provider: the duty stays yours. Name the provider under "Implemented how" and your own owner by name.
Register
The 22 standards and 41 implementation specifications of the HIPAA Security Rule, in our words. Grey columns are fixed; yellow columns are yours. This pack does not say which document, record or practice meets a requirement of the HIPAA Rules. Each reference says what its source asks and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.
| ID | Level | Family | Standard or specification | 45 CFR paragraph (of the standard) | What it asks, in our words | Required or Addressable | Suggested owner role | Evidence to keep | Applies to our environment? | Owner (name) | Implemented how | Status | Addressable decision record | Last reviewed |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| HS-01 | Standard | Administrative | Security management process | 164.308(a)(1) | Have policies and procedures that prevent, detect, contain and correct security violations. | Required | Security official | Policy; Risk analysis; Risk management plan; Activity review log. Checklist items: EV-04, EV-05, EV-06, EV-07, EV-08. | ||||||
| HS-01.1 | Specification | Administrative | Risk analysis | 164.308(a)(1) | Assess the potential risks and vulnerabilities to the confidentiality, integrity and availability of all your ePHI, accurately and thoroughly. | Required | Security official | Kept with the standard (HS-01). | ||||||
| HS-01.2 | Specification | Administrative | Risk management | 164.308(a)(1) | Put in place security measures enough to reduce those risks and vulnerabilities to a reasonable and appropriate level. | Required | Security official | Kept with the standard (HS-01). | ||||||
| HS-01.3 | Specification | Administrative | Sanction policy | 164.308(a)(1) | Apply appropriate sanctions to workforce members who do not follow your security policies and procedures. | Required | Security official | Kept with the standard (HS-01). | ||||||
| HS-01.4 | Specification | Administrative | Information system activity review | 164.308(a)(1) | Review records of system activity, such as audit logs, access reports and incident tracking reports, regularly. | Required | Security official | Kept with the standard (HS-01). | ||||||
| HS-02 | Standard | Administrative | Assigned security responsibility | 164.308(a)(2) | Identify the one security official who is responsible for developing and implementing the security policies and procedures. | Required | Executive sponsor | Written designation. Checklist items: EV-03. | ||||||
| HS-03 | Standard | Administrative | Workforce security | 164.308(a)(3) | Make sure every workforce member has appropriate access to ePHI, and that those who should not have access cannot get it. | Required | HR lead | Procedure; Access records; Leaver records. Checklist items: EV-09. | ||||||
| HS-03.1 | Specification | Administrative | Authorization and/or supervision | 164.308(a)(3) | Have procedures to authorise or supervise workforce members who work with ePHI or where it might be reached. | Addressable | HR lead | The decision record (EV-23), and the measure's own records. | Record for HS-03.1 | |||||
| HS-03.2 | Specification | Administrative | Workforce clearance procedure | 164.308(a)(3) | Have procedures to decide that a workforce member's access to ePHI is appropriate. | Addressable | HR lead | The decision record (EV-23), and the measure's own records. | Record for HS-03.2 | |||||
| HS-03.3 | Specification | Administrative | Termination procedures | 164.308(a)(3) | Have procedures to end access to ePHI when a person's employment or arrangement ends, or when a clearance decision requires it. | Addressable | HR lead | The decision record (EV-23), and the measure's own records. | Record for HS-03.3 | |||||
| HS-04 | Standard | Administrative | Information access management | 164.308(a)(4) | Have policies and procedures to authorise access to ePHI that are consistent with the Privacy Rule. | Required | ePHI system owner | Policy; Access request records; Role definitions. Checklist items: EV-10. | ||||||
| HS-04.1 | Specification | Administrative | Isolating health care clearinghouse functions | 164.308(a)(4) | If you are a clearinghouse that is part of a larger organisation, protect the clearinghouse's ePHI from unauthorised access by the larger organisation. This applies only to clearinghouses. | Required | ePHI system owner | Kept with the standard (HS-04). | ||||||
| HS-04.2 | Specification | Administrative | Access authorization | 164.308(a)(4) | Have policies and procedures to grant access to ePHI, for example through a workstation, transaction, program or process. | Addressable | ePHI system owner | The decision record (EV-23), and the measure's own records. | Record for HS-04.2 | |||||
| HS-04.3 | Specification | Administrative | Access establishment and modification | 164.308(a)(4) | Have policies and procedures to set up, document, review and change a user's right of access. | Addressable | ePHI system owner | The decision record (EV-23), and the measure's own records. | Record for HS-04.3 | |||||
| HS-05 | Standard | Administrative | Security awareness and training | 164.308(a)(5) | Run a security awareness and training programme for all workforce members, including management. | Required | HR lead | Training plan; Attendance records; Reminders sent. Checklist items: EV-11. | ||||||
| HS-05.1 | Specification | Administrative | Security reminders | 164.308(a)(5) | Send periodic security updates. | Addressable | HR lead | The decision record (EV-23), and the measure's own records. | Record for HS-05.1 | |||||
| HS-05.2 | Specification | Administrative | Protection from malicious software | 164.308(a)(5) | Have procedures to guard against, detect and report malicious software. | Addressable | HR lead | The decision record (EV-23), and the measure's own records. | Record for HS-05.2 | |||||
| HS-05.3 | Specification | Administrative | Log-in monitoring | 164.308(a)(5) | Have procedures to monitor log-in attempts and report discrepancies. | Addressable | HR lead | The decision record (EV-23), and the measure's own records. | Record for HS-05.3 | |||||
| HS-05.4 | Specification | Administrative | Password management | 164.308(a)(5) | Have procedures to create, change and safeguard passwords. | Addressable | HR lead | The decision record (EV-23), and the measure's own records. | Record for HS-05.4 | |||||
| HS-06 | Standard | Administrative | Security incident procedures | 164.308(a)(6) | Have policies and procedures to address security incidents. | Required | Security official | Incident procedure; Incident records and outcomes. Checklist items: EV-12. | ||||||
| HS-06.1 | Specification | Administrative | Response and reporting | 164.308(a)(6) | Identify and respond to suspected or known security incidents, reduce their harmful effects as far as practicable, and document each incident and its outcome. | Required | Security official | Kept with the standard (HS-06). | ||||||
| HS-07 | Standard | Administrative | Contingency plan | 164.308(a)(7) | Have policies and procedures for responding to an emergency or other event, such as fire, vandalism, system failure or natural disaster, that damages systems holding ePHI. | Required | IT lead | Backup records; Recovery plan; Emergency mode plan; Test records. Checklist items: EV-13, EV-14. | ||||||
| HS-07.1 | Specification | Administrative | Data backup plan | 164.308(a)(7) | Create and maintain retrievable exact copies of ePHI. | Required | IT lead | Kept with the standard (HS-07). | ||||||
| HS-07.2 | Specification | Administrative | Disaster recovery plan | 164.308(a)(7) | Have procedures to restore any loss of data. | Required | IT lead | Kept with the standard (HS-07). | ||||||
| HS-07.3 | Specification | Administrative | Emergency mode operation plan | 164.308(a)(7) | Have procedures that let critical business processes continue, protecting the security of ePHI, while operating in emergency mode. | Required | IT lead | Kept with the standard (HS-07). | ||||||
| HS-07.4 | Specification | Administrative | Testing and revision procedures | 164.308(a)(7) | Test and revise the contingency plans periodically. | Addressable | IT lead | The decision record (EV-23), and the measure's own records. | Record for HS-07.4 | |||||
| HS-07.5 | Specification | Administrative | Applications and data criticality analysis | 164.308(a)(7) | Assess how critical each application and data set is to the other parts of the contingency plan. | Addressable | IT lead | The decision record (EV-23), and the measure's own records. | Record for HS-07.5 | |||||
| HS-08 | Standard | Administrative | Evaluation | 164.308(a)(8) | Evaluate, periodically, technically and non-technically, your security policies and procedures against the Security Rule's requirements: first against the standards, and again whenever your environment or operations change in a way that affects ePHI. | Required | Security official | Evaluation report; Trigger log. Checklist items: EV-15. | ||||||
| HS-09 | Standard | Administrative | Business associate contracts and other arrangements | 164.308(b)(1) | Let a business associate handle your ePHI only after you have obtained assurances that it will safeguard it, documented in a written contract or other arrangement. A business associate does the same with its own subcontractors. | Required | Vendor owner | Written agreement; Supplier register. Checklist items: EV-16, EV-17. | ||||||
| HS-09.1 | Specification | Administrative | Written contract or other arrangement | 164.308(b)(1) | Document the assurances in a written contract or other arrangement that has the content the organisational requirements ask for. | Required | Vendor owner | Kept with the standard (HS-09). | ||||||
| HS-10 | Standard | Physical | Facility access controls | 164.310(a)(1) | Limit physical access to the electronic information systems and the facilities that house them, while letting properly authorised people in. | Required | Facilities lead | Facility security plan; Access and visitor records; Maintenance records. Checklist items: EV-19. | ||||||
| HS-10.1 | Specification | Physical | Contingency operations | 164.310(a)(1) | Have procedures that allow facility access to restore lost data and run emergency mode operations. | Addressable | Facilities lead | The decision record (EV-23), and the measure's own records. | Record for HS-10.1 | |||||
| HS-10.2 | Specification | Physical | Facility security plan | 164.310(a)(1) | Safeguard the facility and its equipment from unauthorised physical access, tampering and theft. | Addressable | Facilities lead | The decision record (EV-23), and the measure's own records. | Record for HS-10.2 | |||||
| HS-10.3 | Specification | Physical | Access control and validation procedures | 164.310(a)(1) | Control and validate a person's access to the facility by role or function, including visitors and access to software for testing and revision. | Addressable | Facilities lead | The decision record (EV-23), and the measure's own records. | Record for HS-10.3 | |||||
| HS-10.4 | Specification | Physical | Maintenance records | 164.310(a)(1) | Document repairs and modifications to the physical parts of a facility that relate to security, such as hardware, walls, doors and locks. | Addressable | Facilities lead | The decision record (EV-23), and the measure's own records. | Record for HS-10.4 | |||||
| HS-11 | Standard | Physical | Workstation use | 164.310(b) | Specify the proper functions, the manner and the physical surroundings of a workstation, or class of workstation, that can reach ePHI. | Required | IT lead | Workstation use policy. Checklist items: EV-20. | ||||||
| HS-12 | Standard | Physical | Workstation security | 164.310(c) | Put physical safeguards on every workstation that reaches ePHI, so that only authorised users can use it. | Required | Facilities lead | Physical safeguards record. Checklist items: EV-20. | ||||||
| HS-13 | Standard | Physical | Device and media controls | 164.310(d)(1) | Control the receipt and removal of hardware and electronic media that contain ePHI, into and out of a facility and within it. | Required | IT lead | Disposal records; Media re-use records; Movement records. Checklist items: EV-21. | ||||||
| HS-13.1 | Specification | Physical | Disposal | 164.310(d)(1) | Have policies and procedures for the final disposal of ePHI and of the hardware or media it is stored on. | Required | IT lead | Kept with the standard (HS-13). | ||||||
| HS-13.2 | Specification | Physical | Media re-use | 164.310(d)(1) | Have procedures to remove ePHI from electronic media before the media is made available for re-use. | Required | IT lead | Kept with the standard (HS-13). | ||||||
| HS-13.3 | Specification | Physical | Accountability | 164.310(d)(1) | Keep a record of the movements of hardware and electronic media and of who is responsible for them. | Addressable | IT lead | The decision record (EV-23), and the measure's own records. | Record for HS-13.3 | |||||
| HS-13.4 | Specification | Physical | Data backup and storage | 164.310(d)(1) | Make a retrievable exact copy of ePHI, when needed, before equipment is moved. | Addressable | IT lead | The decision record (EV-23), and the measure's own records. | Record for HS-13.4 | |||||
| HS-14 | Standard | Technical | Access control | 164.312(a)(1) | Allow access to systems that hold ePHI only to the people or software that have been granted access rights. | Required | IT lead | Account list; Emergency access procedure; Configuration records. Checklist items: EV-22, EV-23. | ||||||
| HS-14.1 | Specification | Technical | Unique user identification | 164.312(a)(1) | Give every user a unique name or number so that their actions can be identified and tracked. | Required | IT lead | Kept with the standard (HS-14). | ||||||
| HS-14.2 | Specification | Technical | Emergency access procedure | 164.312(a)(1) | Have procedures to get at necessary ePHI in an emergency. | Required | IT lead | Kept with the standard (HS-14). | ||||||
| HS-14.3 | Specification | Technical | Automatic logoff | 164.312(a)(1) | End an electronic session after a set time of inactivity. | Addressable | IT lead | The decision record (EV-23), and the measure's own records. | Record for HS-14.3 | |||||
| HS-14.4 | Specification | Technical | Encryption and decryption | 164.312(a)(1) | Have a mechanism to encrypt and decrypt ePHI. | Addressable | IT lead | The decision record (EV-23), and the measure's own records. | Record for HS-14.4 | |||||
| HS-15 | Standard | Technical | Audit controls | 164.312(b) | Have hardware, software or procedures that record and examine activity in the systems that contain or use ePHI. | Required | IT lead | Logging configuration; Log samples. Checklist items: EV-24. | ||||||
| HS-16 | Standard | Technical | Integrity | 164.312(c)(1) | Protect ePHI from improper alteration or destruction. | Required | IT lead | Integrity controls record. Checklist items: EV-25. | ||||||
| HS-16.1 | Specification | Technical | Mechanism to authenticate electronic protected health information | 164.312(c)(1) | Have electronic mechanisms to confirm that ePHI has not been altered or destroyed in an unauthorised way. | Addressable | IT lead | The decision record (EV-23), and the measure's own records. | Record for HS-16.1 | |||||
| HS-17 | Standard | Technical | Person or entity authentication | 164.312(d) | Have procedures to verify that a person or entity seeking access to ePHI is the one claimed. | Required | IT lead | Authentication configuration. Checklist items: EV-25. | ||||||
| HS-18 | Standard | Technical | Transmission security | 164.312(e)(1) | Have technical measures to guard against unauthorised access to ePHI while it is sent over an electronic network. | Required | IT lead | Transmission configuration; Encryption decision record. Checklist items: EV-25. | ||||||
| HS-18.1 | Specification | Technical | Integrity controls | 164.312(e)(1) | Have security measures to make sure ePHI sent electronically is not changed without detection until it is disposed of. | Addressable | IT lead | The decision record (EV-23), and the measure's own records. | Record for HS-18.1 | |||||
| HS-18.2 | Specification | Technical | Encryption | 164.312(e)(1) | Have a mechanism to encrypt ePHI whenever deemed appropriate. | Addressable | IT lead | The decision record (EV-23), and the measure's own records. | Record for HS-18.2 | |||||
| HS-19 | Standard | Organisational | Business associate contracts or other arrangements | 164.314(a)(1) | Make the contract or other arrangement with each business associate and subcontractor contain what the Rule requires: that it will follow the Security Rule's requirements, bind its own subcontractors, and report any security incident, including breaches of unsecured PHI. | Required | Vendor owner | Agreement; Subcontractor list. Checklist items: EV-17. | ||||||
| HS-19.1 | Specification | Organisational | Implementation specifications | 164.314(a)(1) | Business associate contracts, other arrangements where the Rule allows them, and contracts between a business associate and its subcontractors, each with the required content. | Required | Vendor owner | Kept with the standard (HS-19). | ||||||
| HS-20 | Standard | Organisational | Requirements for group health plans | 164.314(b)(1) | If you are a group health plan, make sure the plan documents oblige the plan sponsor to safeguard the ePHI it handles for the plan. This applies only to group health plans, and not when the only ePHI disclosed to the plan sponsor is disclosed under 164.504(f)(1)(ii) or (iii), or as authorised under 164.508. | Required | Legal counsel | Plan documents. Checklist items: EV-18. | ||||||
| HS-20.1 | Specification | Organisational | Implementation specifications | 164.314(b)(1) | Amend the plan documents to require the plan sponsor to implement safeguards, keep the required separation, bind its agents, and report any security incident to the plan. | Required | Legal counsel | Kept with the standard (HS-20). | ||||||
| HS-21 | Standard | Documentation | Policies and procedures | 164.316(a) | Have reasonable and appropriate policies and procedures to carry out the Security Rule's requirements, and change them whenever needed, provided the change is documented and implemented in line with the Rule. | Required | Security official | Policy set; Change records. Checklist items: EV-01. | ||||||
| HS-22 | Standard | Documentation | Documentation | 164.316(b)(1) | Keep the policies and procedures in writing (electronic is allowed), and a written record of any action, activity or assessment the Rule requires to be documented. | Required | Security official | Document register; Retention records. Checklist items: EV-02, EV-29. | ||||||
| HS-22.1 | Specification | Documentation | Time limit | 164.316(b)(2)(i) | Keep the documentation for six years from the date it was created or the date it was last in effect, whichever is later. | Required | Security official | Kept with the standard (HS-22). | ||||||
| HS-22.2 | Specification | Documentation | Availability | 164.316(b)(2)(ii) | Make the documentation available to the people who carry out the procedures it describes. | Required | Security official | Kept with the standard (HS-22). | ||||||
| HS-22.3 | Specification | Documentation | Updates | 164.316(b)(2)(iii) | Review the documentation periodically and update it when the environment or operations change in a way that affects the security of ePHI. | Required | Security official | Kept with the standard (HS-22). |
Addressable Decisions
One record for each of the 22 addressable specifications. An addressable specification is never optional: this record is where you show that you assessed it and what you decided. The first row is an EXAMPLE.
| Row | AD-01 Specification | Specification name | 45 CFR paragraph | AD-02 Risks it addresses | AD-03 The four factors | AD-04 Reasonable and appropriate? (Yes / No) | AD-04 Reasons | AD-05 Decision | AD-06 The alternative, if any | AD-07 Decided by and on | AD-08 Review |
|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | HS-14.4 | Encryption and decryption | 164.312(a)(1) | ER-01: theft or loss of a laptop. 12 contractor laptops without full-disk encryption, holding cached appointment data on endpoints. Likelihood 3, impact 3, score 9, band High. | Size, complexity and capabilities: about 250 staff, with an endpoint management tool already in use. Technical infrastructure: the 12 laptops can be enrolled in that tool. Cost: small, because the tool's disk encryption is already licensed (an EXAMPLE assumption). Probability and criticality: the risk analysis rates the risk 3 of 4 for likelihood and 3 of 4 for impact; a lost laptop could expose cached appointment data. | Yes | The risk is real and the cost is small, so the safeguard is reasonable and appropriate for this environment. An alternative would add no reduction in risk. | Implement as written | None. The specification is implemented as written. | Max Okafor (EXAMPLE), the security official, proposed on 2026-09-30. The decision is for the person the P05 band names: for band High that is accountable executive and head of information security (HD-03). Decided on 2026-09-30. | With the next risk analysis, and on any trigger: a new system or supplier that handles ePHI, an incident, a merger, or a change in the law. |
| HS-03.1 | Authorization and/or supervision | 164.308(a)(3) | |||||||||
| HS-03.2 | Workforce clearance procedure | 164.308(a)(3) | |||||||||
| HS-03.3 | Termination procedures | 164.308(a)(3) | |||||||||
| HS-04.2 | Access authorization | 164.308(a)(4) | |||||||||
| HS-04.3 | Access establishment and modification | 164.308(a)(4) | |||||||||
| HS-05.1 | Security reminders | 164.308(a)(5) | |||||||||
| HS-05.2 | Protection from malicious software | 164.308(a)(5) | |||||||||
| HS-05.3 | Log-in monitoring | 164.308(a)(5) | |||||||||
| HS-05.4 | Password management | 164.308(a)(5) | |||||||||
| HS-07.4 | Testing and revision procedures | 164.308(a)(7) | |||||||||
| HS-07.5 | Applications and data criticality analysis | 164.308(a)(7) | |||||||||
| HS-10.1 | Contingency operations | 164.310(a)(1) | |||||||||
| HS-10.2 | Facility security plan | 164.310(a)(1) | |||||||||
| HS-10.3 | Access control and validation procedures | 164.310(a)(1) | |||||||||
| HS-10.4 | Maintenance records | 164.310(a)(1) | |||||||||
| HS-13.3 | Accountability | 164.310(d)(1) | |||||||||
| HS-13.4 | Data backup and storage | 164.310(d)(1) | |||||||||
| HS-14.3 | Automatic logoff | 164.312(a)(1) | |||||||||
| HS-14.4 | Encryption and decryption | 164.312(a)(1) | |||||||||
| HS-16.1 | Mechanism to authenticate electronic protected health information | 164.312(c)(1) | |||||||||
| HS-18.1 | Integrity controls | 164.312(e)(1) | |||||||||
| HS-18.2 | Encryption | 164.312(e)(1) |
Responsibility
Responsibility: the security official and who owns what
The Rule asks for one security official (HS-02). Beyond that it names no role. The suggested owners below are the pack's; use your own titles and names. A dash means the role owns no standard in that family, though it may still be asked.
Part 1. Which role owns which standards
| Role | What the role does | Administrative | Physical | Technical | Organisational | Documentation |
|---|---|---|---|---|---|---|
| Security official | The one person named in writing under 164.308(a)(2). Often the head of information security. | Security management process; Security incident procedures; Evaluation | — | — | — | Policies and procedures; Documentation |
| Executive sponsor | The executive who names the security official, owns the risk analysis result and funds the work. | Assigned security responsibility | — | — | — | — |
| ePHI system owner | The business owner of each system that holds ePHI. | Information access management | — | — | — | — |
| IT lead | Runs the systems, backups, accounts and logs. | Contingency plan | Workstation use; Device and media controls | Access control; Audit controls; Integrity; Person or entity authentication; Transmission security | — | — |
| HR lead | Runs joiner, mover and leaver steps, sanctions and records of training. | Workforce security; Security awareness and training | — | — | — | — |
| Facilities lead | Runs physical access and the movement of equipment. | — | Facility access controls; Workstation security | — | — | — |
| Vendor owner | The business owner of each supplier that can reach ePHI, with procurement. | Business associate contracts and other arrangements | — | — | Business associate contracts or other arrangements | — |
| Legal counsel | Confirms the role, the contract terms and any breach decision. | — | — | — | Requirements for group health plans | — |
| Privacy lead | Runs the Privacy Rule duties and, with the security official, the breach assessment. | — | — | — | — | — |
Part 2. Who takes part in each decision
| Decision | Security official | Executive sponsor | ePHI system owner | IT lead | HR lead | Facilities lead | Vendor owner | Legal counsel | Privacy lead | Others named, and notes | Ref. |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Name the security official | Is named | Decides | — | — | — | — | — | — | — | In writing, with the date. One person, not a committee. The name is kept on the register and in the policy. | HD-01 |
| Approve the security risk analysis: its scope, method and result | Signs | Approves | — | — | — | — | — | — | — | A risk accepted instead of treated follows the pack's risk rules (P05 RM-08 and its acceptance bands). The result is a list of risks rated on the P05 scale. A risk accepted instead of treated follows P05 RM-08 and its ACCEPTANCE bands. | HD-02 |
| Decide an addressable specification: implement it or, if that is not reasonable and appropriate, document why and implement an equivalent alternative where that is | Proposes | — | — | — | — | — | — | — | — | The person the P05 acceptance band of the residual risk names decides. The Rule requires the assessment and the record, not a particular person. Using the P05 band keeps the decision with the person who would accept the risk. | HD-03 |
| Approve a business associate agreement | Reviews the security terms | — | — | — | — | — | — | Approves | — | The executive who signs contracts approves, with legal counsel. No contract is signed before the supplier steps of P06 have run. A contract is never signed with a business associate that has not been through the supplier steps in P06. | HD-04 |
| Designate the health care components of a hybrid entity | — | Decides | — | — | — | — | — | Joins the decision | — | The designation is documented and kept (164.105(c)). | HD-05 |
| Decide that an event is or is not a breach to be reported | Signs the assessment | — | — | — | — | — | — | Confirms the breach decision | Signs the assessment | Who decides to report to an authority is as P09 sets. P09's decision rights are unchanged, and the assessment feeds the decision. P09's decision rights are unchanged. The assessment feeds the decision; it never replaces it. | HD-06 |
Part 3. The security official's written designation (HS-02, 164.308(a)(2))
| Field | What to record | Your entry | EXAMPLE entry |
|---|---|---|---|
| Name of the security official | One person, named. A committee or a team mailbox is not the designation. | [[to complete]] | Max Okafor (EXAMPLE) |
| Job title | The title the person holds today. | [[to complete]] | Head of Information Security |
| Date of the written designation | The date the executive sponsor named the person in writing. | [[to complete]] | 2024-06-03 |
| Designated by | The executive sponsor who made the designation. Who is named is the executive sponsor's decision. | [[to complete]] | The chief technology officer (EXAMPLE) |
| Responsibility as written | The responsibility the designation gives, in the Rule's terms: developing and implementing the security policies and procedures. | [[to complete]] | To develop and implement the security policies and procedures (EXAMPLE wording). |
| Where the written designation is kept | The place a reviewer can open it. It is one of the records the evidence checklist lists. | [[to complete]] | The security policy, section 2 (EXAMPLE) |
| Who acts when the security official is absent | The pack suggests recording this. The Rule names one person and says nothing about cover. | [[to complete]] | The IT lead (EXAMPLE) |
| Date the designation was last in effect | Leave blank while the person holds the role. When someone replaces them, enter the date; the earlier designation is kept for six years from then. | [[to complete]] | |
| Date last reviewed | When the designation was last checked against who holds the role. | [[to complete]] | 2026-09-30 |
Keep each designation for 6 years from the date it was created or the date it was last in effect, whichever is later (164.316(b)(2)(i)). If a new security official replaces the old one, the old designation is kept six years from the day it stopped being in effect.
Privacy Rule Pointers
Privacy Rule pointers
Five provisions of the Privacy Rule (45 CFR Part 164, Subpart E) that the Security Rule leans on. They are pointers only. The Privacy Rule is not covered here, and the text of 45 CFR Part 164 governs.
| ID | 45 CFR paragraph | Topic | What it asks, in plain words | Where this register uses it |
|---|---|---|---|---|
| PR-01 | 164.502(b); 164.514(d) | Minimum necessary | Limit PHI used, disclosed or requested to the minimum necessary (covered entities and business associates, 164.502(b)). A covered entity also identifies the roles in its workforce that need access and the categories each needs (164.514(d)(2)). It decides what access the Security Rule's access management then enforces. | Register: HS-04 Information access management and HS-14 Access control. The pack's rule on role-based access (HR-27). |
| PR-02 | 164.502(e); 164.504(e) | Business associate contracts | The Privacy Rule's contract content. The Security Rule's is 164.314(a). One agreement carries both (A05). | Register: HS-09 and HS-19. One agreement carries both sets of terms; the Business Associate Agreement Security Terms document sets out the security terms. |
| PR-03 | 164.530(a)(1) | Privacy official | A covered entity designates a privacy official. The security official is a separate designation under the Security Rule. | Responsibility sheet: the privacy lead. The security official (HS-02) is a separate designation. |
| PR-04 | 164.530(c) | Privacy safeguards | A covered entity has appropriate administrative, technical and physical safeguards to protect the privacy of PHI in any form, including paper. | Not covered here. Paper and other non-electronic PHI is outside the Security Rule (HR-02) and outside this register. |
| PR-05 | 164.530(i); 164.530(j) | Privacy policies and documentation | A covered entity's Privacy Rule policies and the six-year retention of their documentation. | Register: HS-22 Documentation, which asks for the same six-year retention for the Security Rule's records (164.316(b)(2)(i)). |
Minimum necessary (PR-01): the access limit that access management then enforces
Minimum necessary is a Privacy Rule idea. When a covered entity or a business associate uses, discloses or requests protected health information, it makes reasonable efforts to limit it to the minimum needed for the purpose. The Privacy Rule lists exceptions (a disclosure for treatment is one), and counsel confirms whether one applies. A covered entity also works out, role by role, who needs access and which categories of information each role needs, and limits access to that.
The Security Rule does not set that limit. It makes the limit real in the systems. When you decide who may reach electronic protected health information (information access management, HS-04) and then allow only those people or programs in (access control, HS-14), you enforce the limit the Privacy Rule set. The list of roles and categories is the input to your access decisions, and your access reviews check that the limit still holds. If you are a business associate, your agreement with the covered entity also shapes the limit: read both with counsel.
The Privacy Rule also covers uses and disclosures, individual rights and paper records. None of that is in this register.
Counts
Counts
Calculated from the Register and Addressable Decisions sheets. They count rows, nothing else. There is no score, no weighting and no percentage, and a count says what you have entered, not whether a safeguard works.
1. What the Rule holds, counted from the register
| Counted | In the register | Facts say | Check |
|---|---|---|---|
| Standards | 22 | 22 | Matches |
| Implementation specifications | 41 | 41 | Matches |
| Required specifications | 19 | 19 | Matches |
| Addressable specifications | 22 | 22 | Matches |
All 22 standards are required: a standard is never addressable. Only a specification is required or addressable (HR-03). Specifications are counted as the Rule labels them: 164.314(a)(2) and 164.314(b)(2) each carry one Required label and count once.
2. By family
| Family | Standards | Required specifications | Addressable specifications | Standards: facts say |
|---|---|---|---|---|
| Administrative | 9 | 10 | 11 | 9 |
| Physical | 4 | 2 | 6 | 4 |
| Technical | 5 | 2 | 5 | 5 |
| Organisational | 2 | 2 | 0 | 2 |
| Documentation | 2 | 3 | 0 | 2 |
| All families | 22 | 19 | 22 | 22 |
3. Your statuses (the Status column of the Register)
| Status | Standards | Specifications | All rows | |
|---|---|---|---|---|
| Not started | 0 | 0 | 0 | |
| Planned | 0 | 0 | 0 | |
| In place | 0 | 0 | 0 | |
| Operating | 0 | 0 | 0 | |
| Not applicable | 0 | 0 | 0 | |
| No status entered yet | 22 | 41 | 63 | |
| Total rows | 22 | 41 | 63 | |
| The status words are the pack's readiness words: Not started (nothing exists yet); Planned (owner and approach agreed; not yet in place); In place (documented and working, but incomplete, short of its own target, or with too little record for a supervisor to sample); Operating (working in full and meeting its own target, with records a supervisor could sample); Not applicable (the duty does not apply to the entity. the reason must be recorded, and confirmed with counsel). | ||||
4. Your answers to "Applies to our environment?"
| Answer | Standards | Specifications | All rows |
|---|---|---|---|
| Yes | 0 | 0 | 0 |
| No | 0 | 0 | 0 |
| Hybrid component only | 0 | 0 | 0 |
| Not answered yet | 22 | 41 | 63 |
5. Addressable decision records (the Addressable Decisions sheet, the EXAMPLE row left out)
| Counted | Count | Facts say |
|---|---|---|
| Records listed, one for each addressable specification | 22 | 22 |
| Records with a decision entered (AD-05) | 0 | |
| Decision: Implement as written | 0 | |
| Decision: Implement an equivalent alternative measure | 0 | |
| Decision: Not implement, and document why | 0 | |
| Judged reasonable and appropriate: Yes (AD-04) | 0 | |
| Judged reasonable and appropriate: No (AD-04) | 0 |
A record with a decision entered is not a record that the safeguard works. A "No" under AD-04 still needs the reasons, and an equivalent alternative if that is reasonable and appropriate (HR-05).
EXAMPLE
EXAMPLE: Acme Corp (EXAMPLE)
Acme Corp (EXAMPLE) is a US software-as-a-service provider with about 250 staff, whose hosted patient-messaging and appointment service is used by about 60 clinics and small hospital groups. It is a business associate of the clinics it serves. This sheet shows 17 of the 63 register rows as it might fill them in on 2026-09-30, with the counts those rows give. Every name, date and entry is invented for the illustration. A status here is the example's own statement, not a finding.
| ID | Level | Standard or specification | Required or Addressable | Applies? | Owner (name) | Implemented how | Status | Last reviewed |
|---|---|---|---|---|---|---|---|---|
| HS-01 | Standard | Security management process | Required | Yes | Max Okafor (EXAMPLE) | Risk analysis, risk management plan and activity review are run as the specifications below describe. | In place | 2026-09-30 |
| HS-01.1 | Specification | Risk analysis | Required | Yes | Max Okafor (EXAMPLE) | Risk analysis signed on 12 March 2026. It covers the hosted service and its two subcontractors and lists eight risks, ER-01 to ER-08. | In place | 2026-09-30 |
| HS-01.2 | Specification | Risk management | Required | Yes | Max Okafor (EXAMPLE) | Each of the eight risks has a treatment, an owner and a date on the risk management plan. | In place | 2026-09-30 |
| HS-01.4 | Specification | Information system activity review | Required | Yes | IT lead (EXAMPLE) | Log review is not yet scheduled or recorded. Planned, and tracked as a gap. | Planned | 2026-09-30 |
| HS-02 | Standard | Assigned security responsibility | Required | Yes | Chief technology officer (EXAMPLE) | Max Okafor, Head of Information Security, named in writing on 3 June 2024. | Operating | 2026-09-30 |
| HS-07 | Standard | Contingency plan | Required | Yes | IT lead (EXAMPLE) | Backup, recovery and emergency-mode plans exist; testing is still partial (see below). | In place | 2026-09-30 |
| HS-07.1 | Specification | Data backup plan | Required | Yes | IT lead (EXAMPLE) | Backups run for the production database. Making them immutable is the treatment for ER-03. | Operating | 2026-09-30 |
| HS-07.3 | Specification | Emergency mode operation plan | Required | Yes | IT lead (EXAMPLE) | Emergency-mode plan written. A tested failover to the second hosting region is the treatment for ER-05. | In place | 2026-09-30 |
| HS-07.4 | Specification | Testing and revision procedures | Addressable | Yes | IT lead (EXAMPLE) | Assessed and implemented: tests happen but the records are thin. The decision record is still to be completed. | In place | 2026-09-30 |
| HS-09 | Standard | Business associate contracts and other arrangements | Required | Yes | Vendor owner (EXAMPLE) | Register of business associates and subcontractors kept; one agreement (the support-ticketing tool) is still missing. | In place | 2026-09-30 |
| HS-09.1 | Specification | Written contract or other arrangement | Required | Yes | Vendor owner (EXAMPLE) | Written agreements in place with the hosting provider and the clinics. None yet with the ticketing tool (ER-07). | In place | 2026-09-30 |
| HS-14 | Standard | Access control | Required | Yes | IT lead (EXAMPLE) | Unique accounts, emergency access and logoff are in place; encryption is being completed. | In place | 2026-09-30 |
| HS-14.1 | Specification | Unique user identification | Required | Yes | IT lead (EXAMPLE) | Every user has a unique account; shared accounts are removed. | In place | 2026-09-30 |
| HS-14.3 | Specification | Automatic logoff | Addressable | Yes | IT lead (EXAMPLE) | Assessed and implemented: sessions end after inactivity on the support console. | In place | 2026-09-30 |
| HS-14.4 | Specification | Encryption and decryption | Addressable | Yes | IT lead (EXAMPLE) | Assessed and decided to implement (see the Addressable Decisions sheet). Full-disk encryption on the 12 contractor laptops is being enrolled. | Planned | 2026-09-30 |
| HS-19 | Standard | Business associate contracts or other arrangements | Required | Yes | Vendor owner (EXAMPLE) | Agreements are checked against the agreement security terms before signing; two terms are missing from the hosting provider's. | In place | 2026-09-30 |
| HS-19.1 | Specification | Implementation specifications | Required | Yes | Vendor owner (EXAMPLE) | Content of the hosting provider's agreement reviewed; the missing terms are on the gap tracker. | In place | 2026-09-30 |
What these rows count to
| Standards shown | 6 |
| Specifications shown | 11 |
| Required specifications shown | 8 |
| Addressable specifications shown | 3 |
| Rows with status Not started | 0 |
| Rows with status Planned | 2 |
| Rows with status In place | 13 |
| Rows with status Operating | 2 |
| Rows with status Not applicable | 0 |
One addressable decision record is filled in, for HS-14.4 (see the Addressable Decisions sheet). The other addressable rows shown still need theirs: the example's own readiness shows its decision records as planned.
Assumptions: The organisation is an invented EXAMPLE; its name is a placeholder. It provides a hosted service to clinics and handles their patients' protected health information on their behalf, so it is a business associate. It is not a health plan, a clearinghouse or a health care provider. It uses a cloud hosting provider and a customer-support tool that can reach protected health information, so those two are its subcontractors and are business associates too.
Limits
Limits of this register
What the register is, what it is not, and what it leaves out.
| Limit | What it means |
|---|---|
| It restates the Rule | The register puts the Security Rule in our words. It is not the Rule. The text of 45 CFR Part 164, Subpart C, governs, and where the two differ the text is right. Each row shows the paragraph of its standard; open it in the eCFR for the exact words. |
| No coverage claim | This pack does not say which document, record or practice meets a requirement of the HIPAA Rules. Each reference says what its source asks and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met. |
| A status is your statement | A status, an answer or a decision in a yellow column is the adopter's own statement about its own records. It is not a finding about the law, and nobody has checked it. A count is a count of what you wrote. |
| Addressable is not optional | An addressable implementation specification is assessed. If it is reasonable and appropriate it is implemented. If it is not, the reasons are documented and an equivalent alternative measure is implemented if that is reasonable and appropriate. It is never optional, and never skipped without a record. |
| The Rule sets no review interval | The 12-month review in these instructions is the pack's default, written [[12]] so you can change it. The Rule asks for documentation to be kept six years and reviewed periodically. |
| No notification clock | Reporting duties after a breach, and when they start, are in P09 (RD-17 to RD-20) and P18-A09 and P18-A10, not here. A proposed rule at 90 FR 898 is a proposal and is not applied. |
| Not legal advice | This document helps a security team see what the HIPAA Security Rule and the breach notification rules ask of an organisation like yours, and what it could show. It is not legal advice. It does not say that you are compliant with HIPAA or that you are certified, and the Rules provide no certificate of compliance. Whether HIPAA applies to your organisation, in which role, and what a breach or a contract requires are for counsel to confirm. The notification deadlines are in P09 (RD-17 to RD-20) and P18, and are not repeated here. |
| Not covered here | The Privacy Rule beyond five pointers; breach notification (the Breach Assessment & Notification Decision Procedure); agreement content (the Business Associate Agreement Security Terms); how to run the risk analysis (the Security Risk Analysis Method); State laws; mapping to ISO/IEC 27001 or NIST CSF controls; paper records. |
Lists
| LevelList | FamilyList | KindList | AppliesList | StatusList | YesNoList | DecisionList |
|---|---|---|---|---|---|---|
| Standard | Administrative | Required | Yes | Not started | Yes | Implement as written |
| Specification | Physical | Addressable | No | Planned | No | Implement an equivalent alternative measure |
| Technical | Hybrid component only | In place | Not implement, and document why | |||
| Organisational | Operating | |||||
| Documentation | Not applicable |
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Standard | A standard is a requirement of the Security Rule. An implementation specification is a more detailed requirement under a standard, either required or addressable. |
| Required | The entity must implement it. Size, cost and the other factors in 164.306(b) may shape how it is implemented, never whether (HR-04). |
| Addressable | The entity must assess whether it is a reasonable and appropriate safeguard in its environment, and then implement it, or document why not and implement an equivalent alternative measure if that is reasonable and appropriate. It is never optional and never skipped without a record. |
| Family | One of five groups: administrative, physical, technical, organisational, documentation. The administrative standards are management (164.308), physical are premises, equipment and media (164.310), technical are controls in the systems (164.312), organisational are contract content (164.314), and documentation is writing it down and keeping it (164.316). |
| AD-01 Specification | The ID from the register, for example HS-14.4 (encryption and decryption). |
| AD-02 Risks it addresses | The risks from the risk analysis that the specification would reduce. |
| AD-03 The four factors | Size, complexity and capabilities; technical infrastructure and security capabilities; cost; probability and criticality of the risks to ePHI (164.306(b)(2)), and the specification's likely contribution to protecting ePHI (164.306(d)(3)(i)). |
| AD-04 Is it reasonable and appropriate? | Yes or No, with the reasons. |
| AD-05 Decision | Implement as written; or, if that is not reasonable and appropriate, document why and implement an equivalent alternative measure where that is. Never left blank. |
| AD-06 The alternative, if any | What is done instead, and why it is equivalent in the risk it reduces. |
| AD-07 Decided by and on | The person HD-03 names, and the date. |
| AD-08 Review | With the next risk analysis, and on any trigger. |
| Security official | The one person identified as responsible for developing and implementing the security policies and procedures (164.308(a)(2)). |
| Electronic protected health information (ePHI) | PHI that is transmitted by electronic media or maintained in electronic media. It is what the Security Rule protects. |
| Applies to our environment? | Whether the situation a row describes exists in your environment. Hybrid component only: the row applies to the parts you designated as health care components, not to the rest. |
| Status | Not started: Nothing exists yet. Planned: Owner and approach agreed; not yet in place. In place: Documented and working, but incomplete, short of its own target, or with too little record for a supervisor to sample. Operating: Working in full and meeting its own target, with records a supervisor could sample. Not applicable: The duty does not apply to the entity. The reason must be recorded, and confirmed with counsel. |
| Minimum necessary | A Privacy Rule duty to limit the protected health information used, disclosed or requested to what the purpose needs. |
| HS, HR, HD, PR, AD | The pack's IDs: HS standards and specifications, HR rules, HD decisions, PR Privacy Rule pointers, AD record fields. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.36 — Compliance with policies, rules and standards for information security | The register as a whole: keeping a record of the legal requirements that apply and who owns each. A reference by number and title, not a mapping |
| NIST CSF 2.0 | GV.PO-01 — “Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced” | The register as a whole: policy that is established, communicated and enforced. A reference by number and title, not a mapping |
| HIPAA — 45 CFR Parts 160 and 164 | § 164.306 — covered entities and business associates must ensure the confidentiality, integrity and availability of all electronic protected health information they create, receive, maintain or transmit, and protect against reasonably anticipated threats and impermissible uses and disclosures. They “may use any security measures that allow” them “to reasonably and appropriately implement the standards”, taking into account size, complexity and capabilities, technical infrastructure, “the costs of security measures” and “the probability and criticality of potential risks”. Each implementation specification is “required or addressable”. For an addressable one the entity must assess whether it is “a reasonable and appropriate safeguard in its environment” and then implement it if reasonable and appropriate or, if not, document why and “implement an equivalent alternative measure if reasonable and appropriate”. Security measures are reviewed and modified as needed (§ 164.306(e)) | Register: the general requirements, the required and addressable distinction and the four factors (HR-03 to HR-06) |
| HIPAA — 45 CFR Parts 160 and 164 | § 164.308(a)(1) — the security management process standard: “Implement policies and procedures to prevent, detect, contain, and correct security violations.” Its four required implementation specifications are risk analysis (“an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information”), risk management, a sanction policy and information system activity review | Register: HS-01 Security management process |
| HIPAA — 45 CFR Parts 160 and 164 | § 164.308(a)(2) to (a)(7) — assigned security responsibility (identify “the security official”), workforce security, information access management, security awareness and training, security incident procedures, and contingency plan (data backup, disaster recovery and emergency mode operation are required; testing and criticality analysis are addressable) | Register: HS-02 to HS-07; Responsibility: the security official's designation |
| HIPAA — 45 CFR Parts 160 and 164 | § 164.308(a)(8) — evaluation: “Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and, subsequently, in response to environmental or operational changes affecting the security of electronic protected health information”. The rule sets no interval | Register: HS-08 Evaluation |
| HIPAA — 45 CFR Parts 160 and 164 | § 164.308(b) — a covered entity may permit a business associate to create, receive, maintain or transmit electronic protected health information on its behalf “only if” it obtains assurances, in accordance with § 164.314(a), that the business associate will appropriately safeguard the information; a covered entity is not required to obtain them from a business associate that is a subcontractor. A business associate must obtain the same assurances from its subcontractor. The assurances are documented through a written contract or other arrangement (required) | Register: HS-09 Business associate contracts and other arrangements |
| HIPAA — 45 CFR Parts 160 and 164 | § 164.310 — physical safeguards: facility access controls (contingency operations, facility security plan, access control and validation, maintenance records, all addressable), workstation use, workstation security, and “Device and media controls” (disposal and media re-use required; accountability and data backup and storage addressable) | Register: HS-10 to HS-13, the physical safeguards |
| HIPAA — 45 CFR Parts 160 and 164 | § 164.312 — technical safeguards: access control (unique user identification and emergency access procedure required; automatic logoff and encryption and decryption addressable), audit controls, integrity (a mechanism to authenticate electronic protected health information, addressable), person or entity authentication, and “Transmission security” (integrity controls and encryption, addressable) | Register: HS-14 to HS-18, the technical safeguards |
| HIPAA — 45 CFR Parts 160 and 164 | § 164.314(a) — the contract between a covered entity and a business associate, or between a business associate and a subcontractor, must provide that the business associate will comply with the applicable requirements of the Security Rule, will ensure that any subcontractor that handles electronic protected health information agrees to comply by contract, and will report to the covered entity “any security incident of which it becomes aware, including breaches of unsecured protected health information as required by § 164.410” | Register: HS-19 Business associate contracts or other arrangements |
| HIPAA — 45 CFR Parts 160 and 164 | § 164.314(b) — a group health plan must ensure that its plan documents provide that the plan sponsor “will reasonably and appropriately safeguard electronic protected health information”, and require the plan sponsor to implement administrative, physical and technical safeguards for the electronic protected health information it handles for the plan, to keep it separate as § 164.504(f)(2)(iii) requires, to bind its agents, and to report any security incident of which it becomes aware | Register: HS-20 Requirements for group health plans |
| HIPAA — 45 CFR Parts 160 and 164 | § 164.316 — policies and procedures in writing (which may be electronic) and a written record of any action, activity or assessment the subpart requires to be documented. Documentation is retained “for 6 years from the date of its creation or the date when it last was in effect, whichever is later”, made available to those who implement the procedures, and reviewed periodically and updated in response to environmental or operational changes | Register: HS-21 and HS-22, policies and documentation |
| HIPAA — 45 CFR Parts 160 and 164 | § 164.502(b) and § 164.514(d) — when using, disclosing or requesting protected health information, a covered entity or business associate “must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose”, with listed exceptions (treatment disclosures among them). A covered entity identifies the persons or classes of persons in its workforce who need access, the categories of information each needs, and limits access to them | Privacy Rule Pointers: PR-01, and the access rows HS-04 and HS-14 |
| NIST SP 800-66 Rev. 2 (February 2024) | “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide” (J. A. Marron, February 2024, https://doi.org/10.6028/NIST.SP.800-66r2). A resource that relates the Security Rule to NIST publications. It is informative: it does not change the Rule, and non-government organisations may use it on a voluntary basis | Register: an informative resource on the Security Rule; it does not change the Rule |
Editions referenced: 45 CFR Parts 160 and 164 as the eCFR prints them (current to 6 October 2026); HITECH Act provisions at 42 U.S.C. 17931, 17934 and 17941; HHS Office for Civil Rights guidance on risk analysis, business associates and unsecured protected health information; NIST SP 800-66 Rev. 2 (informative); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); as published and read on 18 October 2026
ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of the HIPAA Rules, or that your organisation holds a certificate.
A reference says what its source asks, and which CISO Times document helps with that work. It does not say that a document from this pack meets a requirement, and it does not say that an organisation is compliant or certified. The Rules provide no certificate of compliance for an organisation to hold.
The HIPAA Rules in 45 CFR Parts 160 and 164 apply to covered entities (health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with standard transactions) and, where the Rules provide, to business associates and their subcontractors. Whether your organisation is one of them is decided by what it does with protected health information, and counsel confirms it. The Security Rule (Subpart C) protects electronic protected health information. The Breach Notification Rule (Subpart D) applies to breaches of unsecured protected health information. This pack does not decide which applies to you.
The HHS guidance and the NIST publication cited here are not law. HHS says its risk analysis guidance is not a blueprint and that no method guarantees compliance. NIST SP 800-66 Rev. 2 is an informative resource. Using either is not a statement that your organisation is compliant or certified.
The proposed rule published at 90 FR 898 is a proposal. It is not part of the text this pack applies. Counsel confirms its status before any document is relied on.