HIPAA, protect health information and prove it
Learn what the Privacy, Security and Breach rules ask, and where your gaps are.
Official sources
Use these official places to read the text and find the latest version.
Official website
The US Department of Health and Human Services publishes the rules and guidance.
Visit hhs.gov/hipaa ↗Works alongside
SOC 2, ISO 27001 and HITRUST-style programmes overlap with it.
Browse all frameworks →What HIPAA is
HIPAA is the US law that protects patients’ health information. It covers organisations that deliver or pay for care, and the vendors, called business associates, that handle that data for them.
Its three main parts are the Privacy Rule, the Security Rule and the Breach Notification Rule.
How HIPAA got to where it is today
The milestones that changed what organisations have to do.
HIPAA enacted
The Health Insurance Portability and Accountability Act becomes law.
Privacy Rule applies
Rules for use and disclosure of health information take effect.
Security Rule applies
Safeguards for electronic health information take effect.
HITECH Act
Adds breach notification and extends duties to business associates.
Omnibus Rule
Strengthens enforcement and business associate liability.
Security Rule update proposed
HHS proposes a major update to the Security Rule in December 2024. Check the HHS page for whether it has been finalised.
Dates are for orientation. The official website holds the authoritative record.
Do you need it?
If any of these sound familiar, probably yes.
You are a US provider, health plan or clearinghouse.
You build software that handles patient data.
A healthcare customer asks for a BAA.
You store or transmit electronic health records.
What it asks of you
The requirements fall into six areas.
Privacy
Limit how health information is used and shared.
Security safeguards
Administrative, physical and technical protections.
Risk analysis
Assess risks to health data regularly.
Business associates
Contracts and oversight of vendors.
Breach notification
Tell patients, HHS and sometimes media.
Training and documentation
Train staff and keep records for six years.
6 rule areas, 21 standards and 80 specifications and duties
HIPAA protects health information held by covered entities and their business associates. The Security Rule splits its specifications into required ones you must do and addressable ones you must do or replace with a documented, equally effective alternative. A 2025 proposal would remove that distinction, but it is not confirmed as final here.
21 standards · 80 specifications
SEC-ASecurity Rule: Administrative safeguards (164.308)Policies, people and process controls for protecting electronic health information (ePHI).7 standards · 25 specifications
A1Security management process (164.308(a)(1))Find the risks to ePHI, reduce them and watch what happens on your systems.4 specifications
- 164.308(a)(1)(ii)(A)
Required: carry out an accurate, thorough assessment of risks to the confidentiality, integrity and availability of ePHI.
What you do
- Run and date a risk analysis covering every system and device that holds ePHI
- Refresh it after major changes such as a new EHR or cloud move
- 164.308(a)(1)(ii)(B)
Required: put in place security measures that reduce those risks to a reasonable and appropriate level.
What you do
- Keep a risk register with treatment actions, owners and deadlines
- Track fixes to closure and report to leadership
- 164.308(a)(1)(ii)(C)
Required: apply sanctions to workforce members who breach security policies.
What you do
- Publish a disciplinary policy and record each case
- Make staff acknowledge it at onboarding
- 164.308(a)(1)(ii)(D)
Required: regularly review records of system activity such as audit logs, access reports and incident reports.
What you do
- Review access and audit logs on a set schedule
- Record who reviewed and what was followed up
Evidence to keep
- Documented risk analysis
- Risk management plan with owners and dates
- Sanction policy and system activity review records
A2Security responsibility and workforce security (164.308(a)(2)-(3))Name one accountable person and control who in the workforce can touch ePHI.4 specifications
- 164.308(a)(2)
Required: name one person who is responsible for developing and running the security policies and procedures.
What you do
- Appoint a security official in writing and publish their contact
- Add the duty to their job description
- 164.308(a)(3)(ii)(A)
Addressable: authorise and supervise workforce members who work with ePHI or in places where it can be accessed.
What you do
- Require manager sign-off before ePHI access is given
- Supervise contractors and temporary staff on site
- 164.308(a)(3)(ii)(B)
Addressable: check that a workforce member's access to ePHI is appropriate before it is given.
What you do
- Run background checks proportionate to role
- Confirm role need before granting access
- 164.308(a)(3)(ii)(C)
Addressable: end access to ePHI promptly when employment or an arrangement ends.
What you do
- Use a leaver checklist that disables accounts the same day
- Collect devices, keys and badges at exit
Evidence to keep
- Appointment letter for the security official
- Access approval and termination checklists
A3Information access management (164.308(a)(4))Give people only the ePHI access their job needs.3 specifications
- 164.308(a)(4)(ii)(A)
Required: if a clearinghouse is part of a larger organisation, keep the clearinghouse's ePHI separate from the rest.
What you do
- Segment networks and applications for clearinghouse work
- Document the separation in policy
- 164.308(a)(4)(ii)(B)
Addressable: set policies for authorising access to ePHI such as by workstation, programme or process.
What you do
- Define access roles by job function
- Document who may approve access
- 164.308(a)(4)(ii)(C)
Addressable: set policies for establishing, reviewing and changing a user's access to ePHI.
What you do
- Review access rights at least yearly
- Log every change request and approval
Evidence to keep
- Role-based access matrix
- Access request and approval tickets
A4Awareness and training (164.308(a)(5))Train everyone who handles ePHI and keep them alert to threats.5 specifications
- 164.308(a)(5)(i)
Required: run a security awareness and training programme for all workforce members including management.
What you do
- Train at hire and at least yearly
- Keep attendance records
- 164.308(a)(5)(ii)(A)
Addressable: issue periodic security reminders.
What you do
- Send short monthly tips and alerts
- Run phishing simulations
- 164.308(a)(5)(ii)(B)
Addressable: have procedures to guard against, detect and report malicious software.
What you do
- Deploy managed endpoint protection with central alerts
- Teach staff how to report suspicious files
- 164.308(a)(5)(ii)(C)
Addressable: monitor log-in attempts and report discrepancies.
What you do
- Alert on repeated failed log-ins
- Lock accounts after set failures
- 164.308(a)(5)(ii)(D)
Addressable: have procedures for creating, changing and protecting passwords.
What you do
- Enforce length and breach-list checks
- Offer a password manager and multi-factor sign-in
Evidence to keep
- Training attendance records
- Phishing test results
- Password policy
A5Security incident procedures (164.308(a)(6))Be ready to spot, contain and learn from security incidents.1 specification
- 164.308(a)(6)(ii)
Required: identify and respond to suspected or known incidents, reduce harm where possible and document incidents and outcomes.
What you do
- Write an incident plan with roles and a contact tree
- Keep a log of every incident and the lessons learned
Evidence to keep
- Incident response plan
- Incident log with outcomes
- Post-incident review notes
A6Contingency plan (164.308(a)(7))Keep ePHI available and recoverable when things go wrong.5 specifications
- 164.308(a)(7)(ii)(A)
Required: create and keep exact retrievable copies of ePHI.
What you do
- Run automated backups with offsite or immutable copies
- Monitor backup success daily
- 164.308(a)(7)(ii)(B)
Required: have a plan to restore any lost data.
What you do
- Document restore steps and target recovery times
- Name who runs recovery
- 164.308(a)(7)(ii)(C)
Required: have a plan to keep critical processes running and protect ePHI while operating in emergency mode.
What you do
- Define manual or downtime procedures for clinical or billing work
- Keep printed contact lists
- 164.308(a)(7)(ii)(D)
Addressable: test and revise contingency plans periodically.
What you do
- Run a restore test at least yearly
- Update plans after each test
- 164.308(a)(7)(ii)(E)
Addressable: assess how critical each application and data set is to decide recovery priority.
What you do
- Rank systems by impact and recovery order
- Review the ranking when systems change
Evidence to keep
- Backup logs and restore test records
- Disaster recovery and emergency mode plans
- Criticality analysis
A7Evaluation and business associates (164.308(a)(8), (b))Check your controls still work and bind partners who handle ePHI.3 specifications
- 164.308(a)(8)
Required: carry out periodic technical and non-technical evaluations of your security policies against the Rule, repeated after environmental or operational change.
What you do
- Do an annual internal or third-party review
- Re-evaluate after major system changes
- 164.308(b)(1)
Required: allow a business associate to handle ePHI only on receiving satisfactory assurances that it will protect it.
What you do
- Do due diligence on vendors before sharing ePHI
- Keep a list of all business associates
- 164.308(b)(3)
Required: document those assurances in a written contract or other arrangement.
What you do
- Sign a business associate agreement before any ePHI is shared
- Review agreements when services change
Evidence to keep
- Periodic evaluation report
- Signed business associate agreements
- Vendor inventory
SEC-PSecurity Rule: Physical safeguards (164.310)Protect buildings, devices and media that hold ePHI.3 standards · 11 specifications
P1Facility access controls (164.310(a))Limit who can physically get to systems that hold ePHI.5 specifications
- 164.310(a)(1)
Required: limit physical access to electronic systems and the facilities housing them to authorised people.
What you do
- Use locked server rooms or reputable data centres
- Use badges or keys with a sign-in log
- 164.310(a)(2)(i)
Addressable: set procedures that allow facility access for restoring lost data in an emergency.
What you do
- Document emergency access to the server room
- Name who may use it
- 164.310(a)(2)(ii)
Addressable: have a plan to protect the facility and equipment from unauthorised access, tampering and theft.
What you do
- Write a short facility security plan
- Fit alarms and cameras where sensible
- 164.310(a)(2)(iii)
Addressable: control and validate people's access to facilities based on role, including visitors.
What you do
- Escort visitors and log them
- Review who holds keys and badges
- 164.310(a)(2)(iv)
Addressable: record repairs and changes to physical parts of the facility that affect security such as locks and doors.
What you do
- Log lock, door and wall changes
- Keep contractor work orders
Evidence to keep
- Facility security plan
- Visitor and key logs
- Maintenance records
P2Workstation use and security (164.310(b)-(c))Set rules for how devices are used and where they sit.2 specifications
- 164.310(b)
Required: set policies on how workstations that touch ePHI are used, what is done on them and the surroundings they are in.
What you do
- Write an acceptable use policy covering location and screen privacy
- Use privacy screens in public areas
- 164.310(c)
Required: put physical safeguards on workstations that access ePHI to limit use to authorised users.
What you do
- Use cable locks and locked rooms where needed
- Enforce screen lock after a short idle time
Evidence to keep
- Workstation use policy
- Screen lock configuration
P3Device and media controls (164.310(d))Track, wipe and dispose of hardware and media safely.4 specifications
- 164.310(d)(2)(i)
Required: set policies for the final disposal of ePHI and the hardware or media it is stored on.
What you do
- Shred or degauss media and keep certificates
- Use a certified disposal vendor
- 164.310(d)(2)(ii)
Required: remove ePHI from media before it is re-used.
What you do
- Securely wipe drives before reissue
- Verify and log the wipe
- 164.310(d)(2)(iii)
Addressable: keep a record of who moves hardware and media and where they go.
What you do
- Maintain an asset register with custodian and location
- Log device handovers
- 164.310(d)(2)(iv)
Addressable: make a retrievable exact copy of ePHI before moving equipment.
What you do
- Back up before a laptop swap or relocation
- Verify the copy before wiping
Evidence to keep
- Asset inventory with movement log
- Disposal and wipe certificates
SEC-TSecurity Rule: Technical safeguards (164.312)Technology controls that protect ePHI and record access to it.4 standards · 12 specifications
T1Access control (164.312(a))Make sure only the right, identifiable people can reach ePHI.5 specifications
- 164.312(a)(1)
Required: allow ePHI access only to people or programmes that have been granted it.
What you do
- Apply role-based permissions and least privilege
- Review accounts regularly
- 164.312(a)(2)(i)
Required: give each user a unique identifier so activity can be traced.
What you do
- Ban shared logins
- Use single sign-on with named accounts
- 164.312(a)(2)(ii)
Required: have an emergency procedure to get at ePHI when normal access fails.
What you do
- Create a break-glass account with monitoring
- Test it and record its use
- 164.312(a)(2)(iii)
Addressable: end electronic sessions after a period of inactivity.
What you do
- Set auto-logoff and screen lock timers
- Apply to shared clinical workstations too
- 164.312(a)(2)(iv)
Addressable: use a mechanism to encrypt and decrypt ePHI.
What you do
- Encrypt laptops, servers and databases at rest
- Manage keys separately from data
Evidence to keep
- User list with unique IDs
- Emergency access procedure
- Encryption settings
T2Audit controls (164.312(b))Record and examine activity in systems that hold ePHI.1 specification
- 164.312(b)
Required: use hardware, software or procedural mechanisms that record and examine activity in systems containing ePHI.
What you do
- Turn on audit logging in EHR, databases and servers
- Send logs to a central store and review them
Evidence to keep
- Log configuration
- Log review records
T3Integrity (164.312(c))Stop ePHI being altered or destroyed improperly.2 specifications
- 164.312(c)(1)
Required: protect ePHI from improper alteration or destruction.
What you do
- Restrict write permissions and keep versioned backups
- Use change control on systems
- 164.312(c)(2)
Addressable: use an electronic mechanism to confirm ePHI has not been altered or destroyed in an unauthorised way.
What you do
- Use checksums or file integrity monitoring
- Alert on unexpected changes
Evidence to keep
- File integrity monitoring output
- Change control records
T4Authentication and transmission security (164.312(d)-(e))Confirm who is asking and protect data moving over networks.4 specifications
- 164.312(d)
Required: verify that a person or entity seeking access to ePHI is who they claim to be.
What you do
- Require multi-factor sign-in for remote and privileged access
- Verify vendor and partner identities
- 164.312(e)(1)
Required: guard ePHI against unauthorised access while it is sent over an electronic network.
What you do
- Use secure channels for all transfers
- Block unencrypted email of ePHI
- 164.312(e)(2)(i)
Addressable: use security measures so ePHI is not improperly changed in transit without detection.
What you do
- Use TLS with integrity checks
- Sign files and messages where practical
- 164.312(e)(2)(ii)
Addressable: encrypt ePHI in transit when appropriate.
What you do
- Enforce current TLS versions
- Use a VPN or secure portal for remote work
Evidence to keep
- MFA coverage report
- TLS configuration scans
- VPN policy
SEC-OSecurity Rule: Organisational requirements and documentation (164.314, 164.316)Contracts with partners and the paperwork that proves compliance.2 standards · 9 specifications
O1Business associate contracts (164.314(a))Contracts must oblige partners to protect ePHI.4 specifications
- 164.314(a)(2)(i)
Required: contract must make the business associate apply the Security Rule safeguards to ePHI it creates, receives, maintains or sends.
What you do
- Use a standard business associate agreement
- Check vendor security evidence
- 164.314(a)(2)(i)(C)
Required: contract must make the business associate report security incidents including breaches to you.
What you do
- Set a reporting deadline in the contract
- Name contact points on both sides
- 164.314(a)(2)(iii)
Required: contract must make the business associate require its subcontractors to agree to the same protections.
What you do
- Ask for a list of subcontractors
- Require flow-down clauses
- 164.314(b)
Required: group health plan documents must require the plan sponsor to protect ePHI it receives.
What you do
- Add security language to plan documents
- Confirm sponsor safeguards
Evidence to keep
- Business associate agreement template
- Subcontractor agreements
O2Policies and documentation (164.316)Write policies down, keep them current and keep records for six years.5 specifications
- 164.316(a)
Required: put in place reasonable and appropriate written policies and procedures to meet the Security Rule.
What you do
- Maintain a policy for each safeguard
- Assign an owner to each policy
- 164.316(b)(1)
Required: keep written records of policies, procedures and actions, activities or assessments the Rule requires.
What you do
- Store records in a central repository
- Capture decisions on addressable items and their reasons
- 164.316(b)(2)(i)
Required: keep documentation for six years from creation or last effective date.
What you do
- Set a six-year retention rule
- Archive superseded versions
- 164.316(b)(2)(ii)
Required: make documentation available to the people who carry out the procedures.
What you do
- Publish policies on an intranet
- Notify staff of changes
- 164.316(b)(2)(iii)
Required: review and update documentation periodically in response to environmental or operational change.
What you do
- Review policies at least yearly
- Update after incidents and system changes
Evidence to keep
- Policy library with version history
- Document retention schedule
PRIVPrivacy Rule: key duties (164 Subpart E)How covered entities and business associates may use, disclose and give access to protected health information (PHI).3 standards · 16 specifications
PR1Uses, disclosures and minimum necessary (164.502-164.514)Use PHI only as allowed, and no more than needed.4 specifications
- 164.502(a)
Required: use or disclose PHI only as the Privacy Rule permits or requires.
What you do
- Map uses and disclosures to a permitted basis
- Train staff on what needs authorisation
- 164.502(b)
Required: limit PHI used, disclosed or requested to the minimum needed for the purpose, except for treatment and a few other cases.
What you do
- Define role-based access to the minimum needed
- Use limited data sets where possible
- 164.508
Required: obtain a valid written authorisation for uses and disclosures not otherwise permitted such as most marketing and sale of PHI.
What you do
- Use an authorisation form with all required elements
- Record expiry and revocation
- 164.514(a)-(b)
Addressable: de-identify PHI by an approved method if you want to use it as non-PHI.
What you do
- Use the safe harbour or expert determination method
- Document the method used
Evidence to keep
- Use and disclosure policy
- Signed patient authorisations
- Minimum necessary role matrix
PR2Notice and individual rights (164.520-164.528)Tell people how you use their data and honour their rights.5 specifications
- 164.520
Required: give individuals a notice of privacy practices and make it available.
What you do
- Publish the notice on your site and at the front desk
- Collect acknowledgement from new patients
- 164.522
Required: let individuals request restrictions and confidential communications, and honour restrictions in the cases the Rule requires.
What you do
- Offer a request form
- Flag accounts with agreed restrictions
- 164.524
Required: give individuals access to and copies of their PHI, generally within 30 days.
What you do
- Set up a request workflow with a 30 day timer
- Provide copies electronically when asked
- 164.526
Required: let individuals ask for amendment of their PHI and respond within set time limits.
What you do
- Log amendment requests
- Document denials with reasons
- 164.528
Required: give individuals an accounting of certain disclosures of their PHI on request.
What you do
- Log disclosures outside treatment, payment and operations
- Produce the accounting within the time limit
Evidence to keep
- Notice of privacy practices
- Request tracking log
- Accounting of disclosures log
PR3Administrative duties (164.530, 164.504(e))Organisation, training, safeguards and paperwork for privacy.7 specifications
- 164.530(a)
Required: designate a privacy official and a contact for complaints.
What you do
- Appoint in writing
- Publish contact details in the notice
- 164.530(b)
Required: train all workforce members on privacy policies.
What you do
- Train at hire and when policies change
- Keep attendance records
- 164.530(c)
Required: apply appropriate administrative, technical and physical safeguards to PHI.
What you do
- Lock records and screens
- Align with Security Rule controls
- 164.530(d)
Required: provide a process for individuals to complain and document complaints.
What you do
- Publish a complaint route
- Log and resolve each complaint
- 164.530(e)-(f)
Required: apply sanctions for breaches of policy and reduce harmful effects of known improper disclosures.
What you do
- Apply the disciplinary policy
- Retrieve or contain misdirected PHI
- 164.530(i)-(j)
Required: keep privacy policies and records for six years.
What you do
- Set a six-year retention rule
- Version-control policy changes
- 164.504(e)
Required: have a business associate agreement before giving PHI to a business associate.
What you do
- Maintain a vendor register with agreement status
- Use a standard agreement
Evidence to keep
- Privacy official appointment
- Training records
- Complaint log
- Business associate agreements
BNRBreach Notification Rule: key duties (164.400-164.414)Detect, assess and report breaches of unsecured PHI.2 standards · 7 specifications
BN1Breach assessment (164.402, 164.412, 164.414)Treat an impermissible use or disclosure as a breach unless a risk assessment shows a low probability of compromise.3 specifications
- 164.402
Required: assess every impermissible use or disclosure of unsecured PHI against four factors and treat it as a breach unless low probability of compromise is shown.
What you do
- Use a standard four-factor risk assessment template
- Keep each assessment on file
- 164.412
Required: delay notice if a law enforcement official says it would impede an investigation.
What you do
- Record the law enforcement request and its period
- Resume notification when the delay ends
- 164.414
Required: be able to show you met notification duties or that no breach occurred.
What you do
- Keep notice copies and timelines
- Retain evidence for six years
Evidence to keep
- Breach risk assessment forms
- Breach log
BN2Notifications (164.404-164.410)Tell individuals, regulators and, for large breaches, the media on time.4 specifications
- 164.404
Required: notify each affected individual without unreasonable delay and within 60 days of discovery.
What you do
- Keep a ready letter template with the required content
- Track the 60 day clock from discovery
- 164.406
Required: notify prominent media if more than 500 residents of a state or jurisdiction are affected.
What you do
- Pre-draft a media notice
- Identify who approves it
- 164.408
Required: notify the HHS Secretary at the same time for 500 or more individuals, or within 60 days after year end for fewer than 500.
What you do
- Submit through the HHS portal
- Log smaller breaches for annual filing
- 164.410
Required: business associates must notify the covered entity without unreasonable delay and within 60 days of discovery.
What you do
- Set shorter contractual deadlines
- Give partners a named contact
Evidence to keep
- Notice templates
- Notification timeline log
- HHS breach portal submissions
Nothing matches. Clear the search or pick another rule area.
Outcomes and implementation examples are from HHS: HIPAA Security Rule, Privacy Rule and Breach Notification Rule (45 CFR Part 164), published by NIST. Descriptions of what to do and the evidence lists are our own plain-English guidance. Check the official source for the authoritative text.
Your path to getting started
Five steps from first look to ready. Effort depends on your size and starting point.
- 1
Confirm your role
Covered entity or business associate.
- 2
Run a risk analysis
Document threats to health data.
- 3
Put safeguards in place
Policies, access, encryption.
- 4
Sign BAAs
With every vendor handling the data.
- 5
Train and review
Every year or after changes.
How Optimus GRC helps
Each area maps to a part of the platform, so the work and the evidence sit together.
| What it asks | What you do in Optimus GRC |
|---|---|
| Privacy | Policy and consent records |
| Security safeguards | Controls library with evidence |
| Risk analysis | Risk register |
| Business associates | Vendor and BAA register |
| Breach notification | Incident log and notification workflow |
| Training and documentation | Training records |
Free HIPAA readiness checklist
A one-page PDF you can print or share with your team. No sign-up needed.
Download the checklist (PDF)- Security risk analysis template
- BAA checklist
- Breach response plan
- Staff training log
Share or cite this page
Writing about HIPAA? You are welcome to link to this guide. Copy the link below.
<a href="/frameworks/hipaa/">HIPAA explained in plain English - Optimus CyberX</a>Common questions
Is there a HIPAA certificate?
No official certification exists. Compliance is shown through risk analysis and documentation.
Does it apply to software vendors?
Yes, if they handle protected health information for a covered entity.
What is a BAA?
A business associate agreement. A contract that binds a vendor to HIPAA duties.
What are the penalties?
Civil penalties are set in tiers by level of fault and are adjusted yearly for inflation. Serious wilful misuse of health information can also bring criminal penalties. See the HHS site for current amounts.
Related frameworks
See how ready you are for HIPAA
Answer questions across every area. We email you a report showing where you comply and where you do not.