Security Rule [45 CFR 164.302-318]
Rule: Covered entities and business associates must implement administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of electronic PHI (ePHI).
Implementation Specifications
| Type | Meaning |
|---|
| Required (R) | Must be implemented |
| Addressable (A) | Assess and implement if reasonable; if not, document why and implement alternative |
Administrative Safeguards [§164.308]
| Safeguard | Type | Requirement |
|---|
| Risk analysis | R | Conduct thorough assessment of ePHI risks |
| Risk management | R | Implement measures to reduce risks |
| Sanction policy | R | Discipline workforce for violations |
| Information system activity review | R | Review audit logs, access reports |
| Assigned security responsibility | R | Designate security official |
| Workforce security | A | Ensure appropriate access |
| Security awareness training | A | Train all workforce members |
| Security incident procedures | R | Identify and respond to incidents |
| Contingency plan | R | Data backup, disaster recovery, emergency mode |
| Evaluation | R | Periodic technical/nontechnical evaluation |
| Business associate contracts | R | Written BAAs required |
Physical Safeguards [§164.310]
| Safeguard | Type | Requirement |
|---|
| Facility access controls | A | Limit physical access to ePHI systems |
| Workstation use | R | Specify proper workstation use |
| Workstation security | R | Physical safeguards for workstations |
| Device and media controls | R | Policies for hardware and media |
Technical Safeguards [§164.312]
| Safeguard | Type | Requirement |
|---|
| Access control | R | Unique user IDs, emergency access |
| Automatic logoff | A | Terminate sessions after inactivity |
| Encryption | A | Encrypt ePHI at rest |
| Audit controls | R | Record and examine access |
| Integrity | A | Protect ePHI from improper alteration |
| Authentication | R | Verify identity of users |
| Transmission security | A | Protect ePHI in transit |
Risk Analysis Requirements
Must identify and assess:
- All ePHI created, received, maintained, transmitted
- External sources of ePHI
- Potential threats and vulnerabilities
- Current security measures
- Likelihood of threat occurrence
- Potential impact of breach
- Risk level determination
Documentation Requirements
- Policies and procedures must be written
- Retain for 6 years from creation or last effective date
- Make available to those responsible for implementation
- Review and update periodically
Citation
45 CFR Part 164 Subpart C — Security Standards