Checklist: 1) run a risk analysis, 2) name a security official, 3) put admin, physical, and technical protections in place, 4) document every step and train your staff. HIPAA Security Rule compliance is built in three phases: admin protections first, then physical protections, then technical protections, and all three must work together. Start with a thorough risk analysis, the focus of OCR's Risk Analysis Initiative, and name a security official. Document every step, because regulators expect written proof, not just intent.
HIPAA Security Rule setup Roadmap
The HIPAA Security Rule sets the national standard for protecting digital health data (ePHI).
Covered entities and business associates must follow it. Skipping it brings serious fines and reputation damage.
Many practices struggle to turn broad rules into clear steps. This roadmap breaks the work into phases you can act on.
Understanding the HIPAA Security Rule
Purpose and Scope
The HIPAA Security Rule lives at 45 CFR Part 160 and Part 164 (Subparts A and C). It applies to all covered entities and their business associates that create, receive, keep, or send ePHI.
The Privacy Rule covers all forms of health data. The Security Rule covers only digital data.
The rule requires your practice to:
- Ensure the data privacy, accuracy, and access of all ePHI you create, receive, keep, or send.
- Protect against reasonably anticipated threats to the security or accuracy of ePHI.
- Protect against reasonably anticipated not allowed uses or shares of ePHI.
- Ensure team compliance with the Security Rule's rules.
Required vs. Addressable implementation specifications
People often confuse required and addressable specs. Required specs must be put in place (45 CFR 164.306(d)(2)). Addressable specs are not optional.
For each addressable spec, you must first assess whether it is reasonable and appropriate for your setting. If it is, put it in place. If it is not, write down why and put in an equivalent alternative measure if one is reasonable and appropriate (45 CFR 164.306(d)(3)).
That choice must be in writing. Regulators expect to see proof that you weighed each addressable spec seriously, not that you skipped it to save money.
The Three Safeguard Categories
The Security Rule splits protections into three groups: admin, physical, and tech protections. Each group covers a different part of ePHI protection. All three must work together.
Strong tech controls mean little without solid admin policies. And great policies fail without tech controls to back them up.
Phase 1: admin protections
Admin protections form the base of any HIPAA security program. They hold more than half of the Security Rule's implementation specifications (21 of the 36 listed in the rule's Appendix A matrix). They address the human and team side of security.
Without strong admin protections, your tech and physical controls lack the structure they need to work.
Security Management Process
The security management process is the cornerstone of admin protections. It requires policies and steps to prevent, detect, contain, and correct security breaches. It has four key parts:
- Risk analysis: Run a thorough, accurate check of risks and weak points that could affect ePHI. It is the focus of OCR's Risk Analysis Initiative, and OCR's 2016-2017 HIPAA audits found that most covered entities failed to implement it properly. Read the HIPAA risk review article for a full guide.
- Risk management: Put security measures in place to reduce risks to a reasonable and appropriate level.
- Sanction policy: Apply right penalties to staff who break security policies.
- Information system action review: Regularly review audit logs, access reports, and security incident records.
Here is the risk analysis requirement in the rule's own words:
“Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.”
Document every step of the security management process. Regulators expect to see written proof of your compliance, not just your intent.
A real example from One Guy Consulting's case studies: a mental health franchise office in Florida had policies that were never written, records with holes, and staff training half done, with a state auditor due in days. A ranked action plan and daily check-ins had the office ready for its audit in under a week, and it passed its state audit.
Assigned Security Responsibility
The Security Rule requires you to name a security official. This person develops and carries out your security policies. They are the single point of clear ownership for your HIPAA security posture.
In small practices, this person may also serve as the privacy officer. But the duties must be clearly defined and written down.
The security official needs enough authority to enforce compliance across departments. They need proper training and direct access to leadership to report on security incidents. The compliance officer guide details the full scope of duties this role requires.
team Security and Training
team security controls ensure only authorized staff can access ePHI. Access must be managed throughout the full employment lifecycle. Key rules include:
- access rights and supervision: Set steps for granting access to ePHI based on job function.
- team clearance: Use steps to confirm that each staff member's access level is right.
- ending steps: Remove access right away when staff leave or change roles.
Security awareness and training is a required standard (45 CFR 164.308(a)(5)) that many practices underestimate. Its four implementation specifications are addressable:
- Security reminders: Regular updates about new threats and policy changes.
- Protection from malicious software: Steps to guard against, detect, and report malware. The right HIPAA compliance tools can automate malware detection and reporting.
- Login tracking: Steps for watching login attempts and reporting odd action.
- Password management: Best habits for creating, changing, and protecting passwords.
The Security Rule does not set a training schedule. A practical one is onboarding, once a year, and after any major change to ePHI security. Record all training (dates, content, and attendance) to show compliance.
backup Planning
You must create a backup plan for events that damage ePHI systems. This plan has five parts:
- Data backup plan: Create and keep exact copies of ePHI that you can retrieve.
- Disaster recovery plan: Set steps to restore lost data from backups.
- Emergency mode operation plan: Define steps for running key steps during an emergency.
- Testing and revision: Test and update backup plans often.
- Applications and data criticality analysis: Rate which apps and data are most key so you know what to restore first.
Test your backup plan with tabletop exercises. Simulated recovery drills reveal gaps before a real emergency does.
Phase 2: Physical protections
Physical protections protect the systems, equipment, and media that store or send ePHI. Technical controls get a lot of attention. But a stolen laptop or an unlocked server room can expose ePHI just as surely as a hacked password.
Facility Access Controls
You must limit physical access to digital systems and the spaces that house them. At the same time, you must allow properly authorized access. Specs include:
- backup operations: Steps for facility access during emergencies to support data restoration.
- Facility security plan: Policies to protect the building and equipment from unapproved access, tampering, and theft.
- Access control and validation: Steps to control and confirm physical access based on a person's role.
- upkeep records: Policies for writing down repairs and changes to physical security parts such as locks and doors.
Use badge access, visitor logs, security cameras, and locked server rooms. Physical barriers should block entry to areas where ePHI is stored or processed.
Workstation and Device Security
Workstation use policies must spell out approved functions, how to perform them, and the physical setting where workstations can be used. Workstation security rules require physical controls that limit access to authorized users only.
Device and media controls cover hardware and digital media that hold ePHI. You must set up:
- Disposal: Steps for safely removing ePHI from hardware or media before disposal.
- Media re-use: Steps for wiping ePHI from digital media before it is reused.
- clear ownership: Records of hardware and media movements, including who is responsible.
- Data backup and storage: Create retrievable copies of ePHI before moving any equipment.
Keep a full list of all devices and media that hold ePHI. This list speeds up breach response by helping you identify affected data fast.
Phase 3: Technical protections
Technical protections are technology-based controls that manage access to ePHI. They also protect ePHI during transfer and storage. These controls turn admin policies into system-level protections.
Access Controls
Access control is a required standard with four specs:
- Unique user finding (required): Assign a unique name or number to track each user who accesses ePHI.
- Emergency access step (required): Set steps for getting needed ePHI during an emergency.
- Automatic logoff (addressable): Use digital steps that end sessions after a set period of no action.
- encryption and decryption (addressable): Use tools to encrypt and decrypt ePHI at rest.
Role-based access control (RBAC) is a common way to meet access control rules. RBAC assigns permissions based on job function. This ensures staff see only the ePHI they need, in line with the minimum necessary standard from the Privacy Rule.
Audit Controls and Integrity
Audit controls require hardware, software, and steps to record and review action in ePHI systems. Effective audit logs should capture:
- User login and logout events.
- Access to ePHI records.
- Changes made to ePHI.
- Admin actions such as account creation and permission changes.
- Failed access attempts.
Integrity controls protect ePHI from improper changes or destruction. An addressable specification calls for electronic mechanisms to confirm that ePHI has not been altered or destroyed in an unauthorized manner (45 CFR 164.312(c)(2)). Common tools include checksums, digital signatures, and database accuracy checks.
transfer Security
You must use tech controls to block unapproved access to ePHI sent over digital networks. Two addressable specs support this:
- Integrity controls: tools to detect any improper changes to ePHI during transfer.
- encryption: Encrypt ePHI whenever it travels over open networks.
Use TLS 1.2 or higher for all network transfers that involve ePHI. Apply end-to-end encryption for emails that contain ePHI. Use VPN connections for remote access to ePHI systems.
Transmission encryption is addressable. If you decide not to encrypt ePHI sent over open networks, you must write down why and what equivalent measure you use instead.
Authentication
The person or entity authentication standard (45 CFR 164.312(d)) requires steps to verify who is seeking access to ePHI. Modern setups often include:
- Multi-factor login checks (MFA) for all ePHI system access.
- Certificate-based login checks for system-to-system communications.
- Biometric login checks for high-security access points.
- Single sign-on (SSO) with strong identity providers.
The current Security Rule does not name MFA. The proposed Security Rule update (published as a proposed rule on January 6, 2025, and not yet final) would require it, and MFA is a strong way to meet the authentication standard today.
Building Your setup Timeline
review Phase (Months 1-2)
Start with a full gap analysis comparing your current security posture to every Security Rule standard and spec. This phase includes:
- Inventory all ePHI: Find every system, app, and location where ePHI is created, received, kept, or sent.
- Conduct a risk analysis: Follow the steps in the HIPAA risk review guide.
- Document current controls: Map existing security measures to specific Security Rule rules.
- Identify gaps: Build a ranked list of missing or weak controls.
- set up baseline metrics: Record your current security posture so you can measure progress.
Fix Phase (Months 3-8)
Address gaps in order of risk priority. Fix high-risk weak points that could cause a breach first. Tackle moderate-risk items next. For each gap:
- Define the specific control or policy needed.
- Assign duty to a team member or department.
- Set a realistic deadline.
- Allocate the budget and resources required.
- Document the fixes as they progress.
Sustainment Phase (Ongoing)
HIPAA Security Rule compliance is not a one-time project. Ongoing actions include:
- Repeat risk analyses: Reassess risks on a regular schedule (many practices choose once a year) and after any major change.
- Continuous tracking: Review audit logs, access reports, and security alerts regularly.
- Policy updates: Revise policies to address new threats, technologies, and changes in your practice.
- team training: Run annual training and targeted education for new threats.
- Incident response drills: Test your incident response and backup plans with regular exercises.
- Vendor management: Review business associate agreements and check vendor compliance each year.
Policies and Procedures Documentation
What Must Be Documented
The Security Rule requires written policies and steps for each standard and spec. Required written records includes:
- Policies for each Security Rule standard (admin, physical, tech).
- steps describing how each policy works in practice.
- Risk analysis and risk management records.
- Sanction records for policy breaches.
- Training records including content, dates, and attendance.
- Incident response records writing down security incidents and corrective actions.
- Business associate agreements and vendor reviews.
- backup plan test records and results.
Retention Requirements
Keep all Security Rule written records for six years from the date it was created or last in effect, whichever is later. Use a record management system that supports version control, access tracking, and secure storage.
Good written records are your strongest defense in an audit or breach inquiry.
Security Rule FAQ
What is the difference between required and addressable specs?
Required specs must be put in place. Addressable specs require a written review: assess whether the spec is reasonable and appropriate for your setting; if it is, put it in place; if not, write down why and use an equivalent alternative measure if one is reasonable and appropriate (45 CFR 164.306(d)). Addressable does not mean optional.
How often should we conduct a HIPAA Security Rule risk analysis?
The Security Rule does not set a specific frequency. It does require you to review and update your security measures as needed (45 CFR 164.306(e)) and to run periodic evaluations (45 CFR 164.308(a)(8)). Many practices redo the risk analysis once a year, and you should run one after any major change: new systems, new locations, or big changes to your practice. See the HIPAA risk review guide for the full process.
Do small practices need to implement all Security Rule requirements?
Yes. The Security Rule applies to all covered entities and business associates regardless of size. The rule is designed to scale: the specific measures you use may vary based on your size, complexity, and risk profile. Small practices should read the HIPAA rule-keeping checklist for practical guidance.
What are the penalties for Security Rule breaches?
Under the current inflation-adjusted amounts (45 CFR 102.3), civil penalties range from $145 to $2,190,294 per violation, depending on the level of fault. The calendar-year cap for violations of an identical requirement is $2,190,294.
Beyond fines, practices face reputation damage and loss of patient trust.
Is encryption required under the HIPAA Security Rule?
Encryption is an addressable spec for both data at rest and data in transit. Choosing not to encrypt requires a written reason and an equivalent alternative measure if one is reasonable and appropriate. The proposed Security Rule update (published January 6, 2025) would make encryption required. See the full breakdown of HIPAA encryption requirements for 2026. The timeline has slipped, though; the 2027 delay explains where finalization stands.
Encryption also matters after a loss. Breach notification applies to unsecured PHI, which 45 CFR 164.402 defines as PHI not rendered unusable, unreadable, or indecipherable to unauthorized persons through a technology or method the Secretary specifies in guidance.
Security Rule setup Takeaways
Carrying out the HIPAA Security Rule takes a structured, multi-phase effort. It needs commitment from leadership, dedicated resources, and ongoing attention. This roadmap takes you from admin protections through physical and tech controls to sustained compliance.
Practices that take a proactive, step-by-step approach protect their patients and their reputation.
One Guy Consulting provides expert guidance on HIPAA Security Rule setup, from initial gap reviews to full compliance programs. The HIPAA compliance guide covers the full regulatory picture, and the policy library provides ready-to-use templates. Book a free 30-minute intro call to build a security program that meets the Security Rule and protects patient data. HIPAA consulting HIPAA compliance checklist risk assessment template guide
One Guy Consulting in 37 Seconds
Security Rule Implementation Checklist
The Security Rule organizes its requirements into standards and implementation specifications. Each specification is either required (R) or addressable (A).
| Standard | CFR Section | Key Specifications | Type |
|---|---|---|---|
| Risk Analysis | 164.308(a)(1)(ii)(A) | Conduct accurate and thorough risk assessment | R |
| Risk Management | 164.308(a)(1)(ii)(B) | Implement measures to reduce risk to reasonable levels | R |
| Workforce Security | 164.308(a)(3) | Authorization, clearance, termination procedures | R standard, A specs |
| Access Controls | 164.312(a)(1) | Unique user IDs, emergency access, auto-logoff, encryption | R + A |
| Audit Controls | 164.312(b) | Record and examine system activity | R |
| Transmission Security | 164.312(e)(1) | Integrity controls, encryption | R standard, A specs |
| Contingency Plan | 164.308(a)(7) | Backup plan, disaster recovery, emergency mode | R + A |
| Evaluation | 164.308(a)(8) | Periodic technical and nontechnical evaluation | R |
Key stat: The Security Rule's Appendix A matrix lists 14 required and 22 addressable implementation specifications across its three safeguard categories, plus six standards (such as audit controls) that have no separate specifications and are required as written. Each addressable specification needs a documented decision under 45 CFR 164.306(d)(3).
Sources
- 45 CFR Part 164, Subpart C - Security Standards
- NIST SP 800-66 Rev. 2 - HIPAA Security Rule Implementation
- 45 CFR 164.308 - Administrative Safeguards
- HHS Security Rule Guidance
Related Reading
Try three One Guy Consulting 3D staff training courses free →