HIPAA Security Rule Requirements

The HIPAA Security Rule is the federal regulation that requires organizations to protect electronic protected health information, or ePHI, using administrative, physical, and technical safeguards.

It applies to covered entities and their business associates, including most healthcare software vendors, hosting providers, and billing platforms.

The rule does not name specific tools. It asks organizations to choose safeguards that are reasonable and appropriate for their size, systems, and risk. This guide covers what the current rule requires, then explains the proposed 2025 update that would remove much of that flexibility.

HIPAA Security Rule at a Glance

Safeguard category	What it covers	Examples
Administrative	Policies, risk analysis, workforce management	Risk analysis, security officer, training, sanction policy
Physical	Buildings, facilities, and devices	Facility access controls, workstation security, device disposal
Technical	Systems, networks, and data access	Access control, encryption, audit logs, authentication

Published in 2003 under the original rule and updated in 2013 by the HITECH Act, the Security Rule has not been substantially revised since. That is about to change: the section below covers the proposed 2025 update in detail.

Determining Your HIPAA Obligations

Before implementing safeguards, an organization has to know its role under HIPAA. Covered entities are health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically for transactions HHS has standardized. A provider that operates entirely on paper can fall outside federal HIPAA, though state privacy law may still apply.

Business associates create, receive, maintain, or transmit PHI on a covered entity's behalf. This covers most healthcare technology vendors: hosting providers, billing services, analytics platforms, and third-party vendors that touch health data in any form. HITECH made business associates directly liable for Security Rule violations, not just the covered entities that hire them.

HIPAA Business Associate Agreement Requirements

A signed business associate agreement, or BAA, must be in place before PHI can be shared. HIPAA business associate agreement requirements cover permitted uses of PHI, require the business associate to implement safeguards, set breach notification duties, and cover the return or destruction of PHI when the relationship ends.

Subcontractors that a business associate brings in to help with PHI-related work must sign an agreement that mirrors those same restrictions. This creates a chain of responsibility: every party handling PHI stays accountable for protecting it, all the way down the vendor chain. See our guide on managing risk across vendors for how to track this.

HIPAA Administrative Safeguards

HIPAA administrative safeguards are the policies and procedures that govern how a security program is built, run, and reviewed. HHS groups them under a security management process, workforce security, and training.

HIPAA Security Management Process and Risk Analysis Requirements

Every regulated entity must run a HIPAA security management process: identify risks to ePHI, apply safeguards that reduce those risks to a reasonable level, discipline workforce members who violate policy, and regularly review access logs and audit records.

HIPAA risk analysis requirements sit at the center of this. Organizations must find where ePHI is created, stored, or transmitted, then evaluate the threats to it. HHS offers a Security Risk Assessment Tool, and NIST SP 800-66 provides implementation guidance. Risk assessments must be documented and kept for at least six years. A cybersecurity risk assessment run on a set schedule, not just once, is what auditors expect to see.

Workforce Security and Training

Most healthcare data incidents start with access problems inside the organization, not outside attackers. Workforce clearance procedures should run before granting access, and termination procedures should run the day employment ends. Access should match job duties and be reviewed on a schedule, an approach covered in our access management guide.

HIPAA does not set a required training interval, but onboarding training, annual refreshers, and updates after policy changes are standard practice. Untrained staff remain one of the most common causes of reportable incidents.

HIPAA Physical Safeguards

HIPAA physical safeguards protect the buildings, equipment, and devices that store or process ePHI, preventing unauthorized access, theft, or loss.

Facility Access Controls

• Contingency operations: procedures that let authorized staff access systems during an emergency or disaster.
• Facility security plans: physical protections such as badges, cameras, alarms, or biometric entry.
• Access validation: role-based entry and visitor management.
• Maintenance records: documentation of repairs to doors, locks, and other physical security hardware.

Workstation and Device Security

Workstations that access ePHI should lock automatically when unattended. Laptops and portable devices need encryption, controlled storage, and privacy screens where they could be viewed by others. Devices must be properly wiped before reuse or disposal so no ePHI can be recovered from them.

HIPAA Technical Safeguards

Technical safeguards use software and system controls to protect ePHI and manage who can reach it.

HIPAA Access Control Requirements

HIPAA access control requirements start with a unique user ID for each workforce member, so activity can be traced to a person. Emergency access procedures allow authorized retrieval during a crisis, and systems should log users off automatically after a period of inactivity. Authentication verifies identity through passwords, PINs, smart cards, biometrics, or multi-factor methods, backed by lockout rules that resist brute-force attempts.

HIPAA Encryption Requirements

HIPAA encryption requirements currently sit under an addressable specification: an organization must assess whether encryption is reasonable and appropriate, and if it decides not to encrypt, document the reason and apply an equivalent safeguard instead. In practice, encryption is expected almost everywhere it can be applied. HHS guidance on securing PHI treats ePHI at rest as secured when it is encrypted consistent with NIST SP 800-111. Data encrypted this way falls outside the Breach Notification Rule's reporting requirement even if it is exposed, which is why encryption is treated as both a security control and a compliance shortcut.

HIPAA Audit Controls

HIPAA audit controls require systems that store ePHI to log logins, access levels, file activity, and security events, kept for at least six years. Automated alerts and centralized log review, often through a SIEM tool, help catch suspicious activity and give auditors proof that monitoring is actually happening, not just written into a policy document.

HIPAA Breach Notification Rule Compliance

Not every unauthorized access is a reportable breach, but the HIPAA breach notification rule sets firm deadlines once one is confirmed.

When a Breach Must Be Reported

Breaches of secured PHI, meaning PHI that is encrypted to HHS standards or fully destroyed, are not reportable. For unsecured PHI, any impermissible use, access, or disclosure is presumed a breach unless a documented risk assessment shows a low probability the information was compromised. Three narrow exceptions exist: unintentional workforce access within authorized scope, inadvertent disclosure between authorized people at the same organization, and cases where the recipient could not reasonably retain the information. See our guide to HIPAA violations and their consequences for how OCR treats these cases.

Notification Timelines

Business associates must notify the covered entity within 60 days of discovering a breach. The covered entity then has 60 days to notify affected individuals, HHS, and the media if the breach affects 500 or more people. Smaller breaches can be reported to HHS annually, within 60 days of the end of the calendar year in which they were discovered. Every assessment, whether or not it results in a report, should be documented and kept for six years, a step covered further in our risk assessment methodologies guide.

The Proposed 2025 HIPAA Security Rule Update

In January 2025, HHS published a notice of proposed rulemaking to rewrite large parts of the Security Rule for the first time since 2013. The proposal responds to a sharp rise in healthcare breaches and ransomware attacks, and to gaps OCR says it keeps finding during investigations.

Current status: this is not final law. The public comment period closed in March 2025, and HHS received more than 4,700 comments. As of this writing, HHS has pushed final action to around July 2027 on its regulatory agenda, and hospital groups have asked HHS to scale the rule back, so the date could slip further. The proposal is delayed, not withdrawn. The 2013 rule remains the one organizations must follow today.

What Would Change if the Rule Is Finalized

• No more required versus addressable. The NPRM would remove this distinction entirely. Every implementation specification would become something regulated entities must do, closing the option to skip a safeguard with a documented justification.
• Multi-factor authentication required. The proposal adds a formal definition of MFA and would require it for systems that access ePHI, not just recommend it.
• Encryption becomes a standard, not addressable. Encryption of ePHI at rest and in transit would move from an addressable specification to its own standard, with only narrow, documented exceptions.
• A new vulnerability management standard. Automated vulnerability scans would be required at least once every six months, and the scanning tools themselves reviewed at least once every 12 months. Penetration testing would become a recurring, roughly annual requirement rather than a best practice.
• Written technology asset inventory and network map. Regulated entities would have to maintain and update these at least once every 12 months, or sooner after a major change.
• Annual compliance self-audits. A documented audit against every Security Rule standard and specification, at least once every 12 months.
• Faster access termination. Notice that a workforce member's access has changed or ended would be required within 24 hours, not on whatever schedule an organization currently uses.
• 72-hour restoration target. Written contingency plans would need to aim to restore critical systems within 72 hours of a loss, based on the entity's own criticality analysis.
• Annual written verification from business associates. Business associates would need to give covered entities written verification, updated at least yearly, that their technical safeguards are in place.

Together these proposals would apply to about 1.8 million regulated entities according to the Department's own cost estimates in the rule. For the section-by-section detail, the full NPRM text is on the Federal Register.

How to Prepare Now

None of this is enforceable yet, and the timeline keeps moving. But most of the proposed changes describe what security teams already treat as best practice: MFA everywhere, working encryption instead of a documented excuse not to encrypt, a real asset inventory, and evidence that safeguards are tested, not just written down. Teams that build continuous monitoring and a real evidence library now, instead of waiting for a compliance date, will have far less to redo when a final rule does land.

Maintaining Ongoing HIPAA Compliance

HIPAA compliance is not a one-time project. It needs clear processes, trained staff, and evidence that keeps itself current.

Documentation: keep risk assessments, BAAs, security policies, training records, incident reports, and audit logs for six years. Incomplete records are one of the most common findings when HIPAA violations turn into penalties.

Regular assessments: run risk analysis at least annually and after any major change, new systems, an incident, or a policy update. Our guide to risk mitigation strategies covers what to do with what you find.

Training and accountability: onboarding, annual refreshers, and updates when policy or technology changes. Track completion, not just delivery.

Monitoring tools: the manual version of all this is spreadsheets and calendar reminders. Continuous monitoring and automated evidence collection turn ongoing compliance from a recurring scramble into a system that stays current on its own. See what is HIPAA compliance for the fuller picture, and our HIPAA compliance checklist for a step-by-step start.

Frequently Asked Questions

Meeting HIPAA Security Rule Requirements

The current rule asks for administrative, physical, and technical safeguards that work together, starting from HIPAA risk analysis requirements and reviewed on a schedule, not set once and forgotten. The proposed 2025 update would tighten nearly every part of that, removing the flexibility to skip a safeguard with a written excuse. Either way, the direction is the same: continuous evidence beats a policy document nobody has opened since the last audit.

UprootSecurity helps tech companies handling PHI turn HIPAA Security Rule requirements into evidence instead of a checklist. It connects to your cloud, identity, and code tools, runs continuous monitoring so control failures surface when they happen, and keeps every piece of evidence time-stamped and ready for an auditor or a regulator. The same platform maps to SOC 2 and ISO 27001 as well, so adding a framework later does not mean starting over. If the proposed 2025 update becomes final, the groundwork you build now, real MFA, working encryption, a real asset inventory, is the same groundwork that update would require.

→ Book a demo today