What are the three required safeguards per the security rule?

The HIPAA Security Rule requires implementation of three types of safeguards: administrative, physical, and technical.

Administrative Safeguards

• Definition: Policies, procedures, and administrative actions that manage the selection, development, implementation, and maintenance of security measures.
• Focus: Protects electronic protected health information (ePHI) by governing workforce conduct and administrative processes.
• Key areas: Security management processes, assigned security responsibilities, workforce training, and contingency planning.

Physical Safeguards

• Definition: Physical measures, policies, and procedures used to protect electronic information systems, related buildings, and equipment.
• Focus: Guards physical assets and infrastructure against natural hazards, environmental hazards, and unauthorized physical intrusion.
• Key areas: Facility access controls, workstation use/security, and device and media controls.

Technical Safeguards

• Definition: The technology, policies, and procedures for its use that protect ePHI and control access to it.
• Focus: Uses technology-based security controls to secure data during storage and transmission.
• Key areas: Access controls, audit controls, data integrity, user authentication, and transmission security.

The three types of safeguards required under the HIPAA Security Rule to protect electronic protected health information (ePHI) are administrative, physical, and technical.

1. Administrative Safeguards

Administrative safeguards are policies, procedures, and management actions that govern how an organization handles security and risk.

• Security management: Conducting regular risk analyses and risk management plans.
• Workforce training: Providing staff with ongoing security awareness and training.
• Access management: Restricting data access to only those workers who need it for their jobs.

2. Physical Safeguards

Physical safeguards are real-world, tangible measures used to protect physical buildings, workstations, and equipment from unauthorized access or environmental hazards.

• Facility access controls: Limiting physical entry into buildings and rooms housing servers or sensitive data using badges or visitor logs.
• Workstation security: Placing privacy screens and positioning monitors away from public view.
• Device controls: Regulating how hardware and electronic media are moved, reused, or permanently destroyed.

3. Technical Safeguards

Technical safeguards use technology-based systems and software to control access to data and protect it while in transit or at rest.

• Access controls: Assigning unique user IDs and using multi-factor authentication.
• Audit controls: Recording and tracking activity on information systems that contain sensitive data.
• Transmission security: Encrypting data to prevent unauthorized interception across networks.

The three safeguards required by the HIPAA Security Rule are administrative, physical, and technical safeguards. These categories work together to protect electronic protected health information (ePHI).

Administrative Safeguards

Administrative safeguards are the policies, procedures, and management tools used to select and guide behavior in protecting data.

• Security Management: Conducting risk analysis and managing identified risks.
• Assigned Security Responsibility: Naming a privacy or security officer to oversee compliance.
• Workforce Training: Providing regular and ongoing security awareness training for employees.
• Information Access Management: Restricting access to ePHI based on job roles.

Physical Safeguards

Physical safeguards protect the physical buildings, equipment, and actual hardware where data is kept.

• Facility Access Controls: Limiting physical access to server rooms and data centers using badges or logs.
• Workstation Use: Setting rules for proper behavior and placement of computer screens.
• Workstation Security: Implementing physical locks, privacy screens, and automatic log-offs.
• Device and Media Controls: Managing the movement, disposal, and reuse of hardware and electronic media.

Technical Safeguards

Technical safeguards use technology to control and monitor access to electronic data.

• Access Control: Using unique user IDs, multi-factor authentication, and emergency access procedures.
• Audit Controls: Recording and inspecting system activity and login logs.
• Integrity Controls: Protecting data from improper alteration or destruction.
• Transmission Security: Encrypting data while it moves across networks or the internet.

The HIPAA Security Rule divides required safeguards into three categories: administrative, physical, and technical.

Read more about these standards in the Summary of the HIPAA Security Rule provided by the federal government.

Administrative Safeguards

• Policies and procedures: Document how your organization manages security.
• Risk management: Conduct regular risk analyses to spot and fix threats.
• Workforce training: Train staff on privacy rules and how to report security incidents.

Physical Safeguards

• Facility access: Limit physical entry to buildings and rooms holding data.
• Workstation security: Position screens away from public view and use privacy filters.
• Device controls: Track, wipe, or destroy hardware and media safely.

Technical Safeguards

• Access control: Use unique user IDs and multi-factor authentication.
• Audit controls: Track activity and system logs.
• Transmission security: Encrypt data during transfer using secure networks.

The three types of data security safeguards required by the HIPAA Security Rule are administrative, physical, and technical safeguards.

According to guidelines from the U.S. Department of Health and Human Services (HHS), these three categories work together as a layered defense system to protect electronic protected health information (ePHI).

1. Administrative Safeguards

Administrative safeguards are policies, procedures, and management actions designed to select, develop, implement, and maintain security measures that protect ePHI and manage the conduct of the workforce.

• Security Management Process: Policies to identify and analyze risks to ePHI and implement measures to reduce those risks.
• Assigned Security Responsibility: Designation of a security official responsible for developing and implementing security policies.
• Workforce Security: Screening processes and authorization protocols for employees who access ePHI.
• Information Access Management: Restricting access to ePHI strictly to authorized roles and job duties.
• Security Awareness and Training: Ongoing training programs for all staff regarding security threats and updates.
• Contingency Planning: Establishing data backup, disaster recovery, and emergency mode operation plans.

2. Physical Safeguards

Physical safeguards are physical measures, policies, and procedures to protect a covered entity’s electronic information systems and the buildings and equipment housing them from natural and environmental hazards, as well as unauthorized intrusion.

• Facility Access Controls: Limiting physical access to data centers and server rooms using badges, keys, or visitor logs.
• Workstation Use: Policies governing how workstations and computer terminals can be used to prevent unauthorized viewing.
• Workstation Security: Physical security measures for all workstations that access ePHI, such as privacy screens and cable locks.
• Device and Media Controls: Rules regarding the receipt, movement, and final disposal of hardware and electronic media containing ePHI.

3. Technical Safeguards

Technical safeguards are the technology and the policy and procedures for its use that protect ePHI and control access to it.

• Access Control: Unique user identification, emergency access procedures ("break-glass"), automatic log-off, and data encryption.
• Audit Controls: Hardware, software, and procedural mechanisms that record and examine activity in information systems containing ePHI.
• Integrity Controls: Policies and technology to protect ePHI from improper alteration or destruction.
• Person or Entity Authentication: Procedures verifying that a person or entity seeking access to ePHI is the one claimed.
• Transmission Security: Guarding against unauthorized access to ePHI that is being transmitted over an electronic communications network, typically via encryption.