What does the HIPAA security rule cover?

The HIPAA Security Rule specifically protects electronic protected health information (ePHI)—any individually identifiable health information that a covered entity or business associate creates, receives, maintains, or transmits in electronic form.

Core Protections (The CIA Triad)

The Security Rule requires organizations to ensure three core elements for ePHI:

• Confidentiality: Ensuring data is not made available or disclosed to unauthorized persons.
• Integrity: Ensuring data is not altered or destroyed in an unauthorized manner.
• Availability: Ensuring data is accessible and usable upon demand by an authorized person.

Required Safeguards

To protect ePHI, regulated entities must implement three types of security measures, outlined in the official HHS Security Rule Overview:

• Administrative Safeguards: Internal policies, formal procedures, risk assessments, and workforce security training.
• Physical Safeguards: Physical measures, workstation use policies, and facility access controls to protect hardware and equipment.
• Technical Safeguards: Technology controls, audit logs, access management, and encryption to secure data systems and transmissions.

Note: Unlike the broader HIPAA Privacy Rule, which covers protected health information (PHI) in all formats (paper, oral, and electronic), the Security Rule applies strictly to electronic data.

HIPAA covers the privacy, security, and integrity of patient health information known as Protected Health Information (PHI).

What Information Is Covered (PHI)

• Medical records: Physical and mental health histories, diagnoses, and treatment notes.
• Billing and payment data: Insurance claims, payment details, and billing records.
• Personal identifiers: Names, birth dates, social security numbers, phone numbers, and addresses linked to health data.
• Formats: Information in any medium, whether electronic (e-PHI), written on paper, or spoken aloud.

Who Must Follow HIPAA (Covered Entities)

• Healthcare providers: Doctors, clinics, dentists, psychologists, and pharmacies that transmit data electronically.
• Health plans: Health insurance companies, HMOs, company health plans, and government programs like Medicare and Medicaid.
• Healthcare clearinghouses: Entities that process nonstandard health data into standard formats.
• Business associates: Third-party vendors and contractors that handle PHI for covered entities.

What Is Not Covered

• Employers: Employment records kept by an employer in its role as an employer are excluded.
• Education and schools: Most student educational records managed under FERPA are exempt.
• Life insurers and auto insurers: Companies offering life insurance, casualty insurance, or workers' compensation are generally not bound by HIPAA.
• Non-health entities: Fitness apps, wearable trackers, or casual health queries made outside a formal medical provider or plan are typically not covered.

You can read official guidance on who and what is included directly through the U.S. Department of Health & Human Services (HHS).

The three main components of the HIPAA Security Rule are administrative, physical, and technical safeguards.

Administrative Safeguards

Administrative safeguards are the policies, procedures, and management actions used to select, develop, and maintain security measures.

• Risk analysis: Finding and evaluating potential threats to electronic protected health information (ePHI).
• Assigned security responsibility: Naming a specific security officer in charge of creating and carrying out policies.
• Workforce training: Educating employees about security risks, policies, and how to spot potential data breaches.

Physical Safeguards

Physical safeguards protect the actual physical buildings, equipment, and hardware where ePHI is stored.

• Facility access controls: Limiting physical access to rooms and buildings with computer systems using badges, keys, or visitor logs.
• Workstation security: Securing computer terminals by placing screens away from public view and using automatic logoffs.
• Device and media controls: Managing the movement, disposal, and reuse of hardware and electronic media containing data.

Technical Safeguards

Technical safeguards use technology and related access policies to protect data and control who can see it.

• Access control: Using unique user IDs, multi-factor authentication, and emergency break-glass access.
• Audit controls: Tracking and recording activity within systems that contain ePHI.
• Transmission security: Protecting data as it moves across networks, often using encryption.

The five main rules of the Health Insurance Portability and Accountability Act (HIPAA) are the Privacy Rule, Security Rule, Breach Notification Rule, Transactions and Code Sets Rule, and Unique Identifiers Rule.

1. The Privacy Rule

• What it does: Controls how protected health information (PHI) is used and shared by healthcare providers and plans.
• Key right: Gives patients the right to view, get copies of, and request corrections to their medical records.

2. The Security Rule

• What it does: Protects electronic protected health information (ePHI).
• Key controls: Requires administrative, physical, and technical safeguards—such as encryption and access controls—to secure digital medical data.

3. The Breach Notification Rule

• What it does: Requires healthcare groups to report compromised PHI.
• Key requirement: Mandates notifying affected individuals, the government, and sometimes the media without unreasonable delay (within 60 days).

4. The Transactions and Code Sets Rule

• What it does: Standardizes electronic billing and data exchanges.
• Key goal: Makes healthcare claims and transactions uniform and efficient by using standard coding formats like ICD-10.

5. The Unique Identifiers Rule

• What it does: Assigns standard identification numbers to healthcare participants.
• Key example: Requires providers to use a unique 10-digit National Provider Identifier (NPI).

The HIPAA Security Rule requires covered entities and business associates to protect the confidentiality, integrity, and availability of electronic protected health information (ePHI) using three main categories of safeguards: administrative, physical, and technical.

Administrative Safeguards

Administrative safeguards are policies, procedures, and management actions used to select, develop, implement, and maintain security measures.

• Security Management Process: Conduct risk analysis and apply risk management to reduce vulnerabilities.
• Assigned Security Responsibility: Designate a security official responsible for policies and procedures.
• Workforce Security: Ensure workforce members have proper authorization and supervision.
• Information Access Management: Restrict access to ePHI based on user roles (minimum necessary standard).
• Security Awareness and Training: Provide ongoing training, password management, and reminders for staff.
• Security Incident Procedures: Identify, document, and respond to security incidents.
• Contingency Plan: Create data backup, disaster recovery, and emergency mode operation plans.
• Evaluation: Perform periodic assessments of security policies and performance.
• Business Associate Contracts: Require written agreements with third parties that handle ePHI.

Physical Safeguards

Physical safeguards protect electronic systems, equipment, and the physical buildings where they reside from unauthorized access.

• Facility Access Control: Limit physical access to data centers and server rooms using cameras, guards, or badges.
• Workstation Use: Specify proper behavior and authorized functions for physical workstations.
• Workstation Security: Restrict physical access to authorized users.
• Device and Media Controls: Govern the removal, transfer, disposal, and reuse of hardware and electronic media.

Technical Safeguards

Technical safeguards are the technology and software mechanisms used to protect and control access to ePHI.

• Access Control: Implement unique user IDs, automatic logoffs, and encryption.
• Audit Controls: Use hardware and software mechanisms to record and examine system activity.
• Integrity Controls: Protect ePHI from improper alteration or destruction through authentication mechanisms.
• Person or Entity Authentication: Verify that a person or system trying to access data is authentic.
• Transmission Security: Guard against unauthorized access to data moving across a network via encryption.