What safeguards are in place for HIPAA?

Editorial team Published on

Under the Summary of the HIPAA Security Rule provided by the U.S. Department of Health and Human Services, regulated entities must implement administrative, physical, and technical safeguards to protect electronic protected health information (ePHI).

Administrative Safeguards

These are the management actions, policies, and procedures used to select, develop, and maintain security measures. They also guide employee conduct.

  • Security Management Process: Perform risk analyses to find potential threats and vulnerabilities to patient data.
  • Workforce Training: Train all employees on security policies and how to spot privacy risks.
  • Information Access Management: Restrict data access only to workers who need it for their jobs.
  • Evaluation: Regularly check security performance to ensure policies work properly.

Physical Safeguards

These measures protect the physical buildings, computer systems, and equipment where data is stored from unauthorized access.

  • Facility Access Controls: Limit physical entry to offices and server rooms using keys, badges, or security guards.
  • Workstation Use: Set rules for proper behavior and screen placement on computers that access health data.
  • Workstation Security: Secure physical terminals using privacy screens or cable locks.
  • Device and Media Controls: Track hardware movement, data backups, and secure disposal or wiping of old hard drives.

Technical Safeguards

These security strategies use technology to control and monitor who gets access to electronic health information.

  • Access Control: Assign unique user IDs and strong passwords so only authorized people log in.
  • Audit Controls: Keep logs of system activity to track who views or changes data.
  • Integrity Controls: Use software to make sure patient data is not illegally changed or deleted.
  • Authentication: Verify the identity of any person or program trying to access data.
  • Transmission Security: Encrypt data while it moves across networks to prevent interception.

What are the top 10 most common HIPAA violations?

The most common HIPAA violations involve employee snooping, lost or stolen unencrypted devices, and failing to conduct organization-wide risk analyses.

The Health Insurance Portability and Accountability Act (HIPAA) protects patient health information. When healthcare groups or their business partners break these rules, it leads to heavy fines and legal trouble.

Top 10 Most Common HIPAA Violations

  • Employee Snooping: Staff members look at patient files, such as records for coworkers or neighbors, without a valid work reason.
  • Lost or Stolen Devices: Laptops, phones, or USB drives containing unencrypted electronic protected health information (ePHI) go missing in public.
  • Lack of Organization-Wide Risk Analysis: Clinics fail to perform regular security audits to find weak spots in their computer and paper systems.
  • Improper Disposal of Records: Staff throw away paper files with patient data in normal trash or fail to securely wipe old hard drives.
  • Weak Access Controls: Offices use shared passwords, leave computer screens unlocked, or do not use multi-factor authentication.
  • Unauthorized Texting or Emailing: Workers send patient data over regular, unsecured text messages or consumer email apps instead of encrypted platforms.
  • Missing Business Associate Agreements (BAAs): Companies hire outside vendors—like billing firms or cloud software providers—without signing a legal BAA contract.
  • Delayed Breach Notifications: Organizations take longer than the allowed 60 days to report a data breach to the government or affected patients.
  • Inadequate Employee Training: Staff do not receive annual or proper education on how to handle private patient data safely.
  • Denying Patient Record Access: Providers take more than 30 days to give patients copies of their own medical records.

To learn more, you can read the Most Common HIPAA Violations Guide.

What are the 5 main HIPAA rules?

The five main rules of the Health Insurance Portability and Accountability Act (HIPAA) are the Privacy Rule, Security Rule, Breach Notification Rule, Transactions and Code Sets Rule, and Unique Identifiers Rule.

1. The Privacy Rule

  • What it does: Controls how protected health information (PHI) is used and shared by healthcare providers and plans.
  • Key right: Gives patients the right to view, get copies of, and request corrections to their medical records.

2. The Security Rule

  • What it does: Protects electronic protected health information (ePHI).
  • Key controls: Requires administrative, physical, and technical safeguards—such as encryption and access controls—to secure digital medical data.

3. The Breach Notification Rule

  • What it does: Requires healthcare groups to report compromised PHI.
  • Key requirement: Mandates notifying affected individuals, the government, and sometimes the media without unreasonable delay (within 60 days).

4. The Transactions and Code Sets Rule

  • What it does: Standardizes electronic billing and data exchanges.
  • Key goal: Makes healthcare claims and transactions uniform and efficient by using standard coding formats like ICD-10.

5. The Unique Identifiers Rule

  • What it does: Assigns standard identification numbers to healthcare participants.
  • Key example: Requires providers to use a unique 10-digit National Provider Identifier (NPI).

What are the four safeguards that should be in place?

The four specific safeguards commonly referenced in HIPAA training multiple-choice questions are Oral, Paper/Physical, Electronic, and Disposal.

The Four Safeguards Explained

  • Oral: Controlling what you say aloud. Do not discuss client or patient data in public areas, and use lower voices or closed doors on the phone.
  • Paper/Physical: Protecting physical files and hard copies. Keep physical Protected Health Information (PHI) locked in desks, file cabinets, or car trunks when moving between locations.
  • Electronic: Securing digital data. Use passwords, lock computer screens when walking away, and send encrypted emails.
  • Disposal: Properly destroying sensitive data. Shred paper documents and securely wipe or destroy old electronic media rather than throwing them in the regular trash.

(Note: If your question is instead referring to the four standards within HIPAA Physical Safeguards, they are Facility Access Controls, Workstation Use, Workstation Security, and Device and Media Controls.)

What are the new HIPAA security rules in 2026?

The proposed updates to the HIPAA Security Rule eliminate previous flexibilities by making core cybersecurity controls mandatory rather than "addressable", though federal regulators have delayed the final rule's release to mid-2027.

Key Proposed Requirements

  • Mandatory Encryption: Encryption of electronic protected health information (ePHI) at rest and in transit becomes strict and universal, removing prior loopholes.
  • Multi-Factor Authentication (MFA): MFA is required across all systems and applications that touch ePHI for both users and administrators.
  • Defined Testing Schedules: Organizations must perform vulnerability scans at least every six months and full penetration testing annually.
  • Contingency Timelines: Mandates a 72-hour window for critical data restoration and 24-hour notification for contingency plan activation.
  • Asset Inventories & Network Maps: Requires a formal, annually reviewed inventory of technology assets and network diagrams tracking ePHI flow.
  • Stricter Vendor Accountability: Covered entities must obtain written verification of technical safeguards from business associates at least once a year.

HIPAA physical safeguards

9 related questions found

Is talking about a coworker a HIPAA violation?

Talking about a coworker is a HIPAA violation only if you share their protected health information (PHI) and you obtained it through your role at a healthcare provider, health plan, or healthcare clearinghouse.

When It Is a HIPAA Violation

  • Accessing records without a job reason: Looking up a coworker’s lab results, chart, or medical history in an electronic health record (EHR) system out of curiosity or without a direct care role is a severe violation.
  • Disclosing medical facts learned at work: Sharing specific health details about a coworker that you learned through your healthcare job with unauthorized people inside or outside the workplace breaks federal privacy laws.

When It Is NOT a HIPAA Violation

  • General workplace gossip: If you are talking about a coworker's general behavior, schedule, or performance—or sharing something the coworker told you voluntarily in casual conversation—it is not protected by HIPAA.
  • Employer actions: As most users on Quora agree, general employers (even in healthcare) are usually not "covered entities" under HIPAA when handling employee medical files or leave. While a boss discussing your medical leave or injury with others might violate company policy, employment laws (like the ADA), or the Rehabilitation Act, it is technically not a HIPAA breach.

What qualifies as a HIPAA violation?

A HIPAA violation occurs when a covered entity or business associate fails to follow the rules of the Health Insurance Portability and Accountability Act, leading to the unauthorized use, access, or disclosure of Protected Health Information (PHI).

Common Examples of Violations

  • Unauthorized Disclosure: Sharing patient medical information with unauthorized people, family, or third parties without patient consent.
  • Snooping: Healthcare workers looking at patient charts or records out of curiosity without a professional need to know.
  • Lack of Encryption or Security: Leaving physical files in unlocked areas or failing to encrypt digital data on laptops, phones, or servers.
  • Unsecure Communications: Sending patient data through standard, unencrypted email or text message platforms.
  • Stolen or Lost Devices: Failing to protect mobile devices or hardware containing unencrypted patient information.
  • Denying Patient Access: Refusing or failing to provide patients with timely access to their own medical records within the legal timeframe.
  • Failing to Train Staff: Neglecting regular mandatory privacy and security training for employees.

Categories and Penalties

  • Civil Violations (Unintentional): Accidents or mistakes caused by carelessness or ignorance. Fines range from $100 to over $71,000 per violation depending on awareness and whether it was fixed quickly.
  • Criminal Violations (Intentional): Knowingly obtaining or disclosing PHI under false pretenses or for personal financial gain/malicious harm. Penalties include heavy fines up to $250,000 and prison sentences up to 10 years.

What is not allowed under HIPAA?

Under the Health Insurance Portability and Accountability Act (HIPAA), healthcare providers, health plans, and clearinghouses are strictly not allowed to share or use a patient's Protected Health Information (PHI) without the patient’s written authorization, except for specific purposes like treatment, payment, or healthcare operations.

Prohibited Actions and Disclosures

  • Sharing with employers: Providers cannot give your health information or test results directly to your employer without your signed consent.
  • Marketing use: Selling patient information or using PHI for commercial marketing or advertising without explicit permission is barred.
  • Social media sharing: Posting patient photos, details, or identifying medical stories online is forbidden.
  • Gossip and casual talk: Discussing patient conditions in public areas or with unauthorized family and friends is prohibited.
  • Leaving unsecured records: Leaving paper charts, unencrypted laptops, or visible computer screens exposed to unauthorized people is a violation.

What HIPAA Does Not Cover

HIPAA only applies to covered entities and their business associates. It does not restrict:

  • Employment files: Health data kept in an employer's personnel or HR files (like sick notes or drug tests) is not protected by HIPAA.
  • Consumer apps: Fitness trackers, smartwatches, and period-tracking apps are generally not bound by HIPAA rules.
  • Public records: Information already made public through news or court filings.

What are the 7 patient rights under HIPAA?

Under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, patients have fundamental rights regarding their Protected Health Information (PHI).

The primary patient rights established under HIPAA include:

  • Right to Access and Copy: Patients can inspect and obtain copies of their medical and billing records.
  • Right to Request Amendments: Patients can ask to correct or amend incomplete or inaccurate information in their records.
  • Right to an Accounting of Disclosures: Patients can obtain a list of certain times and reasons a provider or health plan shared their health information.
  • Right to Request Restrictions: Patients can ask providers or health plans to limit how they use or share their health data.
  • Right to Confidential Communications: Patients can request that providers contact them via alternative methods or at alternative locations (such as a work phone instead of a home phone).
  • Right to a Notice of Privacy Practices: Patients have the right to receive a written explanation of how their health information is used and disclosed by a covered entity.
  • Right to File a Complaint: Patients can file a privacy complaint with the health provider's privacy officer or the U.S. Department of Health and Human Services (HHS) Office for Civil Rights if they believe their rights were violated.

What are the four main pillars of HIPAA?

The four main pillars (or core rules) of HIPAA are the Privacy Rule, the Security Rule, the Breach Notification Rule, and the Enforcement Rule.

The Four Core Rules of HIPAA

  • The Privacy Rule: Protects individual medical records and personal health information (PHI), giving patients rights over their health data.
  • The Security Rule: Specifies administrative, physical, and technical safeguards to secure electronic protected health information (ePHI).
  • The Breach Notification Rule: Requires healthcare providers and business associates to notify affected individuals and the government if unsecured health data is breached.
  • The Enforcement Rule: Establishes the tiered civil monetary penalties and investigative procedures for violations of HIPAA standards.