Anthropic-Cybersecurity-Skills/skills/implementing-hipaa-security-rule-safeguards/references/standards.md

# HIPAA Security Rule — Standards & Reference

## Primary regulation
### HIPAA Security Rule — 45 CFR Part 164, Subpart C
- **Regulator**: U.S. Department of Health and Human Services, **Office for Civil Rights (OCR)**
- **Scope**: Security of **electronic** protected health information (ePHI) held or transmitted by covered entities and business associates.
- **Statutory basis**: HIPAA (1996) as amended by **HITECH** (2009).
- **eCFR**: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C

## Rule structure (key sections)
| Section | Title |
|---|---|
| §164.302 | Applicability |
| §164.304 | Definitions |
| §164.306 | Security standards: general rules (flexibility, scalability) |
| §164.308 | **Administrative safeguards** |
| §164.310 | **Physical safeguards** |
| §164.312 | **Technical safeguards** |
| §164.314 | Organizational requirements (BAAs, group health plans) |
| §164.316 | Policies, procedures, and documentation (6-year retention) |

Breach Notification Rule: **45 CFR §§164.400–414** (Subpart D).

## Administrative safeguards (§164.308) — standards
- Security Management Process — **Risk Analysis (R)**, **Risk Management (R)**, Sanction Policy (R), Information System Activity Review (R)
- Assigned Security Responsibility (named Security Official)
- Workforce Security (authorization/supervision, clearance, termination — Addressable)
- Information Access Management (isolating clearinghouse functions (R); access authorization/establishment/modification — Addressable)
- Security Awareness and Training (reminders, malware protection, log-in monitoring, password management — Addressable)
- Security Incident Procedures — Response and Reporting (R)
- Contingency Plan — **Data Backup Plan (R)**, **Disaster Recovery Plan (R)**, **Emergency Mode Operation Plan (R)**, Testing/Revision (A), Applications/Data Criticality Analysis (A)
- Evaluation (periodic)
- Business Associate Contracts (§164.308(b))

## Physical safeguards (§164.310) — standards
- Facility Access Controls (contingency operations, facility security plan, access control/validation, maintenance records — all Addressable)
- Workstation Use (R)
- Workstation Security (R)
- Device and Media Controls — **Disposal (R)**, **Media Re-use (R)**, Accountability (A), Data Backup and Storage (A)

## Technical safeguards (§164.312) — standards
- Access Control — **Unique User Identification (R)**, **Emergency Access Procedure (R)**, Automatic Logoff (A), Encryption and Decryption (A)
- Audit Controls (R)
- Integrity — Mechanism to Authenticate ePHI (A)
- Person or Entity Authentication (R)
- Transmission Security — Integrity Controls (A), Encryption (A)

> (R) = Required, (A) = Addressable, under the **current** rule.

## Required vs Addressable
- **Required**: must be implemented as specified.
- **Addressable**: assess whether the specification is reasonable and appropriate; if yes, implement; if no, **document why** and implement an **equivalent alternative measure** if reasonable. Addressable is **not** optional.

## Breach Notification (45 CFR §§164.400–414)
- Applies to breaches of **unsecured PHI**.
- **Four-factor risk assessment** to determine whether a breach occurred (nature/extent of PHI, who used/received it, whether it was actually acquired/viewed, mitigation).
- Notify **individuals without unreasonable delay and within 60 days**; notify **HHS** (annually for <500; without unreasonable delay and within 60 days for 500+); notify **media** for breaches affecting **500+** residents of a state/jurisdiction.
- **Safe harbor**: PHI encrypted to HHS/NIST-specified standards is "secured" and not subject to breach notification.

## 2025 NPRM — PROPOSED changes (NOT yet final)
- **Citation**: 90 FR 800, RIN 0945-AA22, published **January 6, 2025**; comment period closed March 7, 2025.
- **Status**: **Proposed only.** The current Security Rule remains in force until a final rule is published and becomes effective. Track at https://www.federalregister.gov.
- **Notable proposals**:
  - Remove the **required/addressable** distinction — make (nearly) all implementation specifications **required**.
  - Mandatory **multi-factor authentication**.
  - Mandatory **encryption of ePHI at rest and in transit**.
  - **Asset inventory** and **network maps**, updated regularly.
  - **Vulnerability scans at least every 6 months** and **penetration testing at least annually**.
  - **72-hour restoration** of certain systems/data after an incident.
  - **Annual** risk-analysis updates and written documentation of compliance reviews.
- **Typical effective/compliance timing if finalized**: effective ~60 days after publication; compliance ~180 days after effective (subject to the final rule).

## Supporting NIST guidance
| Document | Role |
|---|---|
| NIST SP 800-66 Rev 2 (2024) | Implementing the HIPAA Security Rule; maps safeguards to SP 800-53 controls. |
| NIST SP 800-30 Rev 1 | Risk-assessment methodology underpinning the required risk analysis. |
| HHS SRA Tool | Free guided Security Risk Assessment for smaller organizations. |

## NIST CSF 2.0 alignment
| CSF 2.0 ID | Relevance |
|---|---|
| GV.OC-03 | Legal/regulatory (HIPAA) requirements understood. |
| GV.RM-01 | Risk-management objectives established. |
| ID.RA-01 / ID.RA-05 | Vulnerabilities identified; risk informs prioritization (the risk analysis). |
| PR.DS-01 | Data-at-rest protection (encryption of ePHI). |
| PR.AA-01 | Identity/authentication (unique IDs, MFA). |
| DE.CM-01 | Monitoring (audit controls, activity review). |