HIPAA Security Rule Controls
Comprehensive guide to HIPAA Security Rule controls with detailed implementation guidance, requirements, and compliance resources for healthcare organizations.
Coverage Overview
Track published HIPAA control coverage by safeguard category and risk level.
All Controls
23 controls found
Disposal of ePHI and Media
Implement policies and procedures to address the final disposition of ePHI, and/or the hardware or electronic media on which it is stored.
Access Control
Implement technical policies and procedures for electronic information systems that maintain ePHI to allow access only to those persons or software… ...
Audit Controls
Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI.
Integrity
Implement policies and procedures to protect ePHI from improper alteration or destruction.
Person or Entity Authentication
Implement procedures to verify that a person or entity seeking access to ePHI is the one claimed.
Transmission Security
Implement technical security measures to guard against unauthorized access to ePHI that is being transmitted over an electronic communications… ...
Business Associate Contracts or Other Arrangements
A covered entity may permit a business associate to create, receive, maintain, or transmit ePHI on the covered entity's behalf only if the covered… ...
Requirements for Group Health Plans
Except when the only ePHI disclosed to a plan sponsor is disclosed pursuant to 164.504(f)(1)(ii) or (iii), or as permitted under 164.508(a)(3)(i), a… ...
Policies and Procedures
Implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of… ...
Documentation
Maintain the policies and procedures implemented to comply with this subpart in written (which may be electronic) form.
Time Limit
Retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in… ...
Understanding HIPAA Controls
Essential information to help you navigate HIPAA Security Rule requirements.
Risk-Based Approach
Start with high-risk controls that address the most common HIPAA violations. Focus on access controls, encryption, and audit logging first.
Documentation Required
Maintain comprehensive documentation for all security controls. Use our downloadable templates to ensure nothing is missed.
Ongoing Monitoring
HIPAA compliance requires regular monitoring, testing, and review. Establish quarterly assessments and annual comprehensive audits.
Control Coverage Checklist
To cover the Security Rule comprehensively, maintain controls across administrative, physical, and technical safeguards with documented ownership and review cadence.
Administrative Safeguards
Risk analysis, workforce security, sanctions, contingency planning, and policy governance.
Physical Safeguards
Facility access controls, workstation use restrictions, device/media controls, and secure disposal.
Technical Safeguards
Access control, audit controls, integrity mechanisms, transmission security, and encryption practices.
Need Help with HIPAA Compliance?
Knowing the controls is the first step; evidencing them to an auditor is the harder one. Our certified auditors help you implement the right safeguards, document them properly, and stay compliant year after year. See how our compliance services work, review transparent pricing, or cross-reference these controls against the NIST framework.