The HIPAA Security Rule is the federal standard for how healthcare organizations and their vendors protect patient information stored or sent electronically. It covers passwords, devices, access, backups and vendor agreements, not who is allowed to see the information. This entry is part of the Healthcare operations glossary. It is a plain-English explainer, not legal advice. Check specific questions with your practice's privacy or security officer.
What is the HIPAA Security Rule?
The HIPAA Security Rule is the part of HIPAA that sets national standards for protecting electronic patient health information through administrative, physical and technical safeguards.
It applies only to electronic protected health information (ePHI). It does not apply to paper charts or spoken conversations.
The safeguards fall into three groups:
- Administrative: policies, staff training, risk analysis and assigned security responsibility.
- Physical: protection of the facility, workstations and devices such as laptops and tablets.
- Technical: access control, audit controls and transmission security for systems that hold ePHI.
In practice at a clinic or small practice
Front desk and nurses: Each person logs in with their own username instead of a shared front-desk password. Check-in screens lock automatically when someone steps away. Staff don't text patient details from personal phones or personal messaging apps. If a clinic tablet or work phone goes missing, they report it right away rather than waiting to see if it turns up.
Office manager: The office manager owns or coordinates the yearly risk analysis and makes sure staff complete security training. When someone leaves, the office manager removes their access to every system the same day. Before the practice uses any software vendor that stores or transmits ePHI, such as the EHR, billing software, cloud storage or a staff chat app, the vendor must sign a business associate agreement (BAA). A signed BAA is only part of the work. A staff chat app that holds ePHI still needs proper configuration, including roles, permissions, retention and offboarding. Any integrations or add-ons connected to it may need their own agreements.
Not to be confused with
| Rule | What it covers | How it differs from the Security Rule |
|---|---|---|
| HIPAA Privacy Rule | Who may use and disclose PHI in any form (paper, oral, electronic), plus patients' rights | The Security Rule covers how ePHI is protected, not who may see it |
| Breach Notification Rule | What to do after unsecured PHI is exposed | The Security Rule is about preventing that exposure |
No official "HIPAA certification" exists for the Security Rule. Organizations and vendors can be compliant with it, but no one can be certified.
What the rules say
- Source and enforcement: The HHS Office for Civil Rights enforces the rule. The text sits at 45 CFR Part 164, Subpart C. Most covered entities first had to comply in April 2005.
- Core sections:
- Administrative safeguards: 164.308
- Physical safeguards: 164.310
- Technical safeguards: 164.312
- Policies, procedures and documentation: 164.316
- Risk analysis: An accurate and thorough risk analysis is a required implementation specification under 164.308(a)(1)(ii)(A).
- Flexibility: Organizations may choose security measures that fit their size, complexity, technical capabilities and costs, under 164.306(b). A three-provider practice is not expected to run a hospital-scale program.
- Required vs addressable: Some specifications are required. Others are addressable, as set out in 164.306(d). Addressable does not mean optional. The organization must assess the specification and implement it if reasonable and appropriate. If it is not, the organization must document why and implement an equivalent alternative where reasonable. See addressable vs required safeguards.
- Who must comply: Both covered entities and business associates must comply. Business associates have been directly subject to the rule since the 2013 Omnibus Rule.
- Documentation: Security policies and related documentation must be retained for six years.
- Resources for small practices: HHS and ONC have offered a free Security Risk Assessment Tool for smaller practices. Check HealthIT.gov for its current availability.
- Proposed changes: HHS has proposed updates to the Security Rule. Until any provisions are finalized, treat them as proposed, not current law.
Related reading
- HIPAA Privacy Rule: the companion rule on use and disclosure of PHI.
- What counts as PHI and ePHI: definitions and everyday examples.
- Security, HIPAA and BAA for staff chat: how a staff chat workspace handles BAAs and security controls.
Where Chanty fits. chanty.health is published by Chanty, a team chat for clinic staff with a signed BAA from the Business plan. If your team still coordinates in personal group chats, see how HIPAA-compliant staff chat works or start free.