HIPAA Security Rule

What is the HIPAA Security Rule?

The HIPAA Security Rule (45 CFR Part 160 and Part 164, Subparts A and C) is a US federal regulation that sets minimum security standards for protecting electronic Protected Health Information (ePHI). It is one component of the Health Insurance Portability and Accountability Act of 1996, alongside the Privacy Rule and Breach Notification Rule. The Security Rule specifically addresses the confidentiality, integrity, and availability of ePHI and requires covered entities to conduct risk analyses and implement appropriate safeguards.

What are the three types of HIPAA safeguards?

The Security Rule organises its requirements into three categories of safeguards:

1. Administrative Safeguards (Section 164.308): Policies and procedures designed to manage the selection, development, implementation, and maintenance of security measures. Includes risk analysis, workforce security, information access management, security awareness training, contingency planning, and evaluation. These represent the largest section of the rule.
2. Physical Safeguards (Section 164.310): Physical measures, policies, and procedures to protect electronic information systems and related buildings and equipment from natural and environmental hazards. Covers facility access controls, workstation use and security, and device and media controls.
3. Technical Safeguards (Section 164.312): Technology and related policies that protect ePHI and control access to it. Covers access controls, audit controls, integrity controls, person or entity authentication, and transmission security.

What is the difference between required and addressable HIPAA specifications?

The Security Rule designates each implementation specification as either 'Required' or 'Addressable.' Required specifications must be implemented as stated. Addressable specifications require the organisation to assess whether the specification is reasonable and appropriate; if so, implement it; if not, document why and implement an equivalent alternative. Addressable does not mean optional. Organisations must document their rationale regardless of the decision.

What are the HIPAA breach notification requirements?

The Breach Notification Rule (Subpart D) requires covered entities to notify affected individuals within 60 days of discovering a breach of unsecured PHI. Breaches affecting 500 or more individuals require notification to the HHS Secretary and prominent media outlets simultaneously. Breaches affecting fewer than 500 individuals must be reported to HHS annually. Business associates must notify the covered entity within 60 days (or as specified in the Business Associate Agreement).