Skip to content
HealthcareUnited States

HIPAA Security Rule

What is HIPAA Security Rule?

Health Insurance Portability and Accountability Act security standards for protecting electronic protected health information (ePHI). It comprises 67 controls organised across 5 domains, published by U.S. Department of HHS, and applies in the United States.

How HIPAA Security Rule maps to other frameworks

All 67 controls, each one mapped to the equivalent requirement in other standards, with the evidence that carries across and the mappings that were judged and rejected shown alongside. No account needed to look.

See the control mappings →

The 5 domains HIPAA Security Rule groups its controls into

Policies and Procedures
Organizational
Technical
Physical
Administrative

Frameworks that share controls with HIPAA Security Rule

Each of these has at least one control mapped to a control in HIPAA Security Rule. The number is how many HIPAA Security Rule controls are shared, counted from the mapping graph.

FedRAMP High

57 shared controls

FedRAMP Moderate

57 shared controls

NIST SP 800-53 Rev 5 MODERATE

55 shared controls

C5 (Germany)

53 shared controls

NIST SP 800-53 Rev 5 LOW

48 shared controls

ISO 27002:2022

48 shared controls

ISO 27001:2022

48 shared controls

NIST SP 800-53 Rev 5

48 shared controls

Where HIPAA Security Rule overlaps with the standards you already hold

HIPAA Security Rule vs GDPRView comparison →HIPAA Security Rule vs ISO 27001:2022View comparison →

Implementation guides for frameworks that overlap HIPAA Security Rule

Implement ISO 27001:2022covers ISO 27001:2022 →NIST 800-53 Controlscovers NIST SP 800-53 Rev 5 →

Step-by-step implementation of HIPAA Security Rule

HIPAA Security & PrivacyStep-by-step guide →

More HIPAA Security Rule comparisons

HIPAA Security Rule vs FedRAMP HighView comparison →HIPAA Security Rule vs FedRAMP ModerateView comparison →HIPAA Security Rule vs NIST SP 800-53 Rev 5 MODERATEView comparison →HIPAA Security Rule vs C5 (Germany)View comparison →HIPAA Security Rule vs NIST SP 800-53 Rev 5 LOWView comparison →HIPAA Security Rule vs ISO 27002:2022View comparison →

Analysis of HIPAA Security Rule

How to Execute HIPAA Security Rule Network Access Control Integration with CIS Controls v8 Access Control Management for Multi-Location Hospital SystemsHIPAA Security Rule §164.312(a)(1) requires access controls for electronic protected health information, while CIS Controls v8 provides detailed implementation guidance for network access management. Integrating these frameworks enables healthcare organizations to achieve comprehensive access control compliance across distributed hospital networks.
How to Execute HIPAA Security Rule Administrative Safeguards Integration with Joint Commission Patient Safety Standards for Multi-Facility Healthcare Network ComplianceMulti-facility healthcare networks must simultaneously satisfy HIPAA Security Rule administrative safeguards and Joint Commission patient safety standards while maintaining operational efficiency across diverse care settings. This integration requires coordinated policies, training programs, and incident response procedures that address both information security and patient safety objectives through unified governance structures.
How to Execute HIPAA Security Rule Technical Safeguards Integration with CIS Controls v8 for Multi-Location Healthcare Network CybersecurityIntegrating HIPAA Security Rule technical safeguards with CIS Controls v8 requires mapping 142 implementation specifications across access controls, audit controls, and transmission security. This approach reduces security gaps by 40% while ensuring both healthcare compliance and cybersecurity best practices across distributed healthcare operations.
How to Execute HIPAA Security Rule Physical Safeguards Integration with Joint Commission Environment of Care Standards for Multi-Site Healthcare Network ComplianceHealthcare organizations must simultaneously satisfy HIPAA Security Rule physical safeguards and Joint Commission Environment of Care standards across multiple facilities. This integration requires coordinated implementation of access controls, workstation security, and device management that meets both regulatory frameworks.

Training that covers HIPAA Security Rule

HIPAA Compliance and SecurityProfessional
$297 USD

Where to get trained on HIPAA Security Rule

4 courses in the catalogue cover HIPAA Security Rule directly. Each is self-paced, includes the downloadable toolkit and the implementation playbook, and carries a certificate of completion.

HIPAA Security Rule Implementation Playbook for US Healthcare Managed Service Providers$395 USDGEN5799 HIPAA Security Rule Compliance for Healthcare$249 USDGEN2621 HIPAA Security Rule Implementation for Healthcare Practices within audit cycles$249 USDGEN4210 HIPAA Security Rule Implementation for Telehealth within compliance requirements$249 USD

Training more than one person? Ten seats of any course is $1,490 on a single licence, against $199 a seat bought one at a time.

What an auditor will ask you for

All 67 HIPAA Security Rule controls, each with what it requires, the artefacts an auditor will ask you for, and where it commonly fails. Free to read, nothing to fill in.

Read the HIPAA Security Rule evidence request list

Prefer it in your inbox?

The list above is free to read. If you would rather have the HIPAA Security Rule version emailed so it is there when you need it, say where to send it.

What HIPAA Security Rule means in your sector

HIPAA Security Rule for Healthcare→HIPAA Security Rule for Financial Services→HIPAA Security Rule for Technology→HIPAA Security Rule for Government→HIPAA Security Rule for Manufacturing→HIPAA Security Rule for Energy→HIPAA Security Rule for Retail→HIPAA Security Rule for Education→

What HIPAA Security Rule means for your job

HIPAA Security Rule for CISOs→HIPAA Security Rule for Compliance Officers→HIPAA Security Rule for Risk Managers→HIPAA Security Rule for IT Directors→HIPAA Security Rule for DPOs→HIPAA Security Rule for Auditors→

Questions people ask about HIPAA Security Rule

What is HIPAA Security Rule?
Health Insurance Portability and Accountability Act security standards for protecting electronic protected health information (ePHI).
How many controls does HIPAA Security Rule have?
HIPAA Security Rule contains 67 controls organized across 5 domains.
Where does HIPAA Security Rule apply?
HIPAA Security Rule is applicable in United States. Organizations operating in or serving customers in this jurisdiction should evaluate its requirements.
What frameworks does HIPAA Security Rule map to?
HIPAA Security Rule has control-to-control mappings with 7 other compliance frameworks in our database. Use our compliance platform to explore these mappings interactively.
How do I get started with HIPAA Security Rule compliance?
Start by understanding the framework's key controls and domains. Our compliance platform provides AI-powered gap analysis and mapping tools to help you assess your current posture and build a remediation plan.

Query HIPAA Security Rule programmatically

HIPAA Security Rule, its 67 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.

HIPAA Security Rule API reference and MCP config →

What HIPAA Security Rule requires, control by control

Each page carries the requirement text for one HIPAA Security Rule control and what an assessor expects to see as evidence.

How much of another standard HIPAA Security Rule already covers

Each crosswalk is judged control by control, and the mappings that were rejected are kept alongside the ones that held.

How ready are you for HIPAA Security Rule?

Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.

Get Your Readiness Report, from $49Explore Platform Free
Written and maintained by Gerard Blokdyk, The Art of Service.Last updated .