United StatesHIPAA Security Rule
45 CFR Part 164, Subpart C (Sections 164.302-164.318)
In force since .
A sector security regimes rule binding public and private bodies.
As of .
What it requires
- It reaches you if you are a covered entity, meaning a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a transaction the Health Insurance Portability and Accountability Act (HIPAA) rules cover, or a business associate, meaning a person that creates, receives, maintains, or transmits protected health information on a covered entity's behalf for a function or activity the HIPAA rules regulate, or that provides a covered entity legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services involving disclosure of protected health information to that person, including a subcontractor of a business associate and a person that offers a personal health record to individuals on a covered entity's behalf. Its duties attach to electronic protected health information, and you are reached by declaring that you are a HIPAA covered entity or business associate.
- Ensure the confidentiality, integrity, and availability of all electronic protected health information you create, receive, maintain, or transmit; protect it against reasonably anticipated threats or hazards to its security or integrity and against reasonably anticipated uses or disclosures the Privacy Rule does not permit or require; and ensure that your workforce complies with the Security Rule (45 CFR 164.306(a)).
- Choose security measures that let you reasonably and appropriately implement each standard and implementation specification, taking into account your size, complexity, and capabilities, your technical infrastructure and hardware and software security capabilities, the cost of the measures, and the probability and criticality of potential risks to electronic protected health information (45 CFR 164.306(b)).
- Implement every required implementation specification. For each addressable one, such as a mechanism to encrypt and decrypt electronic protected health information (45 CFR 164.312(a)(2)(iv)) and encryption of transmitted electronic protected health information whenever deemed appropriate (45 CFR 164.312(e)(2)(ii)), assess whether it is a reasonable and appropriate safeguard in your environment; implement it if it is, and if it is not, document why and implement an equivalent alternative measure if reasonable and appropriate (45 CFR 164.306(d)).
- Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of the electronic protected health information you hold, and implement security measures sufficient to reduce those risks and vulnerabilities to a reasonable and appropriate level (45 CFR 164.308(a)(1)).
- Identify the security official responsible for developing and implementing your security policies and procedures, apply sanctions to workforce members who fail to comply with them, regularly review records of information system activity such as audit logs, access reports, and security incident tracking reports, and run a security awareness and training program for all members of your workforce, including management (45 CFR 164.308(a)(1) to (5)).
- Implement policies and procedures to ensure that your workforce members have appropriate access to electronic protected health information and that those who do not have access cannot obtain it, and policies and procedures for authorizing access that are consistent with the Privacy Rule (45 CFR 164.308(a)(3) and (4)).
- Identify and respond to suspected or known security incidents, mitigate their harmful effects to the extent practicable, and document the incidents and their outcomes (45 CFR 164.308(a)(6)).
- Establish and implement a data backup plan, a disaster recovery plan, and an emergency mode operation plan, and perform a periodic technical and nontechnical evaluation of whether your security policies and procedures meet the Security Rule (45 CFR 164.308(a)(7) and (8)).
- Limit physical access to your electronic information systems and the facilities that house them, specify the proper use of each workstation that can access electronic protected health information and physically safeguard it, and govern the receipt, removal, and movement of hardware and electronic media that contain it, including its final disposition and its removal from media before the media are re-used (45 CFR 164.310).
- Allow access to electronic protected health information only to persons or software programs that have been granted access rights, assign each user a unique name or number, establish procedures for obtaining the information in an emergency, record and examine activity in the information systems that contain it, protect it from improper alteration or destruction, verify that a person or entity seeking access is the one claimed, and guard against unauthorized access to it while it is transmitted over an electronic communications network (45 CFR 164.312).
- If you are a covered entity, obtain satisfactory assurances from each business associate that it will appropriately safeguard electronic protected health information, and if you are a business associate, obtain them from each subcontractor, documented in a written contract or other arrangement that requires the business associate to comply with the Security Rule, to hold its subcontractors to the same, and to report to the covered entity any security incident of which it becomes aware, including breaches of unsecured protected health information (45 CFR 164.308(b) and 164.314(a)).
- Keep your security policies and procedures, and a record of every action, activity, or assessment the Security Rule requires to be documented, in written form (which may be electronic); retain that documentation for 6 years from the date of its creation or the date it last was in effect, whichever is later; make it available to the people responsible for the procedures; review it periodically and update it in response to environmental or operational changes; and review and modify your security measures as needed (45 CFR 164.316 and 164.306(e)).
These lines are LexLint's reading of the law's text, as of . Also read by: HHS Office for Civil Rights (guidance, recorded ); University of Texas M.D. Anderson Cancer Center v. United States Department of Health and Human Services, No. 19-60226 (5th Cir. ) (recorded ).
Who enforces it
Settledness
In the Fifth Circuit, the decision cited here reads the encryption specification at 45 CFR 164.312(a)(2)(iv), which calls for "a mechanism", to say nothing about how effective the mechanism must be.
- As of
- Case link
- https://www.govinfo.gov/content/pkg/USCOURTS-ca5-19-60226/pdf/USCOURTS-ca5-19-60226-0.pdf
- Guidance link
- https://www.hhs.gov/hipaa/for-professionals/faq/2020/what-is-the-difference-between-addressable-and-required-implementation-specifications/index.html
- Case citation
- University of Texas M.D. Anderson Cancer Center v. United States Department of Health and Human Services, No. 19-60226 (5th Cir. )
- Guidance body
- HHS Office for Civil Rights
- Open questions
- Does an entity that has a mechanism to encrypt and decrypt electronic protected health information in place meet the addressable specification at 45 CFR 164.312(a)(2)(iv) when some devices that hold the information remain unencrypted, as the Fifth Circuit reasoned in a decision that the Department's proposal of says it is concerned has not accurately set forth the steps regulated entities must take?
- Will the Department finalize the amendments to Subpart C of 45 CFR Part 164 that it proposed on at 90 FR 898, and on what schedule?
What this law does
Subpart C of Part 164 of title 45 of the Code of Federal Regulations requires a covered entity or business associate to comply with its applicable standards, implementation specifications and requirements with respect to electronic protected health information of a covered entity. A covered entity is a health plan, a health care clearinghouse, or a health care provider who transmits any health information in electronic form in connection with a transaction covered by the subchapter.
A business associate is, with respect to a covered entity, a person who on its behalf creates, receives, maintains, or transmits protected health information for a function or activity the Health Insurance Portability and Accountability Act (HIPAA) rules regulate. The definition of a business associate includes a subcontractor that handles protected health information on behalf of the business associate, and a person that offers a personal health record to one or more individuals on behalf of a covered entity.
The general requirements are to ensure the confidentiality, integrity, and availability of all electronic protected health information the entity creates, receives, maintains, or transmits, to protect against reasonably anticipated threats or hazards to its security or integrity, and to protect against reasonably anticipated uses or disclosures that the Privacy Rule does not permit or require.
An entity may use any security measures that allow it to reasonably and appropriately implement the standards and implementation specifications, and in choosing them must take into account its size, complexity, and capabilities, its technical infrastructure, hardware, and software security capabilities, the costs of security measures, and the probability and criticality of potential risks.
An implementation specification is either required or addressable, and an entity must implement every required one. For an addressable specification an entity must assess whether it is a reasonable and appropriate safeguard in its environment, and implement it if reasonable and appropriate. If implementing it is not reasonable and appropriate, the entity must document why and implement an equivalent alternative measure if reasonable and appropriate.
The mechanism to encrypt and decrypt electronic protected health information is an addressable specification of the access control standard. Encryption of electronically transmitted electronic protected health information whenever deemed appropriate is an addressable specification of the transmission security standard.
The administrative safeguards require an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information, and security measures sufficient to reduce those risks and vulnerabilities to a reasonable and appropriate level.
The standard on security incident procedures requires an entity to identify and respond to suspected or known security incidents, to mitigate their harmful effects to the extent practicable, and to document the incidents and their outcomes. A business associate contract must provide that the business associate will report to the covered entity any security incident of which it becomes aware, including breaches of unsecured protected health information as required by section 164.410.
Subpart D of Part 164 is the HIPAA Breach Notification Rule, which this jurisdiction records as a privacy row. An entity must retain the documentation the Subpart requires for 6 years from the date of its creation or the date when it last was in effect, whichever is later. A health plan that is not a small health plan, a health care clearinghouse and a covered health care provider had to comply no later than , and a small health plan no later than .
In its 2013 omnibus rulemaking under the HITECH Act, the Department modified the Security Rule to extend direct liability for compliance with it to business associates. The Department of Health and Human Services published a notice of proposed rulemaking on to modify the Security Rule. The Unified Agenda entry for that rulemaking lists it among Long-Term Actions with final action in July 2027.
When LexLint raises it
When your app profile says your app handles health records.