HIPAA Security Rule Technical Safeguards
The HIPAA Security Rule (45 CFR Part 160 and Subparts A and C of Part 164) establishes national standards specifically for protecting electronic protected health information (ePHI). While the Privacy Rule covers PHI in all forms, the Security Rule focuses exclusively on ePHI and prescribes administrative, physical, and technical safeguards. RHIA candidates must understand all three safeguard categories, with particular depth in technical safeguards.
Security Rule Framework
The Security Rule is built on three principles:
- Confidentiality: ePHI is not made available or disclosed to unauthorized persons.
- Integrity: ePHI is not altered or destroyed in an unauthorized manner.
- Availability: ePHI is accessible and usable on demand by authorized persons.
The rule uses two categories of implementation specifications:
- Required (R): Must be implemented.
- Addressable (A): The organization must assess whether the specification is reasonable and appropriate. If so, it must implement it. If not, the organization must document why and implement an equivalent alternative measure if reasonable and appropriate. "Addressable" does not mean optional.
Administrative Safeguards (164.308)
Administrative safeguards are the policies, procedures, and actions to manage the selection, development, implementation, and maintenance of security measures. Key standards include:
- Security management process (R): Includes risk analysis, risk management, sanction policy, and information system activity review.
- Assigned security responsibility (R): A single individual must be designated as the security official responsible for developing and implementing security policies.
- Workforce security: Authorization and supervision procedures, workforce clearance procedures (A), and termination procedures (A).
- Information access management: Policies for authorizing access to ePHI, including role-based access.
- Security awareness and training: Includes security reminders (A), protection from malicious software (A), log-in monitoring (A), and password management (A).
- Security incident procedures (R): Policies for identifying, responding to, and mitigating security incidents.
- Contingency plan (R): Data backup plan, disaster recovery plan, emergency mode operation plan, testing and revision procedures (A), and applications and data criticality analysis (A).
- Evaluation (R): Periodic technical and non-technical evaluations of security practices.
Physical Safeguards (164.310)
Physical safeguards protect electronic information systems and related buildings and equipment from natural and environmental hazards and unauthorized intrusion:
- Facility access controls: Contingency operations (A), facility security plan (A), access control and validation procedures (A), maintenance records (A).
- Workstation use (R): Policies specifying the proper functions and physical attributes of workstations that access ePHI.
- Workstation security (R): Physical safeguards restricting access to workstations (e.g., cable locks, screen privacy filters, positioning monitors away from public view).
- Device and media controls: Disposal (R), media re-use (R), accountability (A), and data backup and storage (A).
Technical Safeguards (164.312) - In Depth
Technical safeguards are the technology and policies that protect ePHI and control access to it. This is the most technically detailed section of the Security Rule:
| Standard | Specifications | R/A | Description |
|---|---|---|---|
| Access control | Unique user identification | R | Each user must have a unique identifier for tracking activity. |
| Access control | Emergency access procedure | R | Procedures for obtaining ePHI during an emergency. |
| Access control | Automatic logoff | A | Terminate sessions after a predetermined period of inactivity. |
| Access control | Encryption and decryption | A | Encrypt ePHI as a method of access control. |
| Audit controls | (Standard itself) | R | Hardware, software, and procedural mechanisms to record and examine activity in systems containing ePHI. |
| Integrity | Mechanism to authenticate ePHI | A | Electronic mechanisms to verify that ePHI has not been altered or destroyed improperly (e.g., checksums, digital signatures). |
| Person or entity authentication | (Standard itself) | R | Verify the identity of any person or entity seeking access to ePHI (passwords, tokens, biometrics, or multi-factor). |
| Transmission security | Integrity controls | A | Ensure ePHI is not improperly modified during electronic transmission. |
| Transmission security | Encryption | A | Encrypt ePHI during electronic transmission over open networks (e.g., TLS for email, VPN for remote access). |
Risk Analysis and Risk Management
The risk analysis is the foundation of Security Rule compliance. It requires organizations to:
- Identify all systems that create, receive, maintain, or transmit ePHI.
- Identify threats and vulnerabilities to those systems.
- Assess the likelihood and impact of each threat exploiting each vulnerability.
- Determine the current level of risk and implement measures to reduce risk to a reasonable and appropriate level.
- Document the entire process.
Risk management is the ongoing process of implementing security measures, monitoring their effectiveness, and updating them as the threat landscape, technology, and organizational operations change.
Breach Notification Rule
While technically a separate rule (Subpart D of Part 164), breach notification is closely tied to security. A breach is the unauthorized acquisition, access, use, or disclosure of unsecured PHI that compromises its security or privacy. Notification requirements include:
- Individual notification: Within 60 days of discovery.
- HHS notification: Breaches affecting fewer than 500 individuals are logged and reported annually. Breaches affecting 500 or more must be reported within 60 days.
- Media notification: Required for breaches affecting 500 or more individuals in a single state or jurisdiction.
ePHI that is encrypted using NIST-approved standards is considered "secured" and is not subject to breach notification if compromised.
Exam Preparation Tips
For the RHIA exam, know the difference between required and addressable specifications - especially that addressable does not mean optional. Be able to categorize a given safeguard into administrative, physical, or technical. Memorize the technical safeguards table, particularly which specifications are required versus addressable. Understand the risk analysis process and the breach notification timelines. Questions frequently present a scenario and ask you to identify which safeguard category or specific standard applies.