What is the difference between the HIPAA Privacy Rule and Security Rule?

The Privacy Rule (45 CFR Part 164, Subpart E) governs the use and disclosure of PHI. The Security Rule (45 CFR Part 164, Subpart C) addresses electronic PHI and applies to covered entities and business associates.

Do small healthcare practices need to comply with HIPAA?

HIPAA applies to covered entities regardless of size. A healthcare provider that transmits health information electronically in connection with a standard transaction is a covered entity (45 CFR §160.103).

How often should HIPAA risk assessments be conducted?

The Security Rule requires an evaluation of security controls and a risk analysis, but does not prescribe a single frequency (45 CFR §164.308(a)(1) and (a)(8)). Set a cadence that fits your environment and re-assess when systems or threats change.

What constitutes a HIPAA breach that requires notification?

A breach is an acquisition, access, use or disclosure of PHI not permitted by the Privacy Rule that compromises the security or privacy of the PHI, subject to the exceptions and risk assessment in 45 CFR §164.402. Notification duties and timing are in 45 CFR §§164.404–164.408.

Can cloud services be HIPAA compliant?

A cloud service can support HIPAA compliance where the arrangement meets the Security Rule and a business associate agreement is in place (45 CFR §164.504(e)). Confirm the specific service and terms with the provider.

What should be included in HIPAA workforce training?

Security awareness and training for all workforce members is required by 45 CFR §164.308(a)(5). Cover the security procedures relevant to each role, incident reporting and the sanctions policy.

HIPAA Guide: Rules, Safeguards and Preparation

What is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law enacted in 1996. Its implementing regulations set national standards for protecting the privacy and security of individually identifiable health information. The rules include the Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E), the Security Rule (45 CFR Part 164, Subpart C), the Breach Notification Rule (45 CFR Part 164, Subpart D) and the Enforcement Rule (45 CFR Part 160, Subparts C–E).

Who HIPAA applies to

HIPAA applies to covered entities and business associates (45 CFR §160.103).

Covered entities

Healthcare providers that transmit health information electronically in connection with a standard transaction (45 CFR §160.103).
Health plans, including insurers, HMOs and government health programmes.
Healthcare clearinghouses that process nonstandard transactions into standard format.

Business associates

A person or entity that performs a function or activity on behalf of a covered entity involving protected health information (PHI) (45 CFR §160.103).
Business associate relationships are covered by a written business associate agreement (45 CFR §164.504(e)).

The four HIPAA rules

Rule	Subject	Reference
Privacy Rule	Uses and disclosures of PHI, individual rights, the minimum necessary standard and notice of privacy practices	45 CFR Part 164, Subpart E
Security Rule	Administrative, physical and technical safeguards for electronic PHI	45 CFR Part 164, Subpart C
Breach Notification Rule	Breach assessment and notification to individuals, HHS and the media	45 CFR Part 164, Subpart D
Enforcement Rule	Investigation, compliance review and civil money penalties	45 CFR Part 160, Subparts C–E

Security Rule safeguards

Administrative safeguards (45 CFR §164.308)

§164.308(a)(1): Security management process, including risk analysis and risk management.
§164.308(a)(2): Assigned security responsibility.
§164.308(a)(3): Workforce security.
§164.308(a)(4): Information access management.
§164.308(a)(5): Security awareness and training.
§164.308(a)(6): Security incident procedures.
§164.308(a)(7): Contingency plan.
§164.308(a)(8): Evaluation.
§164.308(b): Business associate contracts and other arrangements.

Physical safeguards (45 CFR §164.310)

§164.310(a): Facility access controls.
§164.310(b): Workstation use.
§164.310(c): Workstation security.
§164.310(d): Device and media controls.

Technical safeguards (45 CFR §164.312)

§164.312(a): Access control.
§164.312(b): Audit controls.
§164.312(c): Integrity.
§164.312(d): Person or entity authentication.
§164.312(e): Transmission security.

Preparing a HIPAA programme

These are preparation steps, not a certification process. The Security Rule requires a risk analysis and risk management programme (45 CFR §164.308(a)(1)(ii)(A)–(B)); the steps below follow that structure.

1. Conduct a risk analysis

Identify the systems, applications and physical locations where electronic PHI is created, stored, transmitted or accessed, and assess the risks to confidentiality, integrity and availability (45 CFR §164.308(a)(1)(ii)(A)).

2. Develop policies and procedures

Document policies covering the Privacy, Security and Breach Notification Rules, including the required and addressable implementation specifications in 45 CFR Part 164, Subpart C.

3. Implement administrative safeguards

Assign security responsibility (§164.308(a)(2)), set workforce security and access management (§164.308(a)(3)–(4)), run security awareness training (§164.308(a)(5)) and establish incident procedures and a contingency plan (§164.308(a)(6)–(7)).

4. Implement physical safeguards

Put facility access, workstation use and security, and device and media controls in place (45 CFR §164.310).

5. Implement technical safeguards

Configure access control, audit controls, integrity controls, authentication and transmission security (45 CFR §164.312). The Security Rule addresses encryption as an addressable implementation specification (§164.312(a)(2)(iv) and (e)(2)(ii)); document how you address it.

6. Execute business associate agreements

Identify business associates and put written agreements in place as required by 45 CFR §164.504(e).

7. Train the workforce

Provide security awareness and training for all workforce members (45 CFR §164.308(a)(5)). Document completion.

8. Evaluate and maintain

Perform the periodic evaluation required by 45 CFR §164.308(a)(8), update the risk analysis and review policies when the environment changes.

Breach notification

The Breach Notification Rule requires notification to affected individuals without unreasonable delay and no later than 60 days after discovery (45 CFR §164.404(b)), notification to HHS (§164.408) and, for breaches affecting more than 500 individuals in a state or jurisdiction, notification to prominent media outlets (§164.406). Breach assessment follows the presumption and risk-assessment approach in 45 CFR §164.402.

Documentation and retention

Documentation required by the Security Rule must be retained for six years from the date of creation or the date it was last in effect, whichever is later (45 CFR §164.316(b)(2)(i)). This applies to the policies, procedures and records the Rule requires.

Penalties

Civil money penalties are set by 45 CFR Part 160, Subpart D, with the amounts adjusted by the Department over time. Check the current published amounts and categories rather than relying on a historical table.

How Compliance Enablers helps with HIPAA

HIPAA runs as one of Compliance Enablers' 30 standards, as a guided programme — scoping, assessment, scoring, evidence and readiness. The platform includes 60 dashboard modules in 11 groups, all included in every plan. HIPAA is a public-source standard: the programme opens on subscription. The platform never sells or redistributes standard text. We help you prepare; the audit or assurance decision belongs to the independent body.

HIPAAGuide:Rules,SafeguardsandPreparation