HIPAA Security Rule Review

When to Use

If a target is provided via arguments, focus the review on: $ARGUMENTS

• Organization is a Covered Entity (CE) or Business Associate (BA) subject to HIPAA
• Preparing for an HHS Office for Civil Rights (OCR) audit or investigation
• Conducting an internal risk analysis as required by 45 CFR 164.308(a)(1)(ii)(A)
• Evaluating Business Associate Agreement (BAA) compliance requirements
• Assessing security posture after a breach or security incident involving ePHI
• Onboarding a new Business Associate that handles ePHI
• Annual or periodic review of the HIPAA security program

Context

The HIPAA Security Rule (45 CFR Part 164, Subpart C) establishes national standards for protecting electronic protected health information (ePHI) held or transferred by Covered Entities and their Business Associates. The rule requires appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of ePHI.

Key Regulatory Concepts