FixTheVuln

HIPAA Security Guide

By FixTheVuln Team Peer-reviewed security content Sources: HHS.gov, NIST SP 800-66

Test Your Knowledge

CISM Practice Quiz CISSP Practice Quiz
← Back to Compliance

HIPAA Security Quick Reference

The Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for protecting sensitive patient health information. This guide covers the Security Rule requirements, breach notification obligations, and a practical compliance checklist for healthcare IT professionals.

Key Definitions

PHI Protected Health Information - any individually identifiable health information held or transmitted by a covered entity (includes name, DOB, SSN, medical records, billing info linked to health data)
ePHI Electronic PHI - PHI that is created, stored, transmitted, or received electronically
Covered Entity Health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically
Business Associate Any person or entity that performs functions involving the use or disclosure of PHI on behalf of a covered entity (cloud providers, billing companies, IT contractors)
BAA Business Associate Agreement - required contract between a covered entity and business associate that establishes permitted uses and disclosures of PHI
Minimum Necessary Only the minimum amount of PHI needed to accomplish the intended purpose should be used or disclosed

The 18 PHI Identifiers

HIPAA defines 18 types of information that qualify as PHI when linked to health data:

1.

Names

2.

Geographic data

Smaller than state level

3.

Dates

Birth, admission, discharge, death

4.

Phone numbers

5.

Fax numbers

6.

Email addresses

7.

SSN

8.

Medical record numbers

9.

Health plan beneficiary #

10.

Account numbers

11.

Certificate/license #

12.

Vehicle identifiers

13.

Device identifiers

14.

Web URLs

15.

IP addresses

16.

Biometric identifiers

17.

Full-face photographs

18.

Any other unique ID

Security Rule: Three Safeguard Categories

The HIPAA Security Rule requires covered entities and business associates to implement safeguards in three categories to protect ePHI:

Administrative Safeguards (§164.308)

Security Management Process

Conduct risk assessments, implement risk management policies, apply sanctions for violations, and review system activity.

Assigned Security Responsibility

Designate a security official responsible for developing and implementing security policies and procedures.

Workforce Security

Implement procedures for authorization, supervision, clearance, and termination of workforce members who access ePHI.

Information Access Management

Implement role-based access controls. Grant access only to ePHI necessary for job functions.

Security Awareness Training

Provide regular security training including phishing awareness, password management, log-in monitoring, and malware protection.

Contingency Plan

Establish data backup, disaster recovery, and emergency mode operation plans. Test and revise periodically.

Physical Safeguards (§164.310)

Facility Access Controls

Limit physical access to facilities with ePHI. Implement badge access, visitor logs, and locked server rooms.

Workstation Use & Security

Define proper workstation use policies. Implement physical safeguards to restrict access to workstations with ePHI.

Device and Media Controls

Govern receipt, removal, disposal, and re-use of hardware and electronic media containing ePHI. Require encryption and secure wiping.

Technical Safeguards (§164.312)

Access Control

Implement unique user identification, emergency access procedures, automatic logoff, and encryption/decryption of ePHI.

Audit Controls

Implement hardware, software, and procedural mechanisms to record and examine activity in systems containing ePHI.

Integrity Controls

Implement policies and procedures to protect ePHI from improper alteration or destruction. Use checksums and digital signatures.

Transmission Security

Implement technical measures to guard against unauthorized access to ePHI transmitted over networks. Use TLS/encryption.

Authentication

Implement procedures to verify that a person or entity seeking access to ePHI is who they claim to be. Use MFA where possible.

Breach Notification Rule

When a breach of unsecured PHI occurs, specific notification requirements apply:

Requirement Timeline Details
Individual Notice 60 days Written notice to affected individuals within 60 days of discovering the breach
HHS Notification 60 days / Annual Breaches affecting 500+ individuals: notify HHS within 60 days. Smaller breaches: annual log submission.
Media Notice 60 days Breaches affecting 500+ residents of a state: notify prominent media outlets in that state
Business Associate 60 days BAs must notify the covered entity of breaches without unreasonable delay (max 60 days)

Safe Harbor: If PHI is encrypted per NIST standards and the encryption key is not compromised, the data is considered "secured" and breach notification is not required.

Business Associate Agreements (BAAs)

A BAA is required whenever a covered entity shares PHI with a third party. Key requirements:

Common Mistake: Cloud services (AWS, Azure, GCP), email providers, EHR vendors, shredding companies, and even IT consultants who may access systems containing PHI all require BAAs.

Penalty Tiers for Non-Compliance

Tier Knowledge Level Per Violation Annual Maximum
Tier 1 Unaware (and would not have known by exercising reasonable diligence) $137 - $68,928 $2,067,813
Tier 2 Reasonable cause (not willful neglect) $1,379 - $68,928 $2,067,813
Tier 3 Willful neglect (corrected within 30 days) $13,785 - $68,928 $2,067,813
Tier 4 Willful neglect (not corrected) $68,928+ $2,067,813

Criminal penalties: Knowingly obtaining or disclosing PHI can result in fines up to $250,000 and up to 10 years imprisonment.

Healthcare IT Compliance Checklist

Risk Assessment & Management

  • Conduct annual risk assessment identifying threats to ePHI
  • Document risk analysis results and remediation plans
  • Review and update policies at least annually
  • Maintain an inventory of all systems that store, process, or transmit ePHI
  • Evaluate risks when implementing new systems or technologies

Access Controls & Authentication

  • Assign unique user IDs to every workforce member
  • Implement role-based access control (RBAC) for ePHI systems
  • Deploy multi-factor authentication for remote access
  • Configure automatic session timeout/logoff
  • Implement emergency access ("break the glass") procedures
  • Review access rights quarterly and upon role changes

Encryption & Data Protection

  • Encrypt ePHI at rest (AES-256 recommended)
  • Encrypt ePHI in transit (TLS 1.2+ required)
  • Encrypt portable devices and removable media
  • Implement secure email for PHI transmission
  • Use NIST-validated encryption modules

Audit & Monitoring

  • Enable audit logging on all systems with ePHI
  • Log access to patient records (who, when, what)
  • Review audit logs regularly for unauthorized access
  • Retain audit logs for at least 6 years
  • Implement intrusion detection/prevention systems
  • Monitor for unusual data access patterns

Backup & Disaster Recovery

  • Perform regular backups of ePHI (encrypted)
  • Store backups in a secure, off-site location
  • Test restoration procedures at least annually
  • Document and test disaster recovery plan
  • Define RPO (Recovery Point Objective) and RTO (Recovery Time Objective)

HIPAA vs. Other Frameworks

Aspect HIPAA GDPR PCI DSS
Scope Healthcare data (PHI) in the US Personal data of EU residents Payment card data globally
Applies To Covered entities & BAs Any organization processing EU data Any org handling cardholder data
Breach Notification Within 60 days Within 72 hours Varies by card brand
Max Penalty ~$2M/year + criminal 4% of global revenue $100K/month + penalties
Encryption Addressable (strongly recommended) Appropriate technical measures Required for stored/transmitted data

Frequently Asked Questions

What is the HIPAA Security Rule?

The HIPAA Security Rule establishes national standards to protect electronic protected health information (ePHI). It requires covered entities and business associates to implement administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of ePHI.

What are the HIPAA safeguard requirements?

HIPAA requires three categories of safeguards: administrative (risk analysis, workforce training, contingency planning), physical (facility access controls, workstation security, device disposal), and technical (access controls, audit controls, transmission security, encryption).

What happens if an organization violates HIPAA?

HIPAA violations can result in civil penalties from $100 to $50,000 per violation (up to $1.5 million per year), criminal penalties including fines up to $250,000 and imprisonment, and mandatory breach notification to affected individuals, HHS, and media for breaches affecting 500+ individuals.

FixTheVuln Store

Studying for Healthcare IT Certifications?

Structured study planners for Security+, CISSP, and other certifications relevant to healthcare IT security. Standard + ADHD-friendly editions.

CompTIA (ISC)2 See All →

Need Detailed HIPAA Implementation Guides?

For comprehensive tutorials and compliance audit preparation:

Visit FixTheVuln.com →

Related Resources

🇪🇺 GDPR Guide EU data protection compliance 🔑 Encryption Cheatsheet Algorithms & best practices 📊 Log Management Security monitoring & SIEM