What does the HIPAA Security Rule ask a health care practice to do?

Who does this rule apply to?

Section 164.302 says covered entities and business associates comply with the standards of this subpart, with respect to electronic protected health information.

A covered entity or business associate must comply with the applicable standards, implementation specifications, and requirements of this subpart with respect to electronic protected health information of a covered entity.

What is the general aim?

Section 164.306(a) opens with the aim of keeping electronic protected health information confidential, intact and available.

Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits.

What does it ask about risk?

Section 164.308(a)(1)(ii)(A) says the risk analysis is an accurate and thorough assessment of the potential risks and vulnerabilities to electronic protected health information.

Section 164.308(a)(1)(ii)(B) asks for security measures sufficient to reduce those risks and vulnerabilities to a reasonable and appropriate level.

Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.

Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with § 164.306(a).

What does it ask about access to the systems?

Section 164.312(a)(1) says technical policies and procedures are to allow access to electronic protected health information only to people or software programs that have been granted access rights.

Implement technical policies and procedures for electronic information systems that maintain electronic protected health information to allow access only to those persons or software programs that have been granted access rights as specified in § 164.308(a)(4).

What can an external reading show for this rule?

This rule asks for care across the whole firm. An external reading cannot see your policies, your training, your devices, your access lists or who can sign in to what.

What it can show, read externally the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

That is evidence toward the duty, never proof of it. Where the text names no control, we add none for it.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.