HIPAA Security Rule

Safeguards for electronic protected health information: integrity controls, audit procedures.


Short name	HIPAA
Region	Americas
Country or scope	United States
Sector	Healthcare
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers HIPAA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 18 controls from Safeguard's control catalog for HIPAA.
Automated tests: 675 map to its controls, and 359 connectors provide automated evidence for them. See HIPAA Security Rule and connectors.
Policy templates: 28: 6 written for HIPAA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`HIPAA-164-306` General Safeguard Duty	Covered entities must protect against reasonably anticipated threats to the security and integrity of ePHI, which for software systems includes knowing what software touches ePHI (45 CFR 164.306(a))	Scan
`HIPAA-164-308RA` Risk Analysis Foundations	An accurate and thorough risk analysis of systems handling ePHI requires identifiable software components that can be matched against known vulnerabilities (45 CFR 164.308(a)(1)(ii)(A))	Scan
`HIPAA-164-312C` Integrity Controls	Entities must implement mechanisms to corroborate that ePHI has not been improperly altered or destroyed, extending to integrity verification of the software processing it (45 CFR 164.312(c)(1))	Scan
`HIPAA-164-308BA` Business Associate Assurance	ePHI may only be handled by business associates providing satisfactory assurances, requiring identification of the suppliers behind the software in the ePHI processing chain (45 CFR 164.308(b))	Scan
`HIPAA-164-308SEC` Security Update Awareness	The security management and protection-from-malicious-software processes require knowing component versions so patches and updates can be applied (45 CFR 164.308(a)(1) and (a)(5)(ii)(B))	Scan
`HIPAA-164-316` Documentation Requirements	Policies, procedures and required records must be documented, retained for six years, and kept current, requiring identifiable and dated documentation artifacts (45 CFR 164.316)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`164.308(a)(1)`	Conduct a Security Risk Analysis
`164.308(a)(2)`	Assign Security Responsibility
`164.308(a)(3)`	Implement Workforce Access Controls
`164.308(a)(4)`	Manage Information Access
`164.308(a)(5)`	Provide Security Awareness and Training
`164.308(a)(6)`	Implement Security Incident Procedures
`164.308(a)(7)`	Establish Contingency Plan
`164.308(a)(8)`	Perform Periodic Security Evaluations
`164.308(b)(1)`	Manage Business Associate Contracts
`164.310(a)(1)`	Implement Facility Access Controls
`164.310(d)(1)`	Control Device and Media Disposal
`164.312(a)(1)`	Implement Technical Access Controls
`164.312(b)`	Implement Audit Controls
`164.312(c)(1)`	Ensure Integrity of ePHI
`164.312(d)`	Implement Person or Entity Authentication
`164.312(e)(1)`	Implement Transmission Security
`164.314(a)`	Establish Business Associate Agreements
`164.316(b)(1)`	Maintain Documentation

Policy templates

Written for HIPAA:

HIPAA Information Security Policy
HIPAA Access Control and Authentication Policy
HIPAA Audit Controls and Logging Policy
HIPAA Breach Notification Policy
HIPAA Business Associate Management Policy
HIPAA Encryption and Transmission Security Policy

And 22 from the standard set, adapted to HIPAA.