NIST SP 800-66 r2

Implementing the HIPAA Security Rule - risk-based approach for healthcare regulated entities.


Short name	800-66
Region	Americas
Country or scope	United States
Sector	Healthcare
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers 800-66

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 10 controls from Safeguard's control catalog for 800-66.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for 800-66 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`SP80066-RA` Risk Analysis Foundation	Regulated entities must conduct an accurate and thorough assessment of risks to ePHI, which SP 800-66r2 grounds in first identifying where ePHI is created, received, stored, and transmitted: requiring an enumerated inventory of the software involved (HIPAA Security Rule risk analysis, 45 CFR 164.308(a)(1)(ii)(A), per SP 800-66r2)	Scan
`SP80066-ASSET` Technology Asset Identification	SP 800-66r2's risk assessment methodology calls for identifying and documenting the technology assets that handle ePHI so threats and vulnerabilities can be tied to them, requiring components to be individually identifiable (SP 800-66r2 risk assessment guidance)	Scan
`SP80066-INTG` Integrity Controls	Regulated entities must implement policies and technical mechanisms to protect ePHI from improper alteration or destruction, implying integrity verification of the software processing it (HIPAA Security Rule integrity standard, 45 CFR 164.312(c)(1), per SP 800-66r2)	Scan
`SP80066-MALW` Protection from Malicious Software	Security awareness and management processes must include procedures for guarding against and detecting malicious software, which requires knowing the exact versions of deployed components so known-vulnerable software can be found and patched (45 CFR 164.308(a)(5)(ii)(B), per SP 800-66r2)	Scan
`SP80066-BA` Business Associate Assurances	A covered entity may permit a business associate to handle ePHI only with satisfactory written assurances that the associate will appropriately safeguard it, requiring knowledge of the supplier behind each component and service in the ePHI flow (45 CFR 164.308(b), per SP 800-66r2)	Scan
`SP80066-DOC` Documentation Requirements	Policies, procedures, and required assessments must be maintained in written form and retained for six years, which is supported by formally identified, timestamped machine-readable documentation of the systems in scope (HIPAA documentation standard, 45 CFR 164.316, per SP 800-66r2)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`800-66-RA`	Risk Analysis
`800-66-RM`	Risk Management Program
`800-66-AS`	Administrative Safeguards: Security Management
`800-66-AS-TRAIN`	Administrative Safeguards: Workforce Training
`800-66-AS-IR`	Administrative Safeguards: Incident Procedures
`800-66-PS`	Physical Safeguards
`800-66-TS`	Technical Safeguards: Access Control
`800-66-TS-AUDIT`	Technical Safeguards: Audit Controls
`800-66-TS-INTEGRITY`	Technical Safeguards: Integrity Controls
`800-66-TS-ENCRYPT`	Technical Safeguards: Transmission Security

Policy templates

Written for 800-66:

NIST 800-66 HIPAA Risk Analysis Procedure

And 22 from the standard set, adapted to 800-66.