What Is the HIPAA Security Rule?

Definition

The HIPAA Security Rule is the federal regulation that requires healthcare providers, health plans, clearinghouses, and their business associates to protect electronic protected health information (ePHI). HHS summarizes it as a "national set of security standards" requiring "administrative, physical, and technical safeguards" for health data that is stored or sent electronically.

How It Works

The rule applies to covered entities and to business associates, the vendors that handle ePHI for them, such as billing companies, IT providers, and accounting firms. It covers electronic health information only; paper and spoken information fall under the Privacy Rule.

The safeguards come in three groups:

Administrative: a risk analysis and risk management, a named security official, workforce training, access management, incident procedures, contingency plans including backups, and business associate agreements.
Physical: facility access, workstation security, and handling of devices and media.
Technical: access control, audit controls, integrity protections, authentication, and transmission security.

The rule is "flexible, scalable, and technology neutral," so it does not dictate specific products. Some implementation specifications are "required" and others "addressable." HHS stresses that addressable "does not mean that an implementation specification is optional"; a regulated entity must implement it or document a reasonable alternative.

The foundation is the risk analysis: "an accurate and thorough assessment of the potential risks and vulnerabilities" to ePHI. Documentation must be kept for six years.

HHS proposed major updates in a rule published January 6, 2025. As of October 2026, the federal regulatory agenda lists it as a long-term action with final action projected for July 2027, and the current rule remains in effect.

Real-World Example

On April 25, 2025, HHS's Office for Civil Rights announced a settlement with Comprehensive Neurology, PC, which it described as "a small New York neurology practice." In December 2020 the practice reported that its IT network, "including all of its ePHI, had been encrypted and rendered inaccessible by ransomware," potentially affecting 6,800 people. OCR found it "failed to conduct an accurate and thorough risk analysis." The practice paid $25,000 and agreed to a two-year corrective action plan. OCR called it the 8th enforcement action in its Risk Analysis Initiative.

Why It Matters for a Small Business

HIPAA applies to the smallest practices and to many businesses outside healthcare that serve them, such as accountants, IT providers, and billing services, once they sign a business associate agreement. OCR's recent cases show that small size is no defense, and that a missing risk analysis is the finding that turns a ransomware attack into an enforcement action. The good news is that the rule scales: a small practice's program can be short, as long as it is documented and followed.

How to Spot It / How DTS Handles It

Warning signs: no written risk analysis, or one that is years old; no business associate agreements with IT and software vendors; shared logins on systems with patient data; untested backups; and no training records.

DTS can perform a HIPAA Security Rule risk analysis for practices and business associates, build the risk management plan that follows it, and keep evidence current. No certification is required to do a risk analysis. DTS does not provide legal advice or guarantee compliance, and DTS is not a law firm, so legal questions go to your counsel. See our vCISO service, or our managed IT service for the technical safeguards.

Related Terms

Risk register: tracking risks found in the HIPAA risk analysis.
Risk assessment: the core Security Rule requirement.
Ransomware: the attack behind most recent OCR cases.
Breach notification: what follows a reportable incident.
Security awareness training: a required administrative safeguard.
Backups and the 3-2-1 rule: part of the contingency plan.
Vendor risk management: managing business associates.

Sources

HHS, Summary of the HIPAA Security Rule (content last reviewed August 7, 2026): https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html
HHS, HHS Office for Civil Rights Settles HIPAA Ransomware Cybersecurity Investigation with Neurology Practice (April 25, 2025): https://www.hhs.gov/press-room/ocr-hipaa-racap-np.html
HHS, HIPAA Security Rule Notice of Proposed Rulemaking: https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html
Office of Information and Regulatory Affairs, Unified Agenda: RIN 0945-AA22, HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information (checked October 14, 2026): https://www.reginfo.gov/public/do/eAgendaViewRule?RIN=0945-AA22&pubId=202510

Last updated October 14, 2026.