Security Management Process
- § 164.308(a)(1)(ii)(A): Conduct accurate risk analysis (HIPAA Reg., Part 164 Subpart C)
- § 164.308(a)(1)(ii)(B): Implement risk management measures (HIPAA Reg., Part 164 Subpart C)
- NIST SP 800-66r2: Identify ePHI and systems (Table 8, Sec 5.1.1)
- NIST SP 800-66r2: Conduct comprehensive risk assessment (Section 3.2)
Evaluation
- § 164.308(a)(8): Perform periodic security evaluations (HIPAA Reg., Part 164 Subpart C)
- NIST SP 800-66r2: Repeat evaluations after changes (Table 15, Sec 5.1.8)
Workforce Security
- § 164.308(a)(3)(ii)(A): Authorize supervise workforce access (HIPAA Reg., Part 164 Subpart C)
- § 164.308(a)(3)(ii)(B): Establish workforce clearance procedures (HIPAA Reg., Part 164 Subpart C)
- § 164.308(a)(3)(ii)(C): Terminate access upon employment end (HIPAA Reg., Part 164 Subpart C)
- NIST SP 800-66r2: Implement workforce termination procedures (Table 10, Sec 5.1.3)
Security Awareness and Training
- § 164.308(a)(5)(i): Provide security awareness training (HIPAA Reg., Part 164 Subpart C)
- § 164.530(b)(1): Train workforce on privacy (HIPAA Reg., Part 164 Subpart E)
- NIST SP 800-66r2: Develop security awareness content (Table 12, Sec 5.1.5)
Information Access Management
- § 164.308(a)(4)(ii)(B): Establish access authorization policies (HIPAA Reg., Part 164 Subpart C)
- § 164.308(a)(4)(ii)(C): Manage access establishment modification (HIPAA Reg., Part 164 Subpart C)
- NIST SP 800-66r2: Implement access authorization policies (Table 11, Sec 5.1.4)
Access Control
- § 164.312(a)(1): Allow access to authorized users (HIPAA Reg., Part 164 Subpart C)
- § 164.312(a)(2)(i): Assign unique user identifiers (HIPAA Reg., Part 164 Subpart C)
- § 164.312(a)(2)(iii): Enforce automatic session logoff (HIPAA Reg., Part 164 Subpart C)
Person or Entity Authentication
- § 164.312(d): Verify person or entity identity (HIPAA Reg., Part 164 Subpart C)
- NIST SP 800-66r2: Select authentication mechanisms (Table 24, Sec 5.3.4)
Transmission and Encryption Security
- § 164.312(a)(2)(iv): Encrypt and decrypt ePHI (HIPAA Reg., Part 164 Subpart C)
- § 164.312(e)(2)(ii): Encrypt data during transmission (HIPAA Reg., Part 164 Subpart C)
- NIST SP 800-66r2: Implement transmission encryption controls (Table 25, Sec 5.3.5)
Data Protection & Cryptography
- § 164.312(a)(2)(iv): Encrypt and decrypt ePHI (HIPAA Reg., Part 164 Subpart C)
- § 164.312(e)(2)(ii): Encrypt data during transmission (HIPAA Reg., Part 164 Subpart C)
- NIST SP 800-66r2: Implement transmission encryption controls (Table 25, Sec 5.3.5)
Integrity Controls
- § 164.312(c)(1): Protect data from alteration (HIPAA Reg., Part 164 Subpart C)
- § 164.312(e)(2)(i): Ensure transmission data integrity (HIPAA Reg., Part 164 Subpart C)
Audit Controls
- § 164.312(b): Record and examine system activity (HIPAA Reg., Part 164 Subpart C)
- § 164.308(a)(1)(ii)(D): Review information system activity (HIPAA Reg., Part 164 Subpart C)
- NIST SP 800-66r2: Select auditing and review tools (Table 22, Sec 5.3.2)
Security Incident Procedures
- § 164.308(a)(6)(ii): Identify and respond incidents (HIPAA Reg., Part 164 Subpart C)
- § 164.404: Notify individuals of breaches (HIPAA Reg., Part 164 Subpart D)
- § 164.408: Notify Secretary of breaches (HIPAA Reg., Part 164 Subpart D)
- NIST SP 800-66r2: Establish incident response capability (Table 13, Sec 5.1.6)
Contingency Plan
- § 164.308(a)(7)(ii)(A): Create retrievable data backups (HIPAA Reg., Part 164 Subpart C)
- § 164.308(a)(7)(ii)(B): Restore data after emergencies (HIPAA Reg., Part 164 Subpart C)
- § 164.308(a)(7)(ii)(C): Maintain emergency operations mode (HIPAA Reg., Part 164 Subpart C)
- NIST SP 800-66r2: Conduct data criticality analysis (Table 14, Sec 5.1.7)
Business Associate Contracts
- § 164.308(b)(1): Obtain business associate assurances (HIPAA Reg., Part 164 Subpart C)
- § 164.314(a)(2)(i): Include security requirements contracts (HIPAA Reg., Part 164 Subpart C)
- § 164.504(e)(2): Define business associate obligations (HIPAA Reg., Part 164 Subpart E)
Facility Access Controls
- § 164.310(a)(1): Limit physical facility access (HIPAA Reg., Part 164 Subpart C)
- § 164.310(a)(2)(ii): Implement facility security plan (HIPAA Reg., Part 164 Subpart C)
- NIST SP 800-66r2: Analyze physical access vulnerabilities (Table 17, Sec 5.2.1)
Workstation Use and Security
- § 164.310(b): Specify workstation functions surroundings (HIPAA Reg., Part 164 Subpart C)
- § 164.310(c): Restrict workstation physical access (HIPAA Reg., Part 164 Subpart C)
- NIST SP 800-66r2: Implement workstation physical safeguards (Table 19, Sec 5.2.3)
Device and Media Controls
- § 164.310(d)(1): Control device and media usage (HIPAA Reg., Part 164 Subpart C)
- § 164.310(d)(2)(i): Dispose electronic media securely (HIPAA Reg., Part 164 Subpart C)
- NIST SP 800-66r2: Maintain hardware media accountability (Table 20, Sec 5.2.4)
Privacy Rule – Individual Rights
- § 164.520: Provide notice of privacy practices (HIPAA Reg., Part 164 Subpart E)
- § 164.524: Provide individual access to PHI (HIPAA Reg., Part 164 Subpart E)
- § 164.526: Amend protected health information (HIPAA Reg., Part 164 Subpart E)
- § 164.528: Account for disclosures made (HIPAA Reg., Part 164 Subpart E)
Policies and Documentation
- § 164.316(a): Maintain security policies procedures (HIPAA Reg., Part 164 Subpart C)
- § 164.316(b): Retain required documentation records (HIPAA Reg., Part 164 Subpart C)
- § 164.530(j): Retain privacy documentation records (HIPAA Reg., Part 164 Subpart E)
