What Is HIPAA Security Rule?

The HIPAA Security Rule sets national standards for safeguarding electronic protected health information. It organizes its requirements into three safeguard families. Administrative safeguards cover risk analysis, risk management, workforce training, and contingency planning. Physical safeguards cover facility access and device and media controls. Technical safeguards cover access control, audit controls, integrity, and transmission security. The rule is deliberately flexible and scalable, so a ten-provider clinic and a hospital system are both covered but can meet the standards differently.

The rule applies to covered entities, meaning health plans, healthcare clearinghouses, and providers that transmit health information electronically, and to their business associates. Enforcement belongs to the HHS Office for Civil Rights, which consistently cites the risk analysis requirement as the most common failure in its investigations.

In January 2025, HHS published a proposed rule that would significantly strengthen the Security Rule, including broader encryption and multifactor authentication expectations. That proposal is not final, and the anticipated final action has moved to an estimated July 2027, so the current rule remains the enforceable standard. Organizations preparing now can work from a HIPAA Security Rule compliance checklist and start with a documented security risk assessment, since that requirement is unchanged in every version of the rule.