HIPAA Security Rule / NIST SP 800-66 Rev. 2

Why does it matter?

Any organization that creates, receives, maintains or transmits ePHI for a covered entity must meet the same standards, including the cloud and software vendors that act as business associates (section 164.306(a)). The rule gives OCR a written test for investigations: whether the entity assessed risk accurately and thoroughly and put reasonable and appropriate safeguards in place.

Key benefits include:

• Business associates carry their own liability

A business associate is liable for its own Security Rule violations, so a vendor that handles ePHI needs its own risk analysis and safeguards, not only a contract with the covered entity (NIST SP 800-66 Rev. 2, Section 2).

• Scalable by design

The required standards are the same for every entity, but section 164.306(b) lets size, complexity, infrastructure, cost and risk shape how an entity implements them.

• Risk analysis anchors the program

Risk analysis and risk management are both Required specifications (164.308(a)(1)(ii)(A) and (B)), and NIST SP 800-66 Rev. 2 describes a method for each in Sections 3 and 4.

• Documentation is retained for six years

Policies, procedures and the records the rule requires must be kept for six years from creation or from the date last in effect, whichever is later (section 164.316(b)).

• Recovery planning is mandatory

The contingency plan standard (164.308(a)(7)) requires a data backup plan, a disaster recovery plan and an emergency mode operation plan.

How does it work?

Subpart C has nine sections. Section 164.306 sets the general requirements: ensure the confidentiality, integrity and availability of all ePHI, protect against reasonably anticipated threats and impermissible uses or disclosures, and ensure workforce compliance. Sections 164.308, 164.310 and 164.312 hold the administrative, physical and technical standards, 164.314 the organizational requirements and 164.316 the documentation standard.

Every standard must be met. Many standards carry implementation specifications that are either Required or Addressable (164.306(d)). A Required specification must be implemented. For an Addressable one, the entity assesses whether it is reasonable and appropriate in its environment. If it is, the entity implements it. If not, it documents why and implements an equivalent alternative measure where reasonable. Addressable does not mean optional.

NIST SP 800-66 Revision 2, Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide, replaced Revision 1 (2008). Section 3 gives a seven-step risk assessment method, Section 4 a risk management approach, and Section 5 a table for each standard with key activities, descriptions and sample questions. Appendix D maps each standard to NIST Cybersecurity Framework subcategories and SP 800-53 controls. The guide states that it does not modify HIPAA and that using it does not ensure compliance.

Key Elements

• Administrative safeguards (164.308)

Eight standards: security management process, assigned security responsibility, workforce security, information access management, security awareness and training, security incident procedures, contingency plan and evaluation (164.308(a)(1) to (8)), plus business associate contracts (164.308(b)).

• Security management process (164.308(a)(1))

Four Required specifications: risk analysis, risk management, a sanction policy and information system activity review (164.308(a)(1)(ii)(A) to (D)).

• Physical safeguards (164.310)

Facility access controls, workstation use, workstation security, and device and media controls. Disposal and media re-use are Required specifications under device and media controls (164.310(d)(2)).

• Technical safeguards (164.312)

Access control, audit controls, integrity, person or entity authentication and transmission security. Unique user identification and an emergency access procedure are Required, while automatic logoff and encryption and decryption are Addressable (164.312(a)(2)).

• Contingency plan (164.308(a)(7))

The data backup, disaster recovery and emergency mode operation plans are Required. Testing and revision procedures and the applications and data criticality analysis are Addressable.

• Organizational requirements and documentation (164.314, 164.316)

Section 164.314 sets the contract terms for business associates and subcontractors and the plan document terms for group health plans. Section 164.316 requires written policies and procedures and retained documentation.

What does it cover?

The rule covers ePHI that a regulated entity creates, receives, maintains or transmits. Its regulated entities are covered healthcare providers that transmit health information electronically in connection with a standard transaction, health plans, healthcare clearinghouses and business associates (NIST SP 800-66 Rev. 2, Section 2). It does not directly address the Privacy, Breach Notification or Enforcement Rules, which sit in other parts of the HIPAA regulations (Section 1.2).

What are its objectives?

Section 164.306(a) states what the Security Rule is for.

Ensure the confidentiality, integrity and availability of all ePHI the entity creates, receives, maintains or transmits (164.306(a)(1)).

Protect against reasonably anticipated threats and against uses or disclosures the Privacy Rule does not permit (164.306(a)(2) and (3)).

Ensure compliance by the workforce (164.306(a)(4)).

Implement security measures that reduce risks to a reasonable and appropriate level (164.308(a)(1)(ii)(B)).

Evaluate the safeguards periodically, and again after environmental or operational changes (164.308(a)(8)).

Keep required documentation for six years (164.316(b)).

Framework in Context

The Security Rule is the regulation, and NIST SP 800-66 Rev. 2 is non-binding guidance on it. HHS adopted the rule under the Administrative Simplification subtitle of HIPAA, and it was amended by the 2013 Omnibus Rule (78 FR 5566). The January 2025 proposed rule (90 FR 898, RIN 0945-AA22) would remove the distinction between Addressable and Required specifications. Comments closed on 7 March 2025, and the federal Unified Agenda lists final action as a long-term item dated July 2027, so the current text still applies.

Common Framework Mappings

NIST SP 800-66 Rev. 2 Appendix D maps each Security Rule standard and implementation specification to NIST Cybersecurity Framework subcategories and SP 800-53 controls, which is why those two appear in the list. The other mappings are choices an organization makes, not part of the rule.

Mapped frameworks include:

CIS Controls v8.1

GDPR

HITRUST CSF v11.5

ISO 27001:2022

ISO 27701

NIST CSF 2.0

NIST 800-53 Rev.5

SOC 2