Last verified: October 2026, against 45 CFR 164.302–318 on eCFR and HHS's January 2025 proposed rule. General information, not legal advice — confirm with your compliance officer or attorney.
The HIPAA Security Rule is the part of HIPAA that tells practices how to protect patient information stored or sent electronically. It organizes requirements into administrative, physical and technical safeguards, marks each as required or addressable, and leaves the specific tools to you, based on your own risk analysis. For a small practice, that translates into concrete controls: MFA, encryption, unique logins, audit logs and backups, applied to the EHR and to the website, forms and inbox where patient data now arrives.
In short: The HIPAA Security Rule requires covered entities and vendors to protect the confidentiality, integrity and availability of electronic PHI through a risk analysis plus administrative, physical and technical safeguards. "Addressable" specifications aren't optional: implement them or document an equivalent alternative. A 2025 proposal to tighten the rule is not final.
What the Security Rule protects: ePHI
The Security Rule applies only to electronic protected health information (ePHI): PHI "transmitted by electronic media" or "maintained in electronic media," per 45 CFR 160.103 (opens in a new tab). Section 164.306(a) (opens in a new tab) sets four general duties: ensure the "confidentiality, integrity, and availability of all electronic protected health information" you create, receive, maintain or transmit; protect against reasonably anticipated threats; protect against impermissible uses and disclosures; and ensure workforce compliance.
The rule is deliberately flexible. Under 164.306(b), you choose security measures based on your size and capabilities, your technical infrastructure, cost, and "the probability and criticality of potential risks." That flexibility only works if you have done the analysis. For the use-and-disclosure side of HIPAA, see the Privacy Rule; for the definition of PHI itself, what is PHI.
Administrative safeguards
164.308 (opens in a new tab) holds the management side, and it is where most of the required items sit:
- Security management process: risk analysis and risk management (both required), a sanction policy and regular review of system activity such as audit logs.
- Assigned security responsibility: a named security official.
- Workforce security and information access management: who may access ePHI, how access is granted and changed, and termination procedures when someone leaves.
- Security awareness and training: security reminders, malware protection, log-in monitoring and password management.
- Security incident procedures: identify, respond to, mitigate and document incidents.
- Contingency plan: data backup, disaster recovery and emergency-mode operation plans (all required), plus testing.
- Evaluation: periodic technical and nontechnical evaluation.
- Business associate contracts: written assurances from every vendor handling ePHI.
The first item is the foundation; our security risk assessment walkthrough covers it step by step.
Physical safeguards
164.310 (opens in a new tab) has four standards:
- Facility access controls: limit physical access to systems and the places they are kept, with visitor control and maintenance records.
- Workstation use: define how workstations that access ePHI may be used, and in what surroundings.
- Workstation security: physically restrict workstations to authorized users.
- Device and media controls: policies for disposal and media re-use (both required), plus tracking hardware and backing up data before equipment moves.
In a small office this means a locked server or network closet, screens angled away from the waiting room, cable locks or locked storage for laptops, and wiping or destroying drives before a computer leaves the building.
Technical safeguards
164.312 (opens in a new tab) covers the controls inside your systems:
| Standard | What it means | Required or addressable |
|---|---|---|
| Access control | Unique user IDs and an emergency access procedure; automatic logoff; encryption and decryption | IDs and emergency access required; logoff and encryption addressable |
| Audit controls | Record and examine activity in systems holding ePHI | Required |
| Integrity | Protect ePHI from improper alteration or destruction | Standard required; authentication mechanism addressable |
| Person or entity authentication | Verify that a user is who they claim to be | Required |
| Transmission security | Guard ePHI sent over networks; integrity controls and encryption | Integrity controls and encryption addressable |
Multi-factor authentication is not named in the current text, but it is a common way to meet person or entity authentication, and the 2025 proposal would require it.
Required vs addressable specifications
164.306(d) (opens in a new tab) splits implementation specifications into two kinds. Required ones must be implemented. For addressable ones, you must:
- "Assess whether each implementation specification is a reasonable and appropriate safeguard in its environment"; then
- implement it if it is; or, if it isn't,
- "Document why it would not be reasonable and appropriate," and "Implement an equivalent alternative measure if reasonable and appropriate."
Addressable never means optional. HHS says as much in its January 2025 proposed rule (opens in a new tab), which cites "the apparent misunderstanding by regulated entities of 'addressable'" as a reason to remove the distinction. Documentation must be kept for six years and reviewed periodically under 164.316 (opens in a new tab).
Applying it to email, forms, hosting and chat
Patient data now enters most practices through the website. Each piece of that stack holds or carries ePHI, so each needs safeguards and, if a vendor runs it, a business associate agreement. Under 160.103, a vendor that "creates, receives, maintains, or transmits" PHI for you is a business associate, and 164.314(a) (opens in a new tab) requires the contract to bind it to the Security Rule and to report security incidents to you.
| Component | Safeguards to expect | Security Rule hook |
|---|---|---|
| Web forms | TLS (HTTPS) on every page with a form; encrypted storage of submissions; vendor BAA | Transmission security; encryption; BA contracts |
| Form notifications and email | Notifications that don't contain PHI, or email covered by a BAA with encryption | Transmission security |
| Hosting | BAA if the host stores ePHI; backups with tested restore; patching | Contingency plan; BA contracts |
| Patient inbox and CRM | Unique logins, MFA, role-based access, audit logs, automatic logoff | Access control; audit controls; authentication |
| Chat widget | BAA; encrypted transcripts; retention settings; access limited to staff who respond | Access control; BA contracts |
| Analytics and ad tags | Kept off pages where patients enter or view health information | Protects against impermissible disclosures |
Our guides go deeper on HIPAA-compliant hosting, HIPAA-compliant forms and business associate agreements.
Medfy's setup maps onto this table: patient information from its forms, chat, inbox and CRM is stored in separate, encrypted HIPAA databases in the US or Canada, encrypted in transit and at rest, with role-based permissions and an audit log of who saw what; Medfy signs a BAA with every practice, and ad platforms never receive patient data. See Medfy's security approach. A free marketing audit checks your current site for risks such as pixels on patient forms.
Proposed updates to watch
On January 6, 2025, HHS published a proposed rule (opens in a new tab) to strengthen the Security Rule, with comments due March 7, 2025. Among other changes, it would:
- remove the distinction between required and addressable specifications;
- require encryption of ePHI at rest and in transit, with limited exceptions;
- require multi-factor authentication;
- require a written technology asset inventory and network map, reviewed at least every 12 months;
- require procedures to restore critical systems and data within 72 hours of a loss;
- require a compliance audit at least once every 12 months, and backup controls tested at least every six months; and
- add vulnerability scanning and penetration testing.
As of October 22, 2026, the Federal Register shows only the proposal, and the eCFR text is unchanged. Treat it as a roadmap, not a requirement. Two free federal resources help either way: the SRA Tool (opens in a new tab) for small and medium providers, and the 405(d) program's Cybersecurity Practices for Small Healthcare Organizations (opens in a new tab) (2023 edition). Practices built on the 405(d) approaches can also benefit at enforcement time: under Public Law 116-321 (opens in a new tab), HHS must consider recognized security practices in place for the previous 12 months.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
Is encryption required by the HIPAA Security Rule?
Not outright under the current rule. Encryption of stored and transmitted ePHI is an addressable specification, which means you must implement it where reasonable and appropriate, or document why not and use an equivalent alternative. For laptops, phones, email and web forms, encryption is usually reasonable and appropriate, and encrypted data can keep a lost device out of breach notification. HHS's 2025 proposal would make it mandatory. Confirm with your compliance officer or attorney.
What are addressable specifications?
They are Security Rule specifications you must assess rather than skip. For each one, decide whether it is reasonable and appropriate for your practice; if it is, implement it; if not, document why and implement an equivalent alternative where reasonable. Addressable never means optional. Automatic logoff, encryption and password management are examples. Keep the written reasoning with your risk analysis, and review it with your compliance officer or attorney.
Does the Security Rule apply to paper records?
No. The Security Rule covers only electronic protected health information. Paper charts, printed schedules and faxes received on paper fall under the Privacy Rule instead, which still requires appropriate administrative, technical and physical safeguards for PHI in every form. So locked cabinets, clean desks and shredding remain required; they just come from a different rule. Confirm your safeguards with your compliance officer or attorney.
Do website forms fall under the Security Rule?
Yes, when they collect patient information. A form submission with a name and reason for visit is electronic PHI the moment it is transmitted, and it remains ePHI wherever it is stored: the form vendor, your inbox, your CRM. That means encryption in transit, protected storage, access controls, audit logs and a BAA with each vendor. Confirm your form setup with your compliance officer or attorney.