The Security Rule

The HIPAA Security Rule establishes national standards to protect individuals' electronic personal health information that is created, received, used, or maintained by a covered entity. The Security Rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.

The Security Rule is located at 45 CFR Part 160 and Subparts A and C of Part 164.

View the combined regulation text of all HIPAA Administrative Simplification Regulations found at 45 CFR 160, 162, and 164.

Security Rule History

January 25, 2013 – Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health (HITECH) Act and the Genetic Information Nondiscrimination Act, and Other Modifications – Final Rule (The “Omnibus HIPAA Final Rule”)

July 14, 2010 – Modifications to the HIPAA Privacy, Security, and Enforcement Rules under the HITECH Act – Proposed Rule

August 4, 2009 – Federal Register notice of the Delegation of Authority to OCR (74 FR 38630)

August 3, 2009 – View the Delegation of Authority Press Release

February 20, 2003 – Security Standards – Final Rule

August 12, 1998 – Security and Electronic Signature Standards - Proposed Rule

HHS Security Risk Assessment Tool

The Office of the National Coordinator for Health Information Technology (ONC) and the HHS Office for Civil Rights (OCR) have jointly launched a HIPAA Security Risk Assessment Tool. The tool's features make it useful in assisting small and medium-sized health care practices and business associates as they perform a risk assessment.

HHS Security Risk Assessment Tool

NIST HIPAA Security Rule Toolkit

The NIST HIPAA Security Toolkit Application is a self-assessment survey intended to help organizations better understand the requirements of the HIPAA Security Rule (HSR), implement those requirements, and assess those implementations in their operational environment.  A comprehensive user guide and instructions for using the application are available along with the HSR application.

NIST HSR Toolkit

Risk Analysis Guidance

• Read the Guidance on Risk Analysis requirements under the Security Rule.
• Safeguarding Health Information: Building Assurance Through HIPAA Security
  • View the presentations from the OCR and NIST HIPAA Security Rule Conference held:
    • May 10-11, 2011
    • May 11-12, 2010

Additional Security Rule Guidance

See the Security Rule Guidance page for additional guidance.