The Security Rule

The HIPAA Security Rule establishes national standards to protect individuals' electronic protected health information that is created, received, used, or maintained by a covered entity or its business associate. The Security Rule requires implementation of appropriate administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of electronic protected health information.

The Security Rule is located at 45 CFR Part 160 and Subparts A and C of Part 164.

View the combined regulation text of all HIPAA Administrative Simplification Regulations found at 45 CFR 160, 162, and 164.

Security Rule History

January 6, 2025

HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information – Proposed Rule

January 25, 2013

Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health (HITECH) Act and the Genetic Information Nondiscrimination Act, and Other Modifications – Final Rule (The “Omnibus HIPAA Final Rule”)

July 14, 2010

Modifications to the HIPAA Privacy, Security, and Enforcement Rules under the HITECH Act – Proposed Rule

August 4, 2009

Federal Register notice of the Delegation of Authority to OCR (74 FR 38630)

February 20, 2003

Security Standards – Final Rule

August 12, 1998

Security and Electronic Signature Standards - Proposed Rule

HHS Security Risk Assessment Tool

The Assistant Secretary for Technology Policy/Office of the National Coordinator for Health Information Technology (ASTP/ONC) and the HHS Office for Civil Rights (OCR) have jointly launched a Security Risk Assessment Tool for regulated entities. The tool's features make it useful in assisting small and medium-sized health care practices and business associates as they perform a risk assessment.

OCR and NIST HIPAA Security Rule Conference 

Safeguarding Health Information: Building Assurance Through HIPAA Security

View the presentations from the OCR and NIST HIPAA Security Rule Conference held October 23-24, 2024.

Security Rule Guidance

See the Security Rule Guidance and Cyber Security Guidance webpages for guidance

Content last reviewed