# What is the HIPAA Security Rule?

The HIPAA Security Rule sets how health plans, providers that bill electronically, and their vendors must protect electronic patient health information.

Updated: October 16, 2026

The HIPAA Security Rule is the federal regulation on how health care organizations and their vendors must protect electronic protected health information (ePHI). ePHI is patient health information sent or stored electronically. The rule is Subpart C of 45 CFR Part 164, which starts at section 164.302.

## Who has to follow it?

Section 164.302 applies the rule to two groups: covered entities and business associates. Under 45 CFR 160.103, covered entities are health plans, health care clearinghouses, and certain health care providers. A provider is covered if it sends health information electronically for a transaction HIPAA covers, such as a claim or an eligibility check. Business associates are the vendors and service companies that handle that information on a covered entity's behalf. [What is a HIPAA business associate?](/guides/healthcare-access/what-is-a-hipaa-business-associate) explains where that line falls.

The rule covers only electronic information. In 160.103, electronic media include hard drives, memory cards and other storage, plus the internet and other networks used to move stored data.

## What does the rule ask for overall?

Section 164.306(a) sets four general duties. Keep ePHI confidential, intact and available. Protect it against threats you can reasonably expect. Protect it against uses and disclosures HIPAA doesn't allow. Make sure your workforce follows the rule.

The rule doesn't prescribe products. Under 164.306(b), you may use any measures that let you meet the standards reasonably and appropriately. When you choose them, you weigh your size and capabilities, your existing systems, the cost, and how likely and serious each risk to ePHI is.

## How is the rule organized?

The standards sit in five sections. The first three hold the administrative, physical and technical safeguards.

| Section | What it covers | Examples that touch logins |
| --- | --- | --- |
| 164.308 Administrative safeguards | Policies and procedures, and managing how your workforce handles ePHI | Risk analysis, workforce security, information access management, log-in monitoring, password management |
| 164.310 Physical safeguards | Facilities, workstations and devices | Workstation use, workstation security |
| 164.312 Technical safeguards | Technology and the rules for using it | Access control, audit controls, person or entity authentication |
| 164.314 Organizational requirements | Contracts with business associates | What a business associate contract must require |
| 164.316 Policies, procedures and documentation | Written policies, procedures and records | Keeping documentation for six years |

Section 164.304 defines the three safeguard types. Administrative safeguards are "administrative actions, and policies and procedures". Physical safeguards protect systems, buildings and equipment. Technical safeguards are "the technology and the policy and procedures for its use" that protect ePHI and control access to it.

## What do "required" and "addressable" mean?

Each standard may come with implementation specifications, the more detailed steps under it. Section 164.306(d) labels every specification either "Required" or "Addressable", in parentheses after its title.

A required specification must be implemented. Unique user identification in 164.312(a)(2)(i) is one: every user gets their own name or number.

An addressable specification is not optional. You must first assess whether it is reasonable and appropriate in your setting. If it is, you implement it. If it isn't, you document why, and you implement an equivalent alternative if that is reasonable and appropriate. Automatic logoff, encryption, termination procedures and password management are all addressable today.

Some standards have no specifications under them, such as audit controls in 164.312(b) and person or entity authentication in 164.312(d). Under 164.306(c) you still have to meet them.

## Is the rule changing?

HHS published a proposed rule on January 6, 2025 (90 FR 898). Among other changes, it would require encryption of ePHI with limited exceptions. It would also add a definition of multi-factor authentication tied to a proposed requirement at 164.312(f)(2)(ii). And it would remove the distinction between "addressable" and "required" specifications, making all of them required, with limited exceptions. A proposed rule is not law. The current text, addressable specifications included, stays in force unless HHS finalizes the proposal and its compliance date arrives. How the current access rules apply at a practice is in [HIPAA Security Rule access control requirements](/guides/healthcare-access/hipaa-security-rule-access-control).


## Frequently asked questions

**Is an "addressable" specification optional?**

No. You have to assess it. If it's reasonable and appropriate for you, you implement it. If not, you write down why and put an equivalent measure in place where that is reasonable and appropriate.

**Does the Security Rule cover paper charts?**

No. It covers electronic protected health information, meaning patient health information sent or stored in electronic media such as hard drives, memory cards and networks.

**Does a small practice have to meet the same standards as a hospital?**

The standards are the same. The rule lets each organization choose its measures based on its size, its systems, the cost of the measures and how likely and serious the risks are.

**How long do we keep Security Rule documentation?**

Six years from the date it was created or the date it was last in effect, whichever is later (45 CFR 164.316(b)(2)(i)).

**Does the Security Rule require multi-factor authentication?**

The current text asks you to verify that a person is who they claim to be and names no method. HHS's January 2025 proposal would add a multi-factor requirement, but it is still a proposal.

## Sources

- [eCFR: 45 CFR 164.302, Applicability](https://www.ecfr.gov/current/title-45/section-164.302)
- [eCFR: 45 CFR 164.304, Definitions](https://www.ecfr.gov/current/title-45/section-164.304)
- [eCFR: 45 CFR 164.306, Security standards: General rules](https://www.ecfr.gov/current/title-45/section-164.306)
- [eCFR: 45 CFR 164.308, Administrative safeguards](https://www.ecfr.gov/current/title-45/section-164.308)
- [eCFR: 45 CFR 164.310, Physical safeguards](https://www.ecfr.gov/current/title-45/section-164.310)
- [eCFR: 45 CFR 164.312, Technical safeguards](https://www.ecfr.gov/current/title-45/section-164.312)
- [eCFR: 45 CFR 164.314, Organizational requirements](https://www.ecfr.gov/current/title-45/section-164.314)
- [eCFR: 45 CFR 164.316, Policies and procedures and documentation requirements](https://www.ecfr.gov/current/title-45/section-164.316)
- [eCFR: 45 CFR 160.103, Definitions](https://www.ecfr.gov/current/title-45/section-160.103)
- [Federal Register, 90 FR 898 (January 6, 2025): HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, proposed rule](https://www.govinfo.gov/content/pkg/FR-2025-01-06/html/2024-30983.htm)

## How Junify handles this

**Doing this by hand** You give every clinician and staff member their own login, open and close access for each per-diem shift and vendor staff change, and keep a record of who used which system and when for someone to review.

**With Junify** Junify is for EHR and portal logins. Your admin adds each login to Junify and assigns it to the people who may use it. They verify on their own phone and click to sign in, and Junify fills in the login without showing the password. Each use is recorded under the person's name, even on a shared login. When someone's shift or contract ends, the admin removes their assignment and they can't sign in through Junify after that.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=healthcare&from=guide&cluster=healthcare-access&slug=what-is-the-hipaa-security-rule)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [Can staff use personal devices to access clinical systems?](/guides/healthcare-access/byod-for-clinical-systems): HIPAA allows it with safeguards. Treat each personal laptop or phone as a workstation, write a device policy, and protect both the device and the login.
- [Who is responsible for user accounts in your practice's cloud software?](/guides/healthcare-access/clinic-saas-responsibility-split): The vendor secures its service. Your practice decides who gets a login and removes it when they leave. HHS says to sign a BAA and put the split in writing.
- [The HHS cybersecurity performance goals for accounts and logins](/guides/healthcare-access/hhs-cybersecurity-performance-goals-accounts): Four of HHS's 10 essential goals cover logins: MFA, revoking departing staff's access, unique credentials and separate admin accounts. HHS calls them voluntary.