The HIPAA Security Rule, requirement by requirement
This is the rule as Mock HIPAA Audit holds it: 67 requirements across five safeguard families. Each one is our statement of its clause, cited to the clause, with the examiner question an OCR investigator asks when your pack does not evidence it. Run a pack against it.
67 requirements, 134 examiner questions.
Administrative safeguards 32 requirements
- 164.306 Security Standards: General Rules Provision
- 164.308(a)(1)(i) Security Management Process (Standard) Standard
- 164.308(a)(1)(ii)(A) Risk Analysis (Required) Required
- 164.308(a)(1)(ii)(B) Risk Management (Required) Required
- 164.308(a)(1)(ii)(C) Sanction Policy (Required) Required
- 164.308(a)(1)(ii)(D) Information System Activity Review (Required) Required
- 164.308(b)(1) Business Associate Contracts and Other Arrangements (Standard) Standard
- 164.308(a)(2) Assigned Security Responsibility (Standard) Standard
- 164.308(b)(2) Subcontractor Arrangements Provision
- 164.308(a)(3)(i) Workforce Security (Standard) Standard
- 164.308(a)(3)(ii)(A) Authorization and Supervision (Addressable) Addressable
- 164.308(a)(3)(ii)(B) Workforce Clearance Procedure (Addressable) Addressable
- 164.308(a)(3)(ii)(C) Termination Procedures (Addressable) Addressable
- 164.308(b)(3) Written Contract or Other Arrangement Provision
- 164.308(a)(4)(i) Information Access Management (Standard) Standard
- 164.308(a)(4)(ii)(A) Isolating Health Care Clearinghouse Functions (Required if applicable) Required if applicable
- 164.308(a)(4)(ii)(B) Access Authorization (Addressable) Addressable
- 164.308(a)(4)(ii)(C) Access Establishment and Modification (Addressable) Addressable
- 164.308(a)(5)(i) Security Awareness and Training (Standard) Standard
- 164.308(a)(5)(ii)(A) Security Reminders (Addressable) Addressable
- 164.308(a)(5)(ii)(B) Protection from Malicious Software (Addressable) Addressable
- 164.308(a)(5)(ii)(C) Log-in Monitoring (Addressable) Addressable
- 164.308(a)(5)(ii)(D) Password Management (Addressable) Addressable
- 164.308(a)(6)(i) Security Incident Procedures (Standard) Standard
- 164.308(a)(6)(ii) Response and Reporting (Required) Required
- 164.308(a)(7)(i) Contingency Plan (Standard) Standard
- 164.308(a)(7)(ii)(A) Data Backup Plan (Required) Required
- 164.308(a)(7)(ii)(B) Disaster Recovery Plan (Required) Required
- 164.308(a)(7)(ii)(C) Emergency Mode Operation Plan (Required) Required
- 164.308(a)(7)(ii)(D) Testing and Revision Procedures (Addressable) Addressable
- 164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis (Addressable) Addressable
- 164.308(a)(8) Evaluation (Standard) Standard
Physical safeguards 12 requirements
- 164.310(b) Workstation Use (Standard) Standard
- 164.310(c) Workstation Security (Standard) Standard
- 164.310(a)(1) Facility Access Controls (Standard) Standard
- 164.310(d)(1) Device and Media Controls (Standard) Standard
- 164.310(a)(2)(i) Contingency Operations (Addressable) Addressable
- 164.310(a)(2)(ii) Facility Security Plan (Addressable) Addressable
- 164.310(a)(2)(iii) Access Control and Validation Procedures (Addressable) Addressable
- 164.310(a)(2)(iv) Maintenance Records (Addressable) Addressable
- 164.310(d)(2)(i) Disposal (Required) Required
- 164.310(d)(2)(ii) Media Re-use (Required) Required
- 164.310(d)(2)(iii) Accountability (Addressable) Addressable
- 164.310(d)(2)(iv) Data Backup and Storage (Addressable) Addressable
Technical safeguards 12 requirements
- 164.312(b) Audit Controls (Standard) Standard
- 164.312(d) Person or Entity Authentication (Standard) Standard
- 164.312(a)(1) Access Control (Standard) Standard
- 164.312(c)(1) Integrity (Standard) Standard
- 164.312(e)(1) Transmission Security (Standard) Standard
- 164.312(a)(2)(i) Unique User Identification (Required) Required
- 164.312(a)(2)(ii) Emergency Access Procedure (Required) Required
- 164.312(a)(2)(iii) Automatic Logoff (Addressable) Addressable
- 164.312(a)(2)(iv) Encryption and Decryption (Addressable) Addressable
- 164.312(c)(2) Mechanism to Authenticate ePHI (Addressable) Addressable
- 164.312(e)(2)(i) Integrity Controls for Transmission (Addressable) Addressable
- 164.312(e)(2)(ii) Encryption of Transmissions (Addressable) Addressable
Organizational safeguards 6 requirements
- 164.314(a)(1) Business Associate Contracts or Other Arrangements (Standard) Standard
- 164.314(b)(1) Requirements for Group Health Plans (Standard) Standard
- 164.314(a)(2)(i) Business Associate Contract Required Provisions Provision
- 164.314(a)(2)(ii) Other Arrangements (Government) Provision
- 164.314(a)(2)(iii) Business Associate Contracts with Subcontractors Provision
- 164.314(b)(2) Implementation Specifications for Group Health Plans Provision