United States. Health data. Regulation
HIPAA Security RuleHIPAA Security Rule (45 C.F.R. Part 164 Subpart C)
In force
§1Summary
- Synopsis
Requires covered entities and business associates to protect electronic PHI through administrative, physical and technical safeguards, based on a documented risk analysis. Many specifications are 'addressable', allowing risk-based alternatives.
- Key themes
- Unique features
Flexible, risk-based approach; the pending proposal would make encryption and MFA mandatory and require asset inventories and 72-hour restoration capability.
- SaaS relevance
Cloud and SaaS business associates holding ePHI must run risk analyses and implement the safeguards themselves, not merely contractually.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- See HIPAA Breach Notification Rule
- DPO
- Yes
- Cross-border transfers
- None
- Maximum penalty
- As HIPAA Privacy Rule (tiered; ~$2.1m annual cap per provision)
§3Dates
- Key dates
- Adopted
- In force
- Compliance 2005-04-20 (small plans 2006); NPRM to overhaul the rule published 2025-01-06; HHS has moved final action to 'long-term actions' with target July 2027.
§4Text and authority
- Text
- Authoritative text ecfr.gov
- Authority
- HHS Office for Civil Rights (OCR)
§5Where it applies
- Domestic law of
- United States
- Also applies in
- Alabama
- Alaska
- Arizona
- Arkansas
- California
- Colorado
- Connecticut
- Delaware
- District of Columbia
- Florida
- Georgia
- Guam
- Hawaii
- Idaho
- Illinois
- Indiana
- Iowa
- Kansas
- Kentucky
- Louisiana
- Maine
- Maryland
- Massachusetts
- Michigan
- Minnesota
- Mississippi
- Missouri
- Montana
- Nebraska
- Nevada
- New Hampshire
- New Jersey
- New Mexico
- New York
- North Carolina
- North Dakota
- Ohio
- Oklahoma
- Oregon
- Pennsylvania
- Puerto Rico
- Rhode Island
- South Carolina
- South Dakota
- Tennessee
- Texas
- US Virgin Islands
- Utah
- Vermont
- Virginia
- Washington
- West Virginia
- Wisconsin
- Wyoming
§6Sources and verification
- Verification
High confidence.
dpo_required Yes = mandatory security official. Proposed amendments were not finalised as of Oct 2026.