# HIPAA Security Rule — Standards and References

## Primary Legal Sources

### Code of Federal Regulations
- **45 CFR Part 164, Subpart C** — Security Standards for the Protection of Electronic Protected Health Information
- **45 CFR §164.302** — Applicability (applies to covered entities and business associates)
- **45 CFR §164.304** — Definitions specific to the Security Rule
- **45 CFR §164.306** — Security standards: general rules (flexibility of approach, required vs addressable)
- **45 CFR §164.308** — Administrative safeguards (risk analysis, workforce security, access management, training, incident procedures, contingency plan, evaluation, BAA requirements)
- **45 CFR §164.310** — Physical safeguards (facility access, workstation use/security, device and media controls)
- **45 CFR §164.312** — Technical safeguards (access control, audit controls, integrity, authentication, transmission security)
- **45 CFR §164.314** — Organizational requirements (BAA contracts, group health plan requirements)
- **45 CFR §164.316** — Policies and procedures and documentation requirements

### Federal Register
- **68 FR 8334** — Health Insurance Reform: Security Standards; Final Rule (February 20, 2003)
- **78 FR 5566** — Omnibus Rule modifications extending Security Rule to business associates (January 25, 2013)
- **89 FR 106039** — HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information; NPRM (December 27, 2024)

## NIST Standards and Guidelines

- **NIST SP 800-66 Rev. 2** — "Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide" (February 2024) — primary cross-reference mapping HIPAA Security Rule to NIST controls
- **NIST SP 800-53 Rev. 5** — "Security and Privacy Controls for Information Systems and Organizations" — comprehensive control catalog
- **NIST SP 800-111** — "Guide to Storage Encryption Technologies for End User Devices" — referenced for ePHI encryption at rest
- **NIST SP 800-88 Rev. 1** — "Guidelines for Media Sanitization" — referenced for ePHI media disposal
- **NIST SP 800-52 Rev. 2** — "Guidelines for the Selection, Configuration, and Use of TLS Implementations" — referenced for transmission security
- **NIST Cybersecurity Framework 2.0** — Voluntary framework with HIPAA Security Rule cross-references

## FIPS Publications
- **FIPS 140-2/140-3** — Security Requirements for Cryptographic Modules — standard for encryption module validation
- **FIPS 197** — Advanced Encryption Standard (AES) — the accepted standard for ePHI encryption
- **FIPS 199** — Standards for Security Categorization of Federal Information and Information Systems

## Industry Standards
- **HITRUST CSF v11** — Common Security Framework incorporating HIPAA, NIST, ISO 27001
- **ISO/IEC 27001:2022** — Information security management systems — international standard referenced in healthcare
- **CIS Controls v8** — Center for Internet Security critical security controls benchmark
- **OWASP Top 10** — Web application security risks relevant to healthcare web applications

## OCR Guidance
- **OCR Security Rule Guidance Material** — Published at hhs.gov/hipaa/for-professionals/security/guidance
- **OCR Guidance on Risk Analysis Requirements** — July 14, 2010 guidance on the nine essential elements
- **OCR Cybersecurity Newsletter Series** — Quarterly newsletters addressing specific Security Rule topics
- **OCR Recognized Security Practices** — Under HITECH §13412 (2021 amendment), OCR considers recognized security practices (NIST, HITRUST, Section 405(d) HICP) as mitigating factors in enforcement