HIPAA Security Rule readiness: risk analysis and safeguards review

The first administrative safeguard in the HIPAA Security Rule is the security management process, and its first two implementation specifications are both required. The risk analysis specification says to “conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate” (45 CFR 164.308(a)(1)(ii)(A)).

Risk management then says to “implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level” (164.308(a)(1)(ii)(B)). The rule's own term is risk analysis, though many people call it a HIPAA risk assessment or a security risk assessment.

The rule sets no fixed interval for redoing the analysis. It does require a periodic technical and nontechnical evaluation, first against the standards and then in response to environmental or operational changes that affect the security of ePHI (164.308(a)(8)). Documentation must be reviewed periodically, updated as needed, and kept for six years from its creation or the date it was last in effect, whichever is later (164.316(b)(2)).

The Security Rule groups its standards into three families of safeguards, alongside organizational requirements (164.314) and policy and documentation requirements (164.316). The table lists every safeguard standard by the name the rule gives it.

Each standard may carry implementation specifications, and each specification is marked in the rule as required or addressable.

Every implementation specification in the Security Rule is labeled either required or addressable (45 CFR 164.306(d)). Required specifications must be implemented.

Addressable doesn't mean optional. For each addressable specification, you assess whether it is a reasonable and appropriate safeguard in your environment. If it is, you implement it. If it isn't, you document why, and you implement an equivalent alternative measure if that is reasonable and appropriate (164.306(d)(3)).

The technical safeguards show both kinds side by side. Under access control, unique user identification and an emergency access procedure are required, while automatic logoff and encryption and decryption are addressable (164.312(a)(2)). When choosing security measures, the rule lets you weigh your size, complexity and capabilities, your technical infrastructure, the costs of the measures, and the probability and criticality of potential risks to ePHI (164.306(b)(2)).

HHS's January 2025 proposal would remove the distinction between required and addressable specifications. As of 2026-09-27, the proposal hasn't been finalized or withdrawn, so the distinction still applies.

A business associate is a person or organization, other than a member of the workforce, that creates, receives, maintains, or transmits protected health information on behalf of a covered entity for a function or activity the HIPAA rules regulate, or that provides certain services to a covered entity, such as legal, accounting, or consulting services, involving protected health information. The definition also includes subcontractors that do the same on behalf of a business associate (45 CFR 160.103).

Before a business associate creates, receives, maintains, or transmits electronic protected health information for a covered entity, the covered entity must obtain satisfactory assurances, documented in a written contract or other arrangement, that the business associate will appropriately safeguard it. A business associate needs the same from its own subcontractors (164.308(b)). Under 164.314(a)(2)(i), the contract must provide that the business associate will:

Two government resources, both available to download from official sites, help with the risk analysis and the safeguards. Neither is a certification, and using them doesn't establish compliance on its own.

Whichever you use, the risk analysis still has to reflect your own systems, locations, and service providers, and it has to be documented and kept current as the rule requires.