The HIPAA Security Rule establishes national standards to protect individuals’ electronic protected health information (ePHI). It focuses on three key safeguard categories: administrative, physical, and technical.

A HIPAA violation occurs when ePHI is exposed due to failure to implement appropriate safeguards. Examples include lack of encryption, improper access controls, and missing risk assessments.

Administrative: Policies, procedures, and training

Physical: Facility access controls, device security

Technical: Access control, audit logs, encryption

HIPAA does not specify frequency, but OCR recommends conducting a risk analysis annually or when significant changes occur (e.g., new software, systems, or business associates).

It must identify:

- Potential risks to ePHI

- Current security measures

- Likelihood and impact of threats

- Remediation plans

While not mandatory, encryption is considered an addressable implementation specification under HIPAA. If not used, you must document why and implement an equivalent measure.

A Business Associate is any person or organization, other than a workforce member of a covered entity, that creates, receives, maintains, or transmits protected health information (PHI) on behalf of a covered entity for functions regulated by HIPAA.

Examples of business associates include:

Cloud storage providers that host ePHI

IT service providers with access to PHI

Billing companies and claims processors

Legal, accounting, or consulting firms handling PHI

Key requirement: Before a business associate can access PHI, they must sign a Business Associate Agreement (BAA) with the covered entity. The BAA requires them to:

Safeguard PHI according to HIPAA standards

Report breaches or security incidents

Ensure their subcontractors also comply

Without a signed BAA, sharing PHI is considered a HIPAA violation.

Yes. Business associates that handle ePHI must enter into a Business Associate Agreement (BAA) and implement HIPAA-compliant security controls.

Covered entities may still be liable. Both parties are required to mitigate the breach, notify affected individuals, and report to HHS.

- Use secure VPNs

- Enforce MFA (multi-factor authentication)

- Encrypt devices

- Disable local data storage on devices, especially personal ones

Yes, but only if you have BYOD (Bring Your Own Device) policies that enforce encryption, device management, and access controls.

Covered entities may still be liable. Both parties are required to mitigate the breach, notify affected individuals, and report to HHS.

A breach is any impermissible use or disclosure of ePHI that compromises privacy or security. Examples: ransomware, phishing, lost devices.

Fewer than 500: Within 60 days (60 days of the end of the calendar year in which the breach was discovered.)

More than 500: without unreasonable delay and in no case later than 60 calendar days from the discovery of the breach.

Full details: HIPAA Breach Notification Rule

Penalties range from $100 to $50,000 per violation, up to $1.5 million annually per type, depending on severity and willfulness.

Yes. HHS’ OCR conducts periodic audits and investigations randomly and especially after breaches or complaints.

Some of the documentation includes:

- Risk assessment reports

- Security policies and training logs

- Incident Response Plans

- BAAs

Penalties range from $100 to $50,000 per violation, up to $1.5 million annually per type, depending on severity and willfulness.