The Security rule

INTRODUCTION TO THE SECURITY RULE

 

The HIPAA Security Rule, which took effect in 2005, specifically addresses the protection of Electronic Protected Health Information (ePHI).

Key Differences: Privacy Rule vs. Security Rule

 

PRIVACY RULE:

 

• Covers ALL PHI (paper, electronic, verbal)
• Focuses on WHAT information is protected and WHO can access it
• About appropriate use and disclosure

SECURITY RULE:

 

• Covers ONLY ePHI (electronic PHI)
• Focuses on HOW to protect electronic information
• About safeguards and security measures

What is ePHI?

 

Electronic Protected Health Information includes:

• Information in Electronic Health Records (EHR)
• Patient data in practice management systems
• Email containing patient information

• Digital images and scans
• Data on portable devices (laptops, tablets, phones, USB drives)
• Electronic billing information
• Patient portals and online communications
• Backups and archived electronic data

Why the Security Rule Matters:

 

In today’s digital healthcare environment:

• 96% of hospitals use EHRs
• Telemedicine is exploding
• Cyberattacks on healthcare have increased 55% in recent years
• Healthcare data breaches affect millions of patients annually
• The average cost of a healthcare data breach is $10.93 million

**The Reality:** If you work in healthcare, you interact with ePHI every single day. Understanding security isn’t optional – it’s essential!

THE THREE TYPES OF SAFEGUARDS

 

The Security Rule requires covered entities to implement three types of safeguards:

1. **ADMINISTRATIVE SAFEGUARDS** (Policies and procedures)

2. **PHYSICAL SAFEGUARDS** (Protecting physical access to ePHI)

3. **TECHNICAL SAFEGUARDS** (Technology-based protection)

Standards vs. Implementation Specifications:

 

**Required Specifications:** MUST be implemented

**Addressable Specifications:** Must be implemented UNLESS:

• It’s not reasonable and appropriate for your organization, AND
• You document why, AND
• You implement an equivalent alternative measure “Addressable” does NOT mean “optional”!

ADMINISTRATIVE SAFEGUARDS

 

Administrative safeguards are the policies, procedures, and processes that manage security measures.

1.  SECURITY MANAGEMENT PROCESS (Required)

 

Risk Analysis (Required):

 

• Identify potential threats and vulnerabilities
• Assess current security measures
• Determine likelihood and impact of threats
• Document findings

Risk Management (Required):

 

• Implement security measures to reduce risks
• Prioritize based on likelihood and impact
• Regularly review and update measures

Sanction Policy (Required):

 

• Establish consequences for security violations
• Apply sanctions consistently
• Document enforcement actions

Example Sanctions:

 

• Verbal warning (first minor offense)
• Written warning
• Mandatory retraining
• Suspension
• Termination
• Criminal prosecution (for serious violations)

Information System Activity Review (Required):

 

• Regularly review system logs and access reports
• Monitor for unusual activity
• Investigate suspicious access patterns
• Document reviews

**Example:** Monthly review of audit logs showing who accessed what patient records, when, and for what purpose.

—

2.  ASSIGNED SECURITY RESPONSIBILITY (Required)

 

Every organization must designate a Security Officer responsible for:

• Developing and implementing security policies
• Conducting risk assessments
• Managing security incidents
• Training workforce
• Ensuring compliance

This can be one person or a team, but responsibility must be clearly assigned.

—

3.  WORKFORCE SECURITY (Required)

 

Authorization and Supervision (Addressable):

 

• Implement procedures for authorizing access to ePHI
• Supervise workforce members who access ePHI
• Ensure access is appropriate to job role

Workforce Clearance Procedures (Addressable):

 

• Screen employees before granting access
• Conduct background checks where appropriate
• Verify credentials and qualifications

Termination Procedures (Addressable):

 

• Immediately revoke access when employment ends
• Retrieve physical and electronic access credentials
• Disable passwords and security codes
• Recover organization-owned devices

**Critical:** Terminated employees with continued access are a MAJOR security risk!

—

4.  INFORMATION ACCESS MANAGEMENT (Required)

 

**Principle:** Users should have access ONLY to the ePHI they need to perform their job functions.

Role-Based Access Control:

 

• Define user roles (nurse, billing clerk, physician, )
• Assign permissions based on role
• Grant minimum necessary access
• Review access regularly

Examples:

 

FRONT DESK STAFF:

 

• Can access: Scheduling, demographics, insurance information

? Cannot access: Clinical notes, lab results, detailed medical history

BILLING DEPARTMENT:

 

• Can access: Diagnoses, procedures, insurance claims

? Cannot access: Detailed clinical notes, images, psychiatric records

PHYSICIANS:

 

• Can access: Comprehensive patient information for their patients

? Should not access: Records of patients they’re not treating

Access Authorization (Addressable):

 

• Formal process for granting access
• Written request and approval
• Documentation of granted access
• Regular access reviews and updates

Access Establishment and Modification (Addressable):

 

• Procedures for establishing user access
• Process for modifying access when job roles change
• Removing access when no longer needed

• Periodic access reviews (at least annually)

—

5.  SECURITY AWARENESS AND TRAINING (Required)

 

All workforce members must receive security training on: Security Reminders (Addressable):

• Periodic updates about security policies
• Reminders about security threats
• Updates on new vulnerabilities
• Best practice communications

Protection from Malicious Software (Addressable):

 

• Recognizing phishing emails
• Avoiding suspicious links and attachments
• Not downloading unauthorized software
• Reporting suspicious activity

Log-in Monitoring (Addressable):

 

• Understanding importance of logging out
• Recognizing unauthorized access attempts
• Monitoring own account activity
• Reporting suspicious log-ins

Password Management (Addressable):

 

• Creating strong passwords
• Never sharing passwords
• Changing passwords regularly
• Using password managers when appropriate

Training Frequency:

 

• Initial training before access is granted
• Annual refresher training (minimum)
• Training when policies change

• Immediate training after incidents

—

6.  SECURITY INCIDENT PROCEDURES (Required)

 

Incident Response Plan:

 

Organizations must have documented procedures to:

• Identify security incidents
• Respond to incidents
• Mitigate harmful effects
• Document incidents and responses

What Constitutes a Security Incident?

 

• Unauthorized access to ePHI
• Lost or stolen devices containing ePHI
• Malware infections affecting systems with ePHI
• Phishing attacks targeting healthcare staff
• Ransomware attacks
• Unauthorized disclosure of ePHI
• System breaches or hacks

Your Responsibilities:

 

1. Recognize potential incidents

2. Report immediately to security officer

3. Do NOT attempt to handle alone

4. Preserve evidence

5. Document what happened

Example Incident Response:

 

Employee reports laptop stolen from car:

• Immediately report to security officer
• File police report

—

• Determine what ePHI was on laptop
• Assess if data was encrypted
• Conduct breach analysis
• Notify affected patients if required
• Implement preventive measures

7.  CONTINGENCY PLAN (Required)

 

Organizations must have plans for emergencies and disasters:

Data Backup Plan (Required):

 

• Regular backups of ePHI
• Secure backup storage
• Testing of backup restoration
• Off-site backup storage

Disaster Recovery Plan (Required):

 

• Procedures to restore systems after emergency
• Priority systems identification
• Recovery time objectives
• Alternative processing sites if needed

Emergency Mode Operation Plan (Required):

 

• Procedures for operating during emergencies
• Manual backup processes
• Critical system priorities
• Communication protocols

Examples:

 

• Hurricane damages facility – how to access patient data?
• Ransomware locks systems – how to continue care?
• Power outage – what systems have priority restoration?

Testing and Revision (Addressable):

 

 

 

 

 

 

 

 

—

• Regularly test contingency plans
• Conduct drills and simulations
• Update plans based on testing
• Document test results

8.  EVALUATION (Required)

 

Organizations must:

• Conduct periodic technical and non-technical evaluations
• Assess security controls and policies
• Test compliance with Security Rule
• Document evaluation findings
• Implement corrective actions

**Frequency:** At least annually and whenever the environment changes significantly.

—

9.  BUSINESS ASSOCIATE CONTRACTS (Required)

 

When working with business associates who handle ePHI:

• Written contract or agreement REQUIRED
• Must specify security responsibilities
• Business associate must agree to safeguard ePHI
• Must allow termination if breach occurs

Who are Business Associates?

 

• Medical billing companies
• Cloud storage providers
• EHR vendors
• Shredding companies
• IT service providers
• Legal and accounting firms handling ePHI
• Email/communication service providers

PHYSICAL SAFEGUARDS

 

Physical safeguards protect physical access to electronic systems, equipment, and facilities containing ePHI.

1.  FACILITY ACCESS CONTROLS (Required)

 

Controlling physical access to facilities where ePHI is stored or accessed. Contingency Operations (Addressable):

• Procedures for physical access during emergencies
• Alternative access methods during disasters
• Securing facilities during evacuations

Facility Security Plan (Addressable):

 

• Safeguards to protect facility from unauthorized access
• May include:
• Badge access systems
• Security guards
• Locked doors
• Security cameras
• Visitor logs
• Escort requirements for visitors

Access Control and Validation Procedures (Addressable):

 

• Procedures for granting facility access
• Visitor sign-in procedures
• Validating authorized access
• Removing access when no longer needed

Maintenance Records (Addressable):

 

• Document repairs and modifications to physical security
• Track who accessed secure areas for maintenance
• Log any security component changes

Real-World Examples:

 

? GOOD PRACTICES:

 

• Server room requires badge access and is locked
• Visitors must sign in and wear badges
• Workstations in locked offices after hours
• Security cameras in areas with ePHI access
• Cleaning crews supervised when in areas with ePHI

? VIOLATIONS:

 

 

 

 

 

 

 

 

 

 

 

—

• Server room door propped open for convenience
• No visitor log or badges
• Leaving building unlocked with computers on
• Allowing unauthorized persons in secure areas
• No tracking of who enters sensitive areas

2.  WORKSTATION USE (Required)

 

Policies specifying the proper functions and physical attributes of workstations that access ePHI.

Workstation Use Policy Should Address:

 

• Where workstations can be located
• Who can use workstations
• What activities are permitted
• Physical positioning to prevent unauthorized viewing
• Automatic log-off after inactivity
• Prohibition of personal use
• Clean desk policies

Examples:

 

? COMPLIANT:

 

• Workstations positioned so screens not visible to public
• Privacy screens on monitors in public areas

• Automatic screen lock after 5 minutes of inactivity
• Prohibition of ePHI access on personal devices
• Clear desk policy – no patient information left visible

? NON-COMPLIANT:

 

 

 

 

 

 

 

 

 

 

 

—

• Computer screens visible from waiting room
• No automatic screen lock
• Accessing ePHI on personal phones/tablets
• Patient charts and papers left on desk overnight
• Using hospital computers for personal activities

3.  WORKSTATION SECURITY (Required)

 

Physical safeguards to protect workstations from unauthorized access.

Safeguards May Include:

 

• Cable locks for laptops
• Locked offices or cabinets
• Positioning away from public areas
• Privacy screens
• Secure areas for workstation storage
• Physical barriers to prevent tampering

Mobile Workstations (Laptops, Tablets):

 

 

 

 

 

 

 

 

 

 

 

 

—

• Must be secured when not in use
• Encryption required
• Strong password protection
• Remote wipe capability
• Physical locks when possible
• Never left unattended in vehicles

4.  DEVICE AND MEDIA CONTROLS (Required)

 

Disposal (Required):

 

Procedures for disposing of ePHI and hardware/media containing ePHI.

Proper Disposal Methods:

 

• SHREDDING: Paper records, CDs, printouts
• DEGAUSSING: Magnetic media (hard drives, tapes)
• PHYSICAL DESTRUCTION: Hard drives, USB drives, mobile devices
• SECURE ERASURE: Software-based data wiping (must be DOD-compliant)
• CERTIFIED DESTRUCTION: Third-party services with certificate of destruction

What Must Be Disposed Properly:

 

• Old hard drives
• Backup tapes
• CDs/DVDs with ePHI
• USB flash drives
• Smartphones and tablets
• Copiers (have hard drives!)
• Fax machines with memory
• Printouts of ePHI

Media Re-use (Required):

 

Before re-using media that contained ePHI:

• Complete data sanitization
• Verification that data is unrecoverable
• Documentation of sanitization process

Accountability (Addressable):

 

• Maintain inventory of hardware and media
• Track movement of devices
• Log disposal of devices
• Document chain of custody

Data Backup and Storage (Addressable):

 

• Create retrievable exact copies of ePHI before movement
• Secure backup storage
• Encryption of backups
• Off-site backup storage

Real-World Disaster:

 

A hospital threw old computers in a dumpster. A journalist found them, recovered patient data from the hard drives, and published a story. The hospital was fined $800,000. The computers should have had drives physically destroyed!

TECHNICAL SAFEGUARDS

 

Technical safeguards are technology-based measures to protect ePHI.

1.  ACCESS CONTROL (Required)

 

Unique User Identification (Required):

 

Every user must have unique credentials (username/ID).

Why It Matters:

 

• Accountability for actions
• Audit trail accuracy
• Access management
• Incident investigation

**PROHIBITED:**

 

? Shared passwords or logins

? Generic accounts (e.g., “Front Desk” login)

? Using someone else’s credentials

? Sharing your credentials with others

Emergency Access Procedure (Required): Procedures for obtaining ePHI during an emergency. Examples:

• “Break glass” accounts for emergencies

• Documented emergency access procedures
• After-the-fact review of emergency access
• Time-limited emergency credentials

Automatic Logoff (Addressable):

 

Electronic sessions that have been inactive for a predetermined time automatically terminate.

Typical Settings:

 

• 5-15 minutes for clinical workstations
• Shorter for high-risk areas
• Balance security with workflow

Encryption and Decryption (Addressable):

 

Mechanism to encrypt and decrypt ePHI.

When Encryption is Critical:

 

• Laptops and mobile devices
• Email containing ePHI
• Removable media (USB drives)
• Wireless networks
• Data in transit
• Backup media

Encryption Standards:

 

• AES-256 (Advanced Encryption Standard)
• Full disk encryption for devices
• Email encryption (S/MIME, TLS)
• VPN for remote access

**Important:** While technically “addressable,” encryption is considered the standard of care. NOT encrypting portable devices that are then lost/stolen will likely result in a breach notification requirement!

—

2.  AUDIT CONTROLS (Required)

 

Mechanisms to record and examine activity in systems containing ePHI.

What Should Be Logged:

 

• User log-ins and log-offs
• Access to patient records
• Changes to ePHI
• Creation and deletion of records
• Failed access attempts
• System configuration changes
• Administrative actions

Log Review:

 

• Regular review of audit logs
• Looking for unusual patterns
• Investigating suspicious activity
• Documenting reviews

Red Flags in Audit Logs:

 

[!] Employee accessing large numbers of records [!] Access to records outside work hours

[!] Multiple failed login attempts

[!] Access to records of celebrities, neighbors, family [!] Unusual data exports or downloads

[!] Access from unusual locations

Real Case:

 

Hospital employee accessed records of 1,000+ patients over 6 months. Audit logs revealed the pattern. Employee was terminated and prosecuted. This shows why audit controls matter!

—

3.  INTEGRITY (Required)

 

Mechanism to Authenticate ePHI (Addressable):

 

Ensuring ePHI has not been altered or destroyed in unauthorized manner.

Methods:

 

• Digital signatures
• Checksums and hash functions
• Version control
• Tamper-evident logs
• Access controls preventing unauthorized changes

Examples:

 

 

 

 

 

 

 

 

 

—

• Electronic signatures on documents
• Audit trails showing who made what changes when
• Systems that prevent backdating or changing entries
• Alerts when records are modified

4.  PERSON OR ENTITY AUTHENTICATION (Required)

 

Verify that a person or entity seeking access is who they claim to be.

Authentication Methods:

 

Single-Factor Authentication:

 

• Something you know (password)
• Something you have (security token, smart card)
• Something you are (biometric – fingerprint, facial recognition)

Multi-Factor Authentication (MFA):

 

Combines two or more factors – STRONGLY RECOMMENDED!

Examples:

 

• Password + security code sent to phone
• Badge + PIN number
• Fingerprint + password

Password Best Practices:

 

• Minimum 8 characters (longer is better)
• Combination of upper/lowercase, numbers, symbols
• Unique passwords for different systems
• Regular password changes (every 60-90 days)
• Never written down or shared
• Use password managers when appropriate

? WEAK PASSWORDS TO AVOID:

 

 

 

 

 

 

 

 

 

 

 

—

• “Password123”
• Birth dates or names
• Consecutive numbers (12345)
• Common words (healthcare, hospital)
• Unchanged default passwords

5.  TRANSMISSION SECURITY (Required)

 

Integrity Controls (Addressable):

 

Ensure ePHI is not improperly modified during transmission.

Encryption (Addressable):

 

Encrypt ePHI being transmitted over electronic networks.

When Transmission Security is Critical:

 

• Email with patient information
• Faxes (use encrypted fax solutions)
• File transfers
• Remote access to systems
• Cloud storage synchronization
• Mobile device communications
• Telemedicine sessions

Secure Transmission Methods:

 

• Encrypted email (TLS, S/MIME)
• Secure file transfer protocol (SFTP)
• Virtual Private Networks (VPN)
• Secure patient portals
• HTTPS websites (not HTTP)
• Encrypted messaging apps (HIPAA-compliant)

? INSECURE METHODS:

 

• Regular unencrypted email
• Text messages (standard SMS)
• Public WiFi without VPN
• HTTP websites
• Unencrypted fax
• Consumer file sharing (Dropbox, Google Drive without BAA)

KEY TAKEAWAYS

 

• The Security Rule applies specifically to Electronic PHI (ePHI)
• Three types of safeguards are required: Administrative, Physical, and Technical
• “Addressable” does NOT mean “optional” – you must implement or document why not and implement alternatives
• Encryption is critical for portable devices and data transmission
• Every user must have unique credentials – no sharing passwords!
• Audit logs must be maintained and reviewed regularly
• Physical security (locked doors, badge access) is as important as technical security
• Employees are both the weakest link and the strongest defense
• Report security incidents immediately – don’t try to handle alone
• Security is everyone’s responsibility, every day