HIPAA Glossary · Laws & rules
Security Rule
The HIPAA regulation requiring administrative, physical, and technical safeguards for ePHI.
Context
The Security Rule lives at 45 CFR Part 164 Subpart C. It applies to ePHI only (paper is governed by the Privacy Rule's safeguard requirements), structured around three safeguard categories, 18 standards, and 54 implementation specifications. See [the Security Rule guide](/guides/hipaa-security-rule/) and the [proposed rule post](/blog/hipaa-security-rule-update/) for the current and forthcoming shape of the rule.
Related terms
- ePHI — PHI in electronic form — the subset the Security Rule protects.
- Administrative safeguards — The management layer of the Security Rule — risk analysis, workforce security, training, incident procedures, contingency planning, evaluation.
- Physical safeguards — Facility access controls, workstation security, and device and media controls, including disposal.
- Technical safeguards — Access control, audit controls, integrity, authentication, and transmission security for ePHI.
- Required vs addressable — Every Security Rule implementation specification is one or the other. Addressable never means optional.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.