The Security Rule has 18 standards and 54 implementation specifications across administrative, physical, and technical safeguards. Security Rule Controls binds every one of them to a named control, an owner, and live evidence — so posture is a fact rather than a claim.
What it does
- Maps every §164 Subpart C standard and implementation specification to a control with an ID, a scope, and an owner.
- Captures the §164.306(d) rationale for every addressable specification: implemented, equivalent alternative, or documented reason not to.
- Tracks the current rule and the proposed rule (RIN 0945-AA22) side-by-side.
- Feeds the evidence store, the compliance score, and the readiness report with the same control objects.
How it maps to HIPAA
The control library spans §164.308 (administrative), §164.310 (physical), §164.312 (technical), §164.314 (organisational), and §164.316 (policies and documentation). Each control is mapped to its citation, so a reviewer can jump from §164.312(a)(2)(i) to the control, the owner, and the evidence in one path.
Where it fits
Security Rule Controls is the backbone of the Security module. The plain-language overview is the HIPAA Security Rule guide; the artefacts controls produce live in Evidence Management.