TL;DR
- The HIPAA technical safeguards in 45 CFR 164.312 set five standards: access control, audit controls, integrity, person or entity authentication, and transmission security.
- “Addressable” does not mean optional. Organizations must implement each addressable specification or document why an equivalent alternative is reasonable, and that decision must trace back to the risk analysis.
- HHS has proposed making encryption and MFA mandatory with limited exceptions. The rule is not final yet, but OCR already treats weak authentication and missing logs as signs of inadequate safeguards.
Healthcare data no longer sits in one EHR behind a hospital firewall. Electronic protected health information now moves across cloud platforms, patient portals, telehealth tools, billing vendors, and connected medical devices. Each new system creates another place where ePHI can be accessed, altered, or intercepted. The HIPAA technical safeguards define the controls that covered entities and business associates must apply to that data wherever it lives.
For security and compliance leaders, the harder task is proving that each safeguard is implemented, monitored, and backed by evidence that holds up in an OCR investigation. This guide explains the five standards, what each requires, and where programs fall short.
What Are HIPAA Technical Safeguards?
HIPAA technical safeguards are the technology controls, and the policies governing their use, that protect electronic protected health information (ePHI) and control who can access it. They are defined in 45 CFR 164.312 of the HIPAA Security Rule.
The Security Rule groups its requirements into administrative, physical, and technical safeguards. Administrative safeguards set governance and risk management. Physical safeguards protect facilities and devices. Technical safeguards operate inside systems and networks, which makes them the controls attackers test first. For a view of how the Security Rule fits with the Privacy and Breach Notification Rules, see our breakdown of HIPAA’s three rules.
The rule is technology-neutral, so each organization selects controls based on its size, infrastructure, and risk analysis.
What Are the 5 HIPAA Technical Safeguard Standards?
The five standards are access control, audit controls, integrity, person or entity authentication, and transmission security. Some carry implementation specifications labeled “required” (R) or “addressable” (A).
| Standard | Citation | Implementation Specifications |
| Access control | 164.312(a) | Unique user identification (R), Emergency access procedure (R), Automatic logoff (A), Encryption and decryption (A) |
| Audit controls | 164.312(b) | None; the standard itself is required |
| Integrity | 164.312(c) | Mechanism to authenticate ePHI (A) |
| Person or entity authentication | 164.312(d) | None; the standard itself is required |
| Transmission security | 164.312(e) | Integrity controls (A), Encryption (A) |
1. Access Control
Access control limits ePHI to the people and software programs that have been granted access rights. In practice, this means unique accounts for every user, role-based permissions aligned to the minimum necessary principle, documented break-glass procedures for emergencies, session timeouts on clinical workstations, and encryption of stored ePHI where reasonable.
2. Audit Controls
Audit controls require mechanisms that record and examine activity in systems containing ePHI. OCR expects logs to be reviewed, so centralized SIEM collection, defined retention, and alerting on abnormal access turn raw logs into a working control.
3. Integrity
The integrity standard protects ePHI from improper alteration or destruction. Organizations typically meet it with hashing, checksums, digital signatures, database change tracking, file integrity monitoring, and immutable backups that support recovery after ransomware.
4. Person or Entity Authentication
This standard requires verifying that a person or system seeking access is the one claimed. Passwords alone rarely satisfy a credible risk analysis today. Multi-factor authentication for remote access, privileged accounts, and cloud applications is now the expected baseline, and service accounts and API keys need the same scrutiny as human users.
5. Transmission Security
Transmission security guards ePHI against unauthorized access while it moves across electronic networks. Current practice includes TLS 1.2 or higher for web and API traffic, encrypted email or secure messaging for clinical communication, VPN or zero trust access for remote users, and integrity checks that detect tampering in transit.
Is Encryption Required Under HIPAA?
Under the current rule, encryption is an addressable specification, not an automatic requirement. That distinction is widely misunderstood. Under 164.306(d), an organization must implement an addressable specification if it is reasonable and appropriate. If it is not, the organization must document why and implement an equivalent alternative where reasonable.
For most organizations, encryption at rest and in transit is reasonable and appropriate. Encryption also matters after an incident. Under HHS breach guidance, ePHI encrypted in line with that guidance is not considered “unsecured,” which can remove breach notification obligations.
The proposed Security Rule update, published by HHS on January 6, 2025, would remove the required versus addressable distinction and mandate encryption and MFA with limited exceptions. It would also call for vulnerability scanning at least every six months and annual penetration testing. As of November 2026, the rule has not been finalized, and the federal regulatory agenda lists July 2027 as the target for final action.
How Should Organizations Implement HIPAA Technical Safeguards?
Implementation should start from the risk analysis, not a tool list:
- Map ePHI flows: Inventory every system, vendor, and integration that creates, receives, stores, or transmits ePHI.
- Run a current risk analysis: Assess threats and vulnerabilities for each asset, as required by 164.308(a)(1).
- Assign controls to each standard: Map identity, logging, encryption, and integrity tooling to the five standards.
- Decide addressable specifications in writing: Record whether each is implemented, replaced by an alternative, or not applicable, with the reasoning.
- Validate the controls: Use configuration reviews, access recertifications, vulnerability scans, and penetration tests to confirm controls work as designed.
- Monitor continuously: Review logs, alert on anomalous access, and reassess when systems or vendors change.
NIST SP 800-66 Rev. 2 offers detailed implementation guidance and maps Security Rule standards to NIST Cybersecurity Framework subcategories.
What Evidence Do Auditors Expect for Technical Safeguards?
Auditors and OCR investigators expect documentation showing each safeguard is designed, implemented, and operating. Security Rule documentation must be retained for six years under 164.316(b)(2). Typical evidence includes:
- User access lists, role definitions, and periodic access review records.
- Emergency access procedures and records of their use.
- Session timeout and MFA configuration exports.
- Encryption settings for databases, endpoints, backups, and data in transit.
- Audit log retention settings and records of log reviews or SIEM alerts.
- Integrity monitoring reports and backup restoration tests.
- Written decisions for each addressable specification.
What Are the Most Common Gaps in HIPAA Technical Safeguards?
The most common gaps are controls that exist on paper but are not enforced across the environment:
- Shared or generic accounts on clinical workstations and medical devices, which defeat unique user identification and audit trails.
- Logs that are collected but never reviewed, leaving audit controls unproven.
- Undocumented addressable decisions, where encryption was skipped without a written rationale.
- MFA gaps on legacy applications, vendor remote access, and service accounts.
- Business associate blind spots, where ePHI in a vendor’s cloud is assumed to be protected without verification.
- Stale risk analyses that do not reflect cloud migrations, new telehealth platforms, or AI tools.
These gaps also drive enforcement outcomes. Our guide to HIPAA penalties by tier explains how OCR weighs culpability when safeguards fail.
What Should Healthcare Organizations Do Next?
Organizations should validate their technical safeguards now rather than wait for the final rule. Encryption, MFA, and regular testing reduce breach and enforcement risk today.
Start with an independent gap assessment against all five standards, then prioritize remediation by risk. Ampcus Cyber’s HIPAA compliance services cover risk assessments, control validation, policy development, and ongoing compliance monitoring, helping teams move from documented intent to provable enforcement.
Conclusion
The HIPAA technical safeguards translate the Security Rule into controls that operate inside systems every day. Access control, audit controls, integrity, authentication, and transmission security only protect ePHI when they are enforced consistently and backed by evidence. Organizations that validate these controls now will be better prepared for audits, investigations, and the final rule.
Ready to find out how your ePHI controls would hold up under OCR scrutiny?
| Request a HIPAA technical safeguards gap assessment from Ampcus Cyber to identify gaps across all five standards and build a prioritized remediation plan. |
People Also Ask
What Are the 5 Technical Safeguards of HIPAA?
They are access control, audit controls, integrity, person or entity authentication, and transmission security, all set out in 45 CFR 164.312.
Does HIPAA Require Multi-Factor Authentication?
The current rule requires authentication but does not name MFA specifically. A risk analysis will usually show MFA is reasonable for remote, privileged, and cloud access. The proposed rule would make MFA mandatory with limited exceptions.
Can an Organization Skip an Addressable Safeguard?
Only with documented justification. It must show the specification is not reasonable and appropriate and implement an equivalent alternative where reasonable.
Do HIPAA Technical Safeguards Apply to Business Associates?
Yes. Business associates that handle ePHI must comply with the Security Rule directly, including all technical safeguards.
How Long Must HIPAA Audit Logs Be Kept?
The Security Rule does not set a specific log retention period. Organizations set one through their risk analysis, while required Security Rule documentation must be kept for six years.
Enjoyed reading this blog? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn.
