HIPAA Safeguards Explained: Administrative, Physical, and Technical Requirements

The HIPAA Security Rule defines three categories of safeguards for electronic protected health information (ePHI). They are administrative safeguards at 45 CFR § 164.308, physical safeguards at § 164.310, and technical safeguards at § 164.312. Administrative safeguards cover risk analysis, workforce management, training, and contingency planning. Physical safeguards cover facilities, workstations, and media. Technical safeguards cover access control, audit logging, integrity, authentication, and transmission security. Every covered entity and business associate must address all three, scaled to its size and risk under the flexibility provision at § 164.306(b).

TL;DR: Quick answer

• The three safeguard categories sit in 45 CFR § 164.308 (administrative), § 164.310 (physical), and § 164.312 (technical). They bind covered entities and business associates alike.
• Most standards carry implementation specifications labeled "required" or "addressable". Under § 164.306(d), addressable does not mean optional. You implement it, or document why it is not reasonable and appropriate and adopt an equivalent measure where reasonable.
• The risk analysis required by § 164.308(a)(1)(ii)(A) is the foundation of the whole program. OCR runs an enforcement effort aimed at it, the Risk Analysis Initiative, and its 14th action came in June 2026.
• Keep Security Rule documentation, including policies and the risk analysis, for six years. The clock runs from creation or the date it was last in effect, whichever is later (§ 164.316(b)(2)(i)).
• HHS proposed the first major Security Rule update since 2013 on January 6, 2025. It would make all implementation specifications required, with limited exceptions. It is still a proposal, and the federal regulatory agenda now targets a final rule in July 2027. Proposed requirements are not law yet; the current Security Rule still applies.

What are the administrative safeguards in 45 CFR § 164.308?

Administrative safeguards are the management layer: the policies, people, and processes that run a security program. The standards, with their key implementation specifications:

• Security management process, § 164.308(a)(1). Includes risk analysis (required), risk management (required), a sanction policy (required), and information system activity review (required). The risk analysis is the foundation document, and an absent or generic one undermines everything built on top of it. OCR runs a Risk Analysis Initiative aimed at this requirement; its 14th enforcement action came in June 2026. Before drafting the sanction policy, it helps to know what sanctions look like in real cases.
• Assigned security responsibility, § 164.308(a)(2). One identified security official, by name, not a committee.
• Workforce security, § 164.308(a)(3). Authorization, clearance, and termination procedures (all addressable). Terminated-employee accounts that stay active are a classic finding; see our roundup of unintentional HIPAA violations.
• Information access management, § 164.308(a)(4). Policies for authorizing access in line with the Privacy Rule, so each person gets only the access their job needs. Access authorization and access establishment and modification are addressable. Isolating health care clearinghouse functions is required when a clearinghouse is part of a larger organization.
• Security awareness and training, § 164.308(a)(5). Reminders, malware protection, login monitoring, and password management (all addressable, all expected in practice).
• Security incident procedures, § 164.308(a)(6). Response and reporting (required).
• Contingency plan, § 164.308(a)(7). Data backup plan, disaster recovery plan, and emergency mode operation plan are all required. Testing and revision procedures and an applications and data criticality analysis are addressable.
• Evaluation, § 164.308(a)(8). Periodic technical and nontechnical review.
• Business associate contracts, § 164.308(b). A written BAA meeting § 164.314(a) and the Privacy Rule terms at § 164.504(e), in place before a vendor handles ePHI for you. Our guide to the HIPAA business associate agreement covers what the contract must say.

What are the physical safeguards in 45 CFR § 164.310?

Physical safeguards protect the places and hardware where ePHI lives:

• Facility access controls, § 164.310(a). Contingency operations, a facility security plan, access control and validation, and maintenance records (all addressable). For cloud-hosted ePHI, these are largely inherited from the data center operator. AWS, for example, says it controls everything from the host operating system and virtualization layer down to the physical security of its facilities. On Amazon EC2, the customer manages the guest operating system, applications and security group firewall.
• Workstation use and workstation security, § 164.310(b) and (c). Policies for how and where ePHI-touching machines are used and physically protected.
• Device and media controls, § 164.310(d). Disposal and media re-use are required; accountability and data backup before movement are addressable. In August 2013, Affinity Health Plan agreed to pay $1,215,780 to settle potential HIPAA violations with HHS. It had returned photocopiers to a leasing agent without erasing their hard drives, exposing PHI of up to 344,579 people.

What are the technical safeguards in 45 CFR § 164.312?

Technical safeguards are the controls implemented in software and hardware:

• Access control, § 164.312(a)(1). Unique user identification, § 164.312(a)(2)(i), is required. Emergency access procedure, (a)(2)(ii), is required. Automatic logoff, (a)(2)(iii), is addressable. See HIPAA automatic logoff for the timeout details. Encryption and decryption, (a)(2)(iv), is addressable; it is commonly treated as the at-rest specification.
• Audit controls, § 164.312(b). Required. Mechanisms that record and allow examination of activity in systems containing ePHI. In practice that means HIPAA audit logs, plus decisions on what they record, how long they are kept, and who holds them. The standard sets no retention period for the logs themselves. Many organizations keep logs for six years to line up with the documentation rule.
• Integrity, § 164.312(c). Mechanisms to detect improper alteration or destruction (addressable).
• Person or entity authentication, § 164.312(d). Required. Verify that the person seeking access is who they claim.
• Transmission security, § 164.312(e)(1). Integrity controls, (e)(2)(i), and encryption in transit, (e)(2)(ii), are both addressable.

What does "addressable" actually mean under § 164.306(d)?

Addressable is the most misread word in the Security Rule. Under 45 CFR § 164.306(d), an addressable specification must be implemented if reasonable and appropriate. If not, the organization must document why, and implement an equivalent alternative where reasonable. Skipping encryption with no documented analysis satisfies neither path. In practice, encryption at rest and in transit is treated as a baseline because it is cheap and widely available. It also changes what a lost device or stolen file means. PHI encrypted in line with HHS guidance is not "unsecured" PHI under § 164.402, so losing it generally does not trigger breach notification.

One forward-looking note: HHS announced a Security Rule update on December 27, 2024 and published it in the Federal Register on January 6, 2025. It would remove the required versus addressable distinction. It would also require encryption and multifactor authentication (MFA), with limited exceptions, plus a written technology asset inventory and network map. Comments closed March 7, 2025, after 4,747 public comments, per the Federal Register. It is still a proposal, and the federal regulatory agenda now targets a final rule in July 2027. Proposed requirements are not law yet; the current Security Rule still applies.

How does each safeguard map to a hosting control?

For organizations whose ePHI lives on web infrastructure, the table below maps each safeguard to a typical hosting control. It is a generic mapping of common practice, not any one provider's feature list. If you searched "HIPAA safeguards administrative physical technical" to see each rule on a real server, this is the short answer.

The full technical detail sits in our companion piece on HIPAA hosting security measures, and our explainer on what compliant hosting services actually include.

For ePHI that needs a single-tenant home, our ePHI hosting runs on single-tenant AWS under a BAA. Every plan includes encryption at rest and in transit, six-year audit logging, tested encrypted backups and EBS storage with 7-day snapshot retention. Those features relate to the encryption, transmission security, audit controls and contingency plan safeguards. The table is a general guide, not a list of what our plans include.

How do the Privacy Rule and documentation requirements fit in?

The HIPAA safeguards administrative physical technical framework comes from the Security Rule, which governs how ePHI is protected. The separate Privacy Rule governs who may use and disclose PHI and grants patients rights such as access to their records. The Breach Notification Rule sits at 45 CFR §§ 164.400-414. Individuals must be notified without unreasonable delay and no later than 60 calendar days after a breach of unsecured PHI is discovered (§ 164.404). Notice to HHS depends on size. Breaches affecting 500 or more people go to HHS at the same time as individual notice. Smaller ones are logged and reported within 60 days after the calendar year ends (§ 164.408). Underpinning all of it, § 164.316(b)(2)(i) requires policies, procedures, and required documentation to be kept for 6 years from creation or last effective date. Failures in any layer feed the civil penalty tiers, which for 2026 run from $145 to $2,190,294 per violation.

Frequently asked questions

What are the three HIPAA safeguards?

Administrative safeguards (45 CFR § 164.308), physical safeguards (§ 164.310), and technical safeguards (§ 164.312). All three are part of the HIPAA Security Rule. They apply to covered entities and business associates alike.

Is encryption required under HIPAA?

Encryption at rest (§ 164.312(a)(2)(iv)) and in transit (§ 164.312(e)(2)(ii)) are addressable specifications. Under § 164.306(d), you implement them where reasonable and appropriate, or document why not and adopt an equivalent measure where reasonable. HHS said in its 2025 proposal that regulated entities should already encrypt ePHI in most circumstances. That proposal would make encryption mandatory, with limited exceptions. Proposed requirements are not law yet; the current Security Rule still applies.

What is the difference between required and addressable specifications?

Required specifications must be implemented as written. Addressable specifications must be implemented if reasonable and appropriate; otherwise the organization documents why and adopts an equivalent measure where reasonable. Neither label permits silently skipping a control.

Do business associates have to meet all three safeguard categories?

Yes. Since the 2013 Omnibus Rule, business associates are directly liable for Security Rule compliance, including hosting providers, software vendors, and agencies that handle ePHI.

How long must HIPAA security documentation be kept?

Six years from creation or the date it was last in effect, under 45 CFR § 164.316(b)(2)(i). That includes the risk analysis, policies, and records of addressable-specification decisions.

Where to go from here

Start with the risk analysis, then work each safeguard category against your actual infrastructure. Turn the lists above into one HIPAA safeguards administrative physical technical checklist, with an owner and evidence for each standard. For the infrastructure half of that work, see our complete guide to HIPAA-compliant hosting.

If you want the hosting layer run for you, our managed HIPAA cloud hosting puts your site or app on single-tenant AWS. We sign a BAA within 24 hours of signup, before patient data moves. Every plan also includes a web application firewall and CloudFront CDN. Managed plans start at $229 a month. Plans are monthly, with no long-term contract. See our pricing page for all six sizes, from Starter to Network. Our BAA covers the servers and services we run. Your risk analysis, policies and workforce training stay with you. Managed HIPAA hosting is our business, so weigh the recommendation accordingly.

This article is general information, not legal advice. Consult qualified counsel and base your safeguards on a documented risk analysis specific to your organization. Reviewed October 2026.

Sources

• 45 CFR § 164.308, Administrative safeguards (eCFR)
• 45 CFR § 164.310, Physical safeguards (eCFR)
• 45 CFR § 164.312, Technical safeguards (eCFR)
• 45 CFR § 164.306, Security standards: general rules (eCFR)
• HHS: The Security Rule
• Federal Register: HIPAA Security Rule NPRM (Jan. 6, 2025)
• Unified Agenda: RIN 0945-AA22, final action July 2027 (checked October 20, 2026)
• 45 CFR § 164.314, Business associate contracts (LII)
• 45 CFR § 164.316, Documentation and retention (LII)
• 45 CFR § 164.402, Definition of unsecured PHI (LII)
• 45 CFR § 164.404, Notice to individuals (LII)
• 45 CFR § 164.408, Notice to the Secretary (LII)
• 45 CFR § 102.3, Civil monetary penalty amounts (LII)
• HHS: 14th Risk Analysis Initiative action (June 18, 2026)
• HHS: Affinity Health Plan photocopier case (2013)
• AWS: Shared Responsibility Model