HIPAA Technical Safeguards - What They Are & What's Required

Electronic protected health information (ePHI) is any individually identifiable health information created, stored, transmitted, or received in electronic form. This includes patient records in EHR systems, diagnostic images, lab results, insurance claims, appointment data, and any health data transmitted via email, mobile apps, or cloud platforms. If the information identifies a patient and exists digitally, HIPAA technical safeguards apply.

Who Must Comply?

HIPAA technical safeguards apply to covered entities—hospitals, clinics, dental practices, health insurance plans, and healthcare clearinghouses—and their business associates, including HealthTech SaaS vendors, cloud storage providers, and billing services.

The HHS Office for Civil Rights (OCR) enforces these requirements against both. A business associate agreement (BAA) does not transfer compliance responsibility — it shares it.

Why Do Technical Safeguards Matter?

Technical safeguard failures are the leading cause of healthcare data breaches in the United States. In 2023, the HHS OCR breach portal recorded 725 reported breaches affecting more than 133 million individuals — the highest volume ever. The majority involved hacking and IT incidents, precisely the attack vectors technical safeguards are designed to prevent.

OCR issued $7.735 million in enforcement settlements across 14 concluded investigations in 2023 alone, with many citing systemic failures in access control, audit monitoring, and risk analysis. Beyond financial penalties, breaches trigger mandatory notification requirements, severe reputational damage, and corrective action plans overseen closely by OCR for up to three years. 

What Does the HIPAA Security Rule Require?

Under 45 CFR § 164.312, technical safeguard requirements are divided into required and addressable implementation specifications.

• Required specifications must be implemented without exception.
• Addressable specifications must be implemented if reasonable and appropriate, or an equivalent alternative must be documented.

Under federal inflation adjustments enacted in early 2026, the financial stakes for non-compliance have reached record highs. The Department of HHS can impose civil monetary penalties that scale up to an annual cap of $2,190,294 per identical violation category. Even under lower culpability tiers, minimal adjustments now start at $145 per violation, while cases of uncorrected willful neglect command an automatic minimum penalty of $73,011.

In December 2024, HHS released a proposed Security Rule update that would make several previously addressable specifications — including encryption — required. Organizations should begin gap assessments now.

The Five HIPAA Technical Safeguards

The HIPAA Security Rule organizes technical safeguards into five standards. Together, these standards help organizations control access to ePHI, monitor system activity, verify user identities, protect data integrity, and secure electronic transmissions. 

1. Access Control — 45 CFR § 164.312(a)(1)

Access control requires technical policies that allow only authorized persons or software programs to access ePHI. The four implementation specifications are:

• Unique user identification (required): Every user must have a unique identifier for tracking system activity. Shared logins are a direct violation.
• Emergency access procedure (required): Procedures must exist to access ePHI during an emergency when normal controls may not function.
• Automatic logoff (addressable): Systems should terminate sessions after a period of inactivity to prevent access from unattended workstations.
• Encryption and decryption (addressable): ePHI stored on devices should be encrypted. Under the proposed 2024 amendments, encryption at rest would become required.
  

The principle of least privilege underpins access control — users should only access the ePHI necessary for their specific job function.

2. Audit Controls — 45 CFR § 164.312(b)

Audit controls require hardware, software, and procedural mechanisms to record and examine activity in systems that contain or use ePHI. This is a required standard, and organizations must determine what to audit and how.

Effective audit controls include:

• System activity logs capturing login attempts, file access, and data exports
• Automated alerts for anomalous activity—unusual hours, unrecognised IP addresses
• Regular log reviews by a designated security officer or IT team
• Retention of audit logs for a minimum of six years, per 45 CFR § 164.316(b)(2)
  

Retention of compliance documentation: While 45 CFR § 164.316(b)(2) strictly mandates keeping HIPAA administrative documentation and records of security actions for a minimum of six years, industry best practice applies this same timeframe to technical audit trails. Maintaining these logs securely for six years ensures your organization can produce historical evidence of system activity during a federal lookback investigation. 

Audit logs are the primary evidence OCR requests during breach investigations. Organizations without functioning audit controls cannot demonstrate what happened, when, or who was responsible.

3. Integrity Controls — 45 CFR § 164.312(c)(1)

Integrity controls require policies and procedures to protect ePHI from improper alteration or destruction. The addressable specification covers implementing electronic mechanisms to confirm that ePHI has not been altered or destroyed without authorization.

Mechanisms include file hashing, digital signatures, error-correcting protocols, and version control. These controls are critical in EHR environments, where altered records carry direct patient safety consequences—not just regulatory ones.

4. Person or Entity Authentication — 45 CFR § 164.312(d)

Authentication requires procedures to verify that the person or entity seeking access to ePHI is who they claim to be. This is a required standard. Common methods include:

• Passwords: Minimum complexity, regular rotation, and no reuse. NIST SP 800-63B provides current best-practice guidance.
• Multi-factor authentication (MFA): Requires two or more independent verification factors. OCR has cited MFA failures in multiple recent enforcement actions.
• Biometrics: Fingerprint scanning, facial recognition, or retinal scanning for high-risk access points.
  

HHS's proposed 2024 amendments would make MFA a required specification. Organizations that haven't deployed MFA across ePHI systems should treat this as an immediate priority.

5. Transmission Security — 45 CFR § 164.312(e)(1)

Transmission security requires technical measures to guard against unauthorized access to ePHI transmitted over electronic communications networks. Two implementation specifications apply:

• Integrity controls (addressable): Ensure transmitted ePHI is not improperly modified without detection.
• Encryption (addressable): Encrypt ePHI during transmission whenever appropriate. Under the 2024 proposed rule, this would become required.
  

Tools include TLS 1.2 or higher for web communications, VPNs for remote access, and secure messaging platforms. Standard consumer email—unencrypted Gmail or Outlook—does not meet transmission security standards for ePHI.

The Most Common HIPAA Technical Safeguard Mistakes

Most failures aren't the result of sophisticated attacks—they're predictable operational gaps.

Weak password and authentication practices. Many organizations still permit simple passwords and no MFA. OCR issued a $1.25 million settlement in 2023 that cited MFA failures as a contributing factor to a breach affecting 2.6 million individuals.

Shared user accounts. Shared logins directly violate the unique user identification requirement. They also make audit log analysis meaningless — if three nurses share one login, no one can determine who accessed which record and when.

Failure to encrypt ePHI. Unencrypted ePHI on laptops, USB drives, and mobile devices is one of the leading causes of HIPAA breach notifications. The HHS Breach Portal contains hundreds of incidents involving lost or stolen unencrypted devices.

Ignoring audit logs. Logs that are collected but never reviewed provide no security value. OCR expects an active monitoring program—not just the technical capability to generate logs.

Excessive access permissions. Over-permissioned accounts where staff can access far more ePHI than their role requires is a systemic least-privilege failure. Former employees with active credentials are one of the most avoidable breach scenarios in healthcare IT.

HIPAA Technical Safeguards Checklist

Before updating or implementing controls, conduct a formal HIPAA Security Rule risk analysis under 45 CFR § 164.308(a)(1). Then use this as your operational audit baseline:

✅ Assign unique user IDs to every system user. No shared accounts.

✅ Enable MFA on all ePHI systems — EHRs, email, cloud storage, remote access tools.

✅ Encrypt ePHI at rest (AES-256) and in transit (TLS 1.2 or higher).

✅ Review and adjust access permissions at least quarterly and upon every role change or departure.

✅ Monitor audit logs actively. Assign responsibility. Set automated alerts for high-risk activity.

✅ Patch systems promptly. Unpatched systems are a documented entry point in most healthcare ransomware incidents.

✅ Test data backups regularly. A backup never tested is not a reliable control.

✅ Deliver role-based security training — not a single annual all-staff video.

What Effective HIPAA Technical Safeguards Training Looks Like

Technology alone doesn't protect ePHI. Staff who share passwords, ignore phishing warnings, or bypass authentication steps undermine every technical control an organization has deployed.

The HIPAA Security Rule requires a security awareness and training program for all workforce members under 45 CFR § 164.308(a)(5), covering identification of malicious software, monitoring login attempts, and password management procedures.

Role-specific training matters. A clinical nurse's security responsibilities differ from those of an IT administrator or billing manager. Generic all-staff sessions fail to address the specific risks each role faces. OCR's audit protocols assess whether training is tailored — not just whether it occurred.

Annual refresher training keeps staff current as threats evolve and regulations update. Building a security-focused culture also requires leadership reinforcement. When CISOs, IT directors, and practice managers model correct security behavior, staff are more likely to apply those standards under pressure.