The HIPAA Security Rule explained without the jargon: what it protects, the three types of safeguards it requires, and the distinction that trips teams up most.
TL;DR
The HIPAA Security Rule sets the standards for protecting electronic protected health information (ePHI). It requires three kinds of safeguards, administrative, physical, and technical, that work together to keep health data secure.
Within those, specifications are either required or addressable. Addressable does not mean optional: you assess it and either implement it or justify a reasonable equivalent. Risk analysis is the foundation everything else builds on.
On this page
The HIPAA Security Rule, explained
The Security Rule is the part of HIPAA that deals specifically with electronic protected health information. Where the Privacy Rule governs how health information may be used and shared in any form, the Security Rule is narrower and more technical: it requires organisations to protect ePHI through concrete safeguards, and to keep those safeguards working as risks change. If your systems handle health data electronically, this is the rule that shapes most of your security work.
The three types of safeguards
The rule organises its requirements into three categories. None stands alone; together they cover people, places, and systems.
Administrative safeguards are the largest group and cover how you manage security: risk analysis, workforce training, and access management. Physical safeguards protect the places and devices where ePHI lives. Technical safeguards are the controls built into your systems, access control, encryption, audit logging, and integrity protection.
Required vs addressable: the distinction that trips teams up
Within each safeguard, individual specifications are labelled either required or addressable. This is the single most misunderstood part of the Security Rule, and getting it wrong is a common source of gaps.
The mistake is reading addressable as optional. It is not. An addressable specification still has to be assessed, and then either implemented or replaced with a documented, reasonable alternative that achieves the same protection. Ignoring it entirely is a compliance failure.
Where to start: risk analysis first
If the Security Rule feels large, there is a clear place to begin. Risk analysis is both an explicit requirement and the foundation the rest depends on, and it is the deficiency regulators cite most often. A thorough, current risk analysis tells you which safeguards matter most for your environment, so everything else becomes prioritised rather than guessed.
A note on the proposed 2025 update
A proposed update to the Security Rule was published in early 2025 and would strengthen technical requirements, making some previously addressable items explicit and adding measures around areas like risk analysis frequency. Importantly, it remains a proposed rule, not final law, and regulators continue to enforce the current Security Rule in the meantime. Building strong, modern technical controls now prepares you regardless of the final outcome.
The lean-team path to the Security Rule
Most of the Security Rule’s technical safeguards, and much of the administrative work like risk analysis and access management, come down to controls that must genuinely operate on your ePHI and be evidenced. Assembling those across separate tools is where teams lose time and leave gaps between systems.
Meet the Security Rule without the gaps.
Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Run the administrative and technical safeguards on one platform, with evidence collected automatically and mapped to HIPAA. No security team required.
Frequently asked questions
What is the HIPAA Security Rule?
It is the part of HIPAA that sets standards for protecting electronic protected health information (ePHI). It requires administrative, physical, and technical safeguards to keep health data confidential, intact, and available, and to keep those safeguards working as risks change.
What are the three types of HIPAA safeguards?
Administrative safeguards (risk analysis, training, access management), physical safeguards (facility, workstation, and device controls), and technical safeguards (access control, encryption, audit logging, and integrity). They work together across people, places, and systems.
What does addressable mean in the HIPAA Security Rule?
Addressable does not mean optional. It means you must assess the specification and then either implement it or document a reasonable equivalent that achieves the same protection. Ignoring an addressable specification is a compliance failure.
What is the most important part of the Security Rule?
Risk analysis. It is an explicit requirement, the foundation the other safeguards build on, and the deficiency regulators cite most often. A thorough, current risk analysis directs where the rest of your effort should go.
Is the HIPAA Security Rule changing?
A proposed update was published in early 2025 that would strengthen technical requirements. As of now it remains a proposed rule, not final law, and regulators continue to enforce the existing Security Rule. Building modern controls now prepares you either way.
Does the Security Rule require encryption?
Encryption is an addressable specification, which means you must assess it and either implement it or justify a reasonable equivalent. In practice, for ePHI in modern systems, encryption at rest and in transit is the expected approach.