Administrative safeguards are the policies, processes and people-side controls the HIPAA Security Rule requires. They are the largest of the three families.
The short answer
Administrative safeguards are the nine Security Rule standards covering how an organisation manages security: risk analysis, assigned responsibility, workforce access, training, incident response, contingency planning, periodic evaluation and business associate contracts. They account for more of the rule than the physical and technical families combined, and they are where most enforcement findings land.
They are also the ones engineering teams skip, because none of them are shipped as code. A perfectly encrypted system with no risk analysis and no offboarding process still fails.
On this page
The nine standards
| Standard | What it asks for |
|---|---|
| Security management process | Risk analysis, risk management, sanctions policy, information system activity review |
| Assigned security responsibility | A named security official accountable for the programme |
| Workforce security | Authorisation, supervision, clearance and termination procedures |
| Information access management | Access authorised, established and modified according to role |
| Security awareness and training | Reminders, malware protection, login monitoring, password management |
| Security incident procedures | Identify, respond to, mitigate and document incidents |
| Contingency plan | Backups, disaster recovery, emergency mode operation, testing |
| Evaluation | Periodic reassessment as the environment changes |
| Business associate contracts | Written assurances from every vendor handling ePHI |
Security management process
Information system activity review is the one caught most often. Collecting logs satisfies the technical safeguard; this standard requires somebody to actually look at them on a defined cadence and record that they did.
Workforce security and access
Termination procedures are the recurring finding
Access must be removed when someone leaves or changes role. Investigators routinely find active accounts belonging to people who departed months earlier. It is a process failure that a joiner-mover-leaver checklist and periodic access review would prevent.
Information access management pairs with this: access is granted by role, using the minimum necessary standard, and modified when the role changes rather than accumulating.
Contingency planning
Data backup plan
Retrievable exact copies of ePHI. Required, not addressable.
Disaster recovery
Documented restoration of lost data. Required.
Testing and revision
Addressable, and the one that turns a plan into something that works.
Availability is part of the Security Rule, not a separate concern. A ransomware event that makes records unreachable is a security failure under the rule even if nothing was exfiltrated.
How Osto covers them
Administrative safeguards are process plus evidence. Osto supplies both sides: AI policy generation and built-in security awareness training for the documentation, and live control data for the proof. Access management records authorisation and removal, SIEM supports activity review with correlated logs, and testing and posture monitoring feed the periodic evaluation the rule expects.
Free security assessment
Policies, training and the proof they happened
AI policy generation and built-in awareness training, backed by live control data for activity review and evaluation.
Get a free security assessment Book a platform walkthroughDocumentation plus evidence · HIPAA mapped · One platform, everything
Frequently asked questions
What are administrative safeguards under HIPAA?
The nine Security Rule standards covering how an organisation manages security: risk analysis, assigned responsibility, workforce security, access management, training, incident procedures, contingency planning, evaluation and business associate contracts.
How many administrative safeguards are there?
Nine standards, each with its own implementation specifications marked required or addressable. It is the largest of the three safeguard families in the Security Rule.
Is a risk analysis an administrative safeguard?
Yes, and it is a required specification under the security management process standard. It is also the most frequently cited failure in HIPAA enforcement actions.
Is security awareness training required?
The training standard itself is required, though its individual specifications are addressable. Regulators expect documented, periodic training for all workforce members with access to ePHI, not a one-time induction.
What is the difference between administrative and technical safeguards?
Administrative safeguards govern people and process: policies, training, responsibility and planning. Technical safeguards govern the systems: authentication, encryption, audit controls and transmission security.