Technical safeguards are the five HIPAA Security Rule standards that govern the systems holding electronic protected health information.
The short answer
Technical safeguards are access control, audit controls, integrity, person or entity authentication, and transmission security. They cover who can reach ePHI, what gets recorded when they do, whether the data can be altered undetected, how identity is proven, and how data is protected in motion. The rule states outcomes rather than technologies.
For an engineering team this is the most familiar family. Most of it is ordinary practice, documented properly and evidenced.
On this page
The five standards
Access control in detail
| Specification | What it means |
|---|---|
| Unique user identification (required) | Every person has their own account. Shared logins break the audit trail and are a standing violation |
| Emergency access procedure (required) | A documented way to reach ePHI during an outage or crisis, with the use logged |
| Automatic logoff (addressable) | Sessions terminate after inactivity |
| Encryption and decryption (addressable) | Encryption at rest, or a documented equivalent |
Shared accounts are the quiet failure
A single admin login used by three engineers defeats unique identification and audit controls at once. When an investigator asks who accessed a record, “the ops account” is not an answer.
Audit controls
Required, with no addressable escape. You need hardware, software or procedural mechanisms that record and examine activity in systems containing ePHI. Two halves matter: recording, and examining. Logs written to a bucket nobody opens satisfy half a requirement.
Retention is not fixed by the Security Rule itself, though HIPAA documentation requirements run to six years and most organisations align log retention with that.
Transmission security
Integrity controls
Detect whether ePHI was altered in transit. TLS provides this as part of the protocol.
Encryption
Addressable, but expected. Modern TLS on every path carrying ePHI, internal ones included.
Internal traffic counts
Service-to-service calls inside a VPC still transmit ePHI and are frequently overlooked.
How Osto implements them
Four of the five standards are infrastructure Osto runs directly. Identity, unique accounts, MFA and session control cover access control and authentication. SIEM with cross-module correlation covers audit controls including the review half, not just collection. Encryption and ZTNA cover transmission security, and cloud posture flags a storage bucket or database that drifts out of policy.
Free security assessment
Four of five standards, running out of the box
Unique identity and MFA, audit controls with real review, encryption and transmission security in one integrated stack.
Get a free security assessment Book a platform walkthroughAccess, logging, encryption · Cloud posture · One platform, everything
Frequently asked questions
What are technical safeguards under HIPAA?
The five Security Rule standards governing systems that hold ePHI: access control, audit controls, integrity, person or entity authentication, and transmission security.
Is MFA required under HIPAA?
The rule requires authentication but does not name multi-factor specifically. In practice MFA is the expected implementation, and regulators and cyber insurers treat its absence as a significant weakness.
Are audit logs required?
Yes. Audit controls is a required standard with no addressable alternative. You must both record activity in systems containing ePHI and examine those records, not merely retain them.
Does HIPAA require encryption in transit?
It is addressable rather than required, meaning you must implement it or document why an equivalent alternative is reasonable. Given TLS is standard practice, declining it is very hard to justify.
Are shared accounts allowed?
No. Unique user identification is a required specification. Shared credentials break both access control and the audit trail, and are a common enforcement finding.