The HIPAA Security Rule Explained: Safeguards and Requirements | Osto<\/title>\n<meta name=\"description\" content=\"The HIPAA Security Rule explained: the administrative, physical, and technical safeguards for ePHI, required vs addressable specs, and where to start.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">The HIPAA Security Rule explained without the jargon: what it protects, the three types of safeguards it requires, and the distinction that trips teams up most.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>8 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>The HIPAA Security Rule sets the standards for protecting electronic protected health information (ePHI). It requires three kinds of safeguards, administrative, physical, and technical, that work together to keep health data secure.<\/p>\n <p>Within those, specifications are either required or addressable. Addressable does not mean optional: you assess it and either implement it or justify a reasonable equivalent. Risk analysis is the foundation everything else builds on.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What the Security Rule covers<\/a><\/li>\n <li><a href=\"#pillars\">The three types of safeguards<\/a><\/li>\n <li><a href=\"#reqvsaddr\">Required vs addressable<\/a><\/li>\n <li><a href=\"#priority\">Where to start<\/a><\/li>\n <li><a href=\"#proposed\">The proposed 2025 update<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">The HIPAA Security Rule, explained<\/h2>\n <p>The Security Rule is the part of HIPAA that deals specifically with electronic protected health information. Where the Privacy Rule governs how health information may be used and shared in any form, the Security Rule is narrower and more technical: it requires organisations to protect ePHI through concrete safeguards, and to keep those safeguards working as risks change. If your systems handle health data electronically, this is the rule that shapes most of your security work.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">The goal in one line<\/div>The Security Rule exists to keep electronic health information confidential, intact, and available, protected from unauthorised access, tampering, and loss.<\/div>\n\n <h2 class=\"sec\" id=\"pillars\">The three types of safeguards<\/h2>\n <p>The rule organises its requirements into three categories. None stands alone; together they cover people, places, and systems.<\/p>\n\n <div style=\"background:linear-gradient(135deg,#0e1444,#1c267a 55%,#2e3d9e);border-radius:20px;padding:34px 34px 30px;margin:30px 0;box-shadow:0 18px 50px rgba(14,20,68,.28);position:relative;overflow:hidden\">\n <div style=\"position:absolute;top:-40px;right:-30px;width:240px;height:240px;background:radial-gradient(circle,rgba(157,151,255,.26),transparent 65%);pointer-events:none\"><\/div>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#9d97ff;margin-bottom:6px\">The three pillars<\/div>\n <div style=\"font-size:21px;font-weight:800;color:#fff;margin-bottom:24px;letter-spacing:-.01em\">What the Security Rule actually asks for<\/div>\n <div style=\"display:grid;grid-template-columns:1fr 1fr 1fr;gap:16px\">\n <div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(0,194,168,.35);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#12d3b6,#00c2a8);display:grid;place-items:center;font-size:18px;margin-bottom:12px\">👥<\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Administrative<\/div>\n <div style=\"font-size:12px;color:#c6ccf0;line-height:1.5\">Risk analysis, workforce training, access management, policies.<\/div>\n <\/div>\n <div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(157,151,255,.35);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#4a57d4,#3a46c0);display:grid;place-items:center;font-size:18px;margin-bottom:12px\">🏢<\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Physical<\/div>\n <div style=\"font-size:12px;color:#c6ccf0;line-height:1.5\">Facility access, workstation use, device and media controls.<\/div>\n <\/div>\n <div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(0,194,168,.35);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#12d3b6,#00c2a8);display:grid;place-items:center;font-size:18px;margin-bottom:12px\">⚙️<\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Technical<\/div>\n <div style=\"font-size:12px;color:#c6ccf0;line-height:1.5\">Access control, encryption, audit controls, integrity, transmission security.<\/div>\n <\/div>\n <\/div>\n<\/div>\n\n <p>Administrative safeguards are the largest group and cover how you manage security: <a href=\"https:\/\/www.osto.one\/resources\/glossary\/risk-assessment\/\">risk analysis<\/a>, workforce training, and access management. Physical safeguards protect the places and devices where ePHI lives. Technical safeguards are the controls built into your systems, access control, encryption, audit logging, and integrity protection.<\/p>\n\n <h2 class=\"sec\" id=\"reqvsaddr\">Required vs addressable: the distinction that trips teams up<\/h2>\n <p>Within each safeguard, individual specifications are labelled either required or addressable. This is the single most misunderstood part of the Security Rule, and getting it wrong is a common source of gaps.<\/p>\n\n <div style=\"background:linear-gradient(180deg,#fbfcff,#eef1ff);border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.10)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#3a46c0;margin-bottom:6px\">A key distinction<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">Required vs addressable specifications<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">Addressable does not mean optional. It means you assess it, then implement it or justify an equivalent.<\/div>\n <svg viewBox=\"0 0 700 180\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Required versus addressable HIPAA specifications\">\n <g font-family=\"Inter,Arial,sans-serif\">\n <rect x=\"24\" y=\"26\" width=\"300\" height=\"128\" rx=\"16\" fill=\"#e6f7f4\" stroke=\"#00c2a8\" stroke-width=\"2\"\/>\n <text x=\"174\" y=\"56\" text-anchor=\"middle\" font-size=\"15\" font-weight=\"800\" fill=\"#0a7a68\">Required<\/text>\n <text x=\"48\" y=\"86\" font-size=\"12\" fill=\"#0e1330\">You must implement it.<\/text>\n <text x=\"48\" y=\"110\" font-size=\"12\" fill=\"#5b6178\">No discretion: the specification<\/text>\n <text x=\"48\" y=\"128\" font-size=\"12\" fill=\"#5b6178\">applies as written.<\/text>\n\n <rect x=\"376\" y=\"26\" width=\"300\" height=\"128\" rx=\"16\" fill=\"#f1f0ff\" stroke=\"#9d97ff\" stroke-width=\"2\"\/>\n <text x=\"526\" y=\"56\" text-anchor=\"middle\" font-size=\"15\" font-weight=\"800\" fill=\"#5b52d6\">Addressable<\/text>\n <text x=\"400\" y=\"86\" font-size=\"12\" fill=\"#0e1330\">You assess it, then either<\/text>\n <text x=\"400\" y=\"110\" font-size=\"12\" fill=\"#5b6178\">implement it, or document a<\/text>\n <text x=\"400\" y=\"128\" font-size=\"12\" fill=\"#5b6178\">reasonable equivalent. Not optional.<\/text>\n <\/g>\n <\/svg>\n<\/div>\n\n <p>The mistake is reading addressable as optional. It is not. An addressable specification still has to be assessed, and then either implemented or replaced with a documented, reasonable alternative that achieves the same protection. Ignoring it entirely is a compliance failure.<\/p>\n\n <h2 class=\"sec\" id=\"priority\">Where to start: risk analysis first<\/h2>\n <p>If the Security Rule feels large, there is a clear place to begin. Risk analysis is both an explicit requirement and the foundation the rest depends on, and it is the deficiency regulators cite most often. A thorough, current risk analysis tells you which safeguards matter most for your environment, so everything else becomes prioritised rather than guessed.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">The anchor control<\/div>Start with a genuine risk analysis of where your ePHI lives and how it flows. It is required, it is the most-cited gap in enforcement, and it directs the rest of your safeguard work.<\/div>\n\n <h2 class=\"sec\" id=\"proposed\">A note on the proposed 2025 update<\/h2>\n <p>A proposed update to the Security Rule was published in early 2025 and would strengthen technical requirements, making some previously addressable items explicit and adding measures around areas like risk analysis frequency. Importantly, it remains a proposed rule, not final law, and regulators continue to enforce the current Security Rule in the meantime. Building strong, modern technical controls now prepares you regardless of the final outcome.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to the Security Rule<\/h2>\n <p>Most of the Security Rule’s technical safeguards, and much of the administrative work like risk analysis and access management, come down to controls that must genuinely operate on your ePHI and be evidenced. Assembling those across separate tools is where teams lose time and leave gaps between systems.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. The technical safeguards the Security Rule expects, access control, encryption, audit logging, integrity, and monitoring, run on one platform and produce evidence automatically, then map to HIPAA alongside 200+ other frameworks. A lean team can satisfy the Security Rule without stitching tools together, which is why startups treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Meet the Security Rule without the gaps.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Run the administrative and technical safeguards on one platform, with evidence collected automatically and mapped to HIPAA. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is the HIPAA Security Rule?<\/summary><p>It is the part of HIPAA that sets standards for protecting electronic protected health information (ePHI). It requires administrative, physical, and technical safeguards to keep health data confidential, intact, and available, and to keep those safeguards working as risks change.<\/p><\/details>\n <details><summary>What are the three types of HIPAA safeguards?<\/summary><p>Administrative safeguards (risk analysis, training, access management), physical safeguards (facility, workstation, and device controls), and technical safeguards (access control, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/encryption-at-rest-and-in-transit\/\">encryption<\/a>, audit logging, and integrity). They work together across people, places, and systems.<\/p><\/details>\n <details><summary>What does addressable mean in the HIPAA Security Rule?<\/summary><p>Addressable does not mean optional. It means you must assess the specification and then either implement it or document a reasonable equivalent that achieves the same protection. Ignoring an addressable specification is a compliance failure.<\/p><\/details>\n <details><summary>What is the most important part of the Security Rule?<\/summary><p>Risk analysis. It is an explicit requirement, the foundation the other safeguards build on, and the deficiency regulators cite most often. A thorough, current risk analysis directs where the rest of your effort should go.<\/p><\/details>\n <details><summary>Is the HIPAA Security Rule changing?<\/summary><p>A proposed update was published in early 2025 that would strengthen technical requirements. As of now it remains a proposed rule, not final law, and regulators continue to enforce the existing Security Rule. Building modern controls now prepares you either way.<\/p><\/details>\n <details><summary>Does the Security Rule require encryption?<\/summary><p>Encryption is an addressable specification, which means you must assess it and either implement it or justify a reasonable equivalent. In practice, for ePHI in modern systems, encryption at rest and in transit is the expected approach.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>The HIPAA Security Rule Explained: Safeguards and Requirements | Osto The HIPAA Security Rule explained without the jargon: what it\u2026<\/p>\n","protected":false},"author":8,"featured_media":806,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[309,308,310],"class_list":["post-805","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-hipaa-safeguards","tag-hipaa-security-rule","tag-hipaa-security-rule-explained"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/805","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=805"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/805\/revisions"}],"predecessor-version":[{"id":807,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/805\/revisions\/807"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/806"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=805"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=805"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=805"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":805,"date":"2026-08-16T21:19:17","date_gmt":"2026-08-16T21:19:17","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=805"},"modified":"2026-08-16T21:19:17","modified_gmt":"2026-08-16T21:19:17","slug":"hipaa-security-rule-explained","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/hipaa-security-rule-explained\/","title":{"rendered":"The HIPAA Security Rule Explained: Safeguards and Requirements"},"content":{"rendered":"\n\n\n\n\n\nThe HIPAA Security Rule Explained: Safeguards and Requirements | Osto<\/title>\n<meta name=\"description\" content=\"The HIPAA Security Rule explained: the administrative, physical, and technical safeguards for ePHI, required vs addressable specs, and where to start.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">The HIPAA Security Rule explained without the jargon: what it protects, the three types of safeguards it requires, and the distinction that trips teams up most.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>8 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>The HIPAA Security Rule sets the standards for protecting electronic protected health information (ePHI). It requires three kinds of safeguards, administrative, physical, and technical, that work together to keep health data secure.<\/p>\n <p>Within those, specifications are either required or addressable. Addressable does not mean optional: you assess it and either implement it or justify a reasonable equivalent. Risk analysis is the foundation everything else builds on.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What the Security Rule covers<\/a><\/li>\n <li><a href=\"#pillars\">The three types of safeguards<\/a><\/li>\n <li><a href=\"#reqvsaddr\">Required vs addressable<\/a><\/li>\n <li><a href=\"#priority\">Where to start<\/a><\/li>\n <li><a href=\"#proposed\">The proposed 2025 update<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">The HIPAA Security Rule, explained<\/h2>\n <p>The Security Rule is the part of HIPAA that deals specifically with electronic protected health information. Where the Privacy Rule governs how health information may be used and shared in any form, the Security Rule is narrower and more technical: it requires organisations to protect ePHI through concrete safeguards, and to keep those safeguards working as risks change. If your systems handle health data electronically, this is the rule that shapes most of your security work.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">The goal in one line<\/div>The Security Rule exists to keep electronic health information confidential, intact, and available, protected from unauthorised access, tampering, and loss.<\/div>\n\n <h2 class=\"sec\" id=\"pillars\">The three types of safeguards<\/h2>\n <p>The rule organises its requirements into three categories. None stands alone; together they cover people, places, and systems.<\/p>\n\n <div style=\"background:linear-gradient(135deg,#0e1444,#1c267a 55%,#2e3d9e);border-radius:20px;padding:34px 34px 30px;margin:30px 0;box-shadow:0 18px 50px rgba(14,20,68,.28);position:relative;overflow:hidden\">\n <div style=\"position:absolute;top:-40px;right:-30px;width:240px;height:240px;background:radial-gradient(circle,rgba(157,151,255,.26),transparent 65%);pointer-events:none\"><\/div>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#9d97ff;margin-bottom:6px\">The three pillars<\/div>\n <div style=\"font-size:21px;font-weight:800;color:#fff;margin-bottom:24px;letter-spacing:-.01em\">What the Security Rule actually asks for<\/div>\n <div style=\"display:grid;grid-template-columns:1fr 1fr 1fr;gap:16px\">\n <div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(0,194,168,.35);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#12d3b6,#00c2a8);display:grid;place-items:center;font-size:18px;margin-bottom:12px\">👥<\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Administrative<\/div>\n <div style=\"font-size:12px;color:#c6ccf0;line-height:1.5\">Risk analysis, workforce training, access management, policies.<\/div>\n <\/div>\n <div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(157,151,255,.35);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#4a57d4,#3a46c0);display:grid;place-items:center;font-size:18px;margin-bottom:12px\">🏢<\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Physical<\/div>\n <div style=\"font-size:12px;color:#c6ccf0;line-height:1.5\">Facility access, workstation use, device and media controls.<\/div>\n <\/div>\n <div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(0,194,168,.35);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#12d3b6,#00c2a8);display:grid;place-items:center;font-size:18px;margin-bottom:12px\">⚙️<\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">Technical<\/div>\n <div style=\"font-size:12px;color:#c6ccf0;line-height:1.5\">Access control, encryption, audit controls, integrity, transmission security.<\/div>\n <\/div>\n <\/div>\n<\/div>\n\n <p>Administrative safeguards are the largest group and cover how you manage security: <a href=\"https:\/\/www.osto.one\/resources\/glossary\/risk-assessment\/\">risk analysis<\/a>, workforce training, and access management. Physical safeguards protect the places and devices where ePHI lives. Technical safeguards are the controls built into your systems, access control, encryption, audit logging, and integrity protection.<\/p>\n\n <h2 class=\"sec\" id=\"reqvsaddr\">Required vs addressable: the distinction that trips teams up<\/h2>\n <p>Within each safeguard, individual specifications are labelled either required or addressable. This is the single most misunderstood part of the Security Rule, and getting it wrong is a common source of gaps.<\/p>\n\n <div style=\"background:linear-gradient(180deg,#fbfcff,#eef1ff);border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.10)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#3a46c0;margin-bottom:6px\">A key distinction<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">Required vs addressable specifications<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">Addressable does not mean optional. It means you assess it, then implement it or justify an equivalent.<\/div>\n <svg viewBox=\"0 0 700 180\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Required versus addressable HIPAA specifications\">\n <g font-family=\"Inter,Arial,sans-serif\">\n <rect x=\"24\" y=\"26\" width=\"300\" height=\"128\" rx=\"16\" fill=\"#e6f7f4\" stroke=\"#00c2a8\" stroke-width=\"2\"\/>\n <text x=\"174\" y=\"56\" text-anchor=\"middle\" font-size=\"15\" font-weight=\"800\" fill=\"#0a7a68\">Required<\/text>\n <text x=\"48\" y=\"86\" font-size=\"12\" fill=\"#0e1330\">You must implement it.<\/text>\n <text x=\"48\" y=\"110\" font-size=\"12\" fill=\"#5b6178\">No discretion: the specification<\/text>\n <text x=\"48\" y=\"128\" font-size=\"12\" fill=\"#5b6178\">applies as written.<\/text>\n\n <rect x=\"376\" y=\"26\" width=\"300\" height=\"128\" rx=\"16\" fill=\"#f1f0ff\" stroke=\"#9d97ff\" stroke-width=\"2\"\/>\n <text x=\"526\" y=\"56\" text-anchor=\"middle\" font-size=\"15\" font-weight=\"800\" fill=\"#5b52d6\">Addressable<\/text>\n <text x=\"400\" y=\"86\" font-size=\"12\" fill=\"#0e1330\">You assess it, then either<\/text>\n <text x=\"400\" y=\"110\" font-size=\"12\" fill=\"#5b6178\">implement it, or document a<\/text>\n <text x=\"400\" y=\"128\" font-size=\"12\" fill=\"#5b6178\">reasonable equivalent. Not optional.<\/text>\n <\/g>\n <\/svg>\n<\/div>\n\n <p>The mistake is reading addressable as optional. It is not. An addressable specification still has to be assessed, and then either implemented or replaced with a documented, reasonable alternative that achieves the same protection. Ignoring it entirely is a compliance failure.<\/p>\n\n <h2 class=\"sec\" id=\"priority\">Where to start: risk analysis first<\/h2>\n <p>If the Security Rule feels large, there is a clear place to begin. Risk analysis is both an explicit requirement and the foundation the rest depends on, and it is the deficiency regulators cite most often. A thorough, current risk analysis tells you which safeguards matter most for your environment, so everything else becomes prioritised rather than guessed.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">The anchor control<\/div>Start with a genuine risk analysis of where your ePHI lives and how it flows. It is required, it is the most-cited gap in enforcement, and it directs the rest of your safeguard work.<\/div>\n\n <h2 class=\"sec\" id=\"proposed\">A note on the proposed 2025 update<\/h2>\n <p>A proposed update to the Security Rule was published in early 2025 and would strengthen technical requirements, making some previously addressable items explicit and adding measures around areas like risk analysis frequency. Importantly, it remains a proposed rule, not final law, and regulators continue to enforce the current Security Rule in the meantime. Building strong, modern technical controls now prepares you regardless of the final outcome.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to the Security Rule<\/h2>\n <p>Most of the Security Rule’s technical safeguards, and much of the administrative work like risk analysis and access management, come down to controls that must genuinely operate on your ePHI and be evidenced. Assembling those across separate tools is where teams lose time and leave gaps between systems.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. The technical safeguards the Security Rule expects, access control, encryption, audit logging, integrity, and monitoring, run on one platform and produce evidence automatically, then map to HIPAA alongside 200+ other frameworks. A lean team can satisfy the Security Rule without stitching tools together, which is why startups treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Meet the Security Rule without the gaps.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Run the administrative and technical safeguards on one platform, with evidence collected automatically and mapped to HIPAA. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is the HIPAA Security Rule?<\/summary><p>It is the part of HIPAA that sets standards for protecting electronic protected health information (ePHI). It requires administrative, physical, and technical safeguards to keep health data confidential, intact, and available, and to keep those safeguards working as risks change.<\/p><\/details>\n <details><summary>What are the three types of HIPAA safeguards?<\/summary><p>Administrative safeguards (risk analysis, training, access management), physical safeguards (facility, workstation, and device controls), and technical safeguards (access control, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/encryption-at-rest-and-in-transit\/\">encryption<\/a>, audit logging, and integrity). They work together across people, places, and systems.<\/p><\/details>\n <details><summary>What does addressable mean in the HIPAA Security Rule?<\/summary><p>Addressable does not mean optional. It means you must assess the specification and then either implement it or document a reasonable equivalent that achieves the same protection. Ignoring an addressable specification is a compliance failure.<\/p><\/details>\n <details><summary>What is the most important part of the Security Rule?<\/summary><p>Risk analysis. It is an explicit requirement, the foundation the other safeguards build on, and the deficiency regulators cite most often. A thorough, current risk analysis directs where the rest of your effort should go.<\/p><\/details>\n <details><summary>Is the HIPAA Security Rule changing?<\/summary><p>A proposed update was published in early 2025 that would strengthen technical requirements. As of now it remains a proposed rule, not final law, and regulators continue to enforce the existing Security Rule. Building modern controls now prepares you either way.<\/p><\/details>\n <details><summary>Does the Security Rule require encryption?<\/summary><p>Encryption is an addressable specification, which means you must assess it and either implement it or justify a reasonable equivalent. In practice, for ePHI in modern systems, encryption at rest and in transit is the expected approach.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>The HIPAA Security Rule Explained: Safeguards and Requirements | Osto The HIPAA Security Rule explained without the jargon: what it\u2026<\/p>\n","protected":false},"author":8,"featured_media":806,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[309,308,310],"class_list":["post-805","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-hipaa-safeguards","tag-hipaa-security-rule","tag-hipaa-security-rule-explained"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/805","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=805"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/805\/revisions"}],"predecessor-version":[{"id":807,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/805\/revisions\/807"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/806"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=805"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=805"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=805"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}