HIPAA Security Rule & Privacy Rule
Practical Guide for 2026

§1 Security Rule Administrative Safeguards (45 CFR §164.308)

The administrative safeguards are where most OCR enforcement actions begin. Every covered entity and business associate must implement the eight categories in §164.308(a), each paired with both a 'required' implementation specification and (for four of them) an 'addressable' alternative — though the December 2026 HHS NPRM proposes to retire the required/addressable split and elevate every safeguard to a Standards-based duty.

§164.308(a)(1)(ii)(A) — Risk Analysis. This is OCR's most-cited safeguard. You must conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI) held by the covered entity. ComplianceStack maps your risk analysis to §164.308(a)(1)(ii)(A) by enumerating every ePHI asset, every threat, every likelihood, and every impact — the four columns OCR investigators look for in any corrective action plan (CAP).

§164.308(a)(1)(ii)(B) — Risk Management. Once you have identified risks, §164.308(a)(1)(ii)(B) requires you to implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level. The risk analysis is the diagnosis; the risk management plan is the treatment. ComplianceStack remediation action plans are written to be defensible as a risk management plan deliverable.

§164.308(a)(2) — Assigned Security Responsibility. Identify the single person (or role) who is responsible for the entity's Security Rule policies and procedures. The named security official is the point of contact for OCR investigations. ComplianceStack recommends documenting this responsibility in a one-page charter signed by the named individual and the CEO.

§164.308(a)(3) — Workforce Security. Authorization or supervision of workforce members who work with ePHI (§164.308(a)(3)(i)), workforce clearance procedures (§164.308(a)(3)(ii)(A)), and termination procedures (§164.308(a)(3)(ii)(C)) are the three implementation specifications. Background checks, role-based access, and a documented offboarding checklist that disables accounts within 24 hours of separation are the operationally important controls.

§164.308(a)(5) — Security Awareness and Training. §164.308(a)(5)(ii)(A) (security reminders), (B) (protection from malicious software), (C) (log-in monitoring), and (D) (password management) are the four training implementation specifications. ComplianceStack recommends at minimum an annual HIPAA training module, quarterly phishing simulations, and a documented reminder cadence.

§164.308(a)(6) — Incident Procedures. §164.308(a)(6)(ii) requires documented security incident response policies and procedures. Pair this directly with §164.400–414 breach notification workflow — the incident response runbook should explicitly trigger breach analysis within 24 hours.

§164.308(a)(7) — Contingency Plan. Data backup (§164.308(a)(7)(ii)(A)), disaster recovery (§164.308(a)(7)(ii)(B)), emergency mode operation (§164.308(a)(7)(ii)(C)), testing and revision procedures (§164.308(a)(7)(ii)(D)), and applications and data criticality analysis (§164.308(a)(7)(ii)(E)). OCR failure on this safeguard is a recurring source of multi-million-dollar CAPs.

§164.308(a)(8) — Evaluation. Periodic technical and non-technical evaluation of your Security Rule compliance posture. ComplianceStack runs annual §164.308(a)(8) evaluations as a routine deliverable.

§2 Security Rule Physical Safeguards (45 CFR §164.310)

The physical safeguards exist to control physical access to ePHI systems and the environments in which they operate (§164.310(a)), define acceptable workstation behavior (§164.310(b)), and govern the lifecycle of hardware and electronic media that contain ePHI (§164.310(c)).

• §164.310(a)(1) Facility Access Controls. (§164.310(a)(2)(i)) Contingency operations, (§164.310(a)(2)(ii)) facility security plan, (§164.310(a)(2)(iii)) access control and validation, (§164.310(a)(2)(iv)) maintenance records.
• §164.310(b) Workstation Use & Workstation Restrictions. Defines acceptable workstation behavior and the physical boundaries of where ePHI may be accessed. Document the workstation-class inventory and post the restrictions at every point of use.
• §164.310(c) Device and Media Controls. (§164.310(c)(1)) Disposal, (§164.310(c)(2)) Media re-use, (§164.310(c)(3)) Accountability, (§164.310(c)(4)) Data backup and storage. The single most-cited physical safeguard in OCR enforcement is missing media-disposal logs — pair with NIST SP 800-88 Rev. 1 purge guidance.

For organizations operating under hybrid work, §164.310 requires HIPAA-compliant controls on any device that touches ePHI — laptops, mobile phones, copy machines, and network printers all need to be inventoried with documented disposal procedures.

§3 Security Rule Technical Safeguards (45 CFR §164.312)

The technical safeguards are the most visible control surface — and the most frequently cited in modern OCR enforcement because encryption has become the defining risk-reduction tool for unauthorized disclosures.

• §164.312(a)(1) Access Control. (§164.312(a)(2)(i)) Unique user identification, (§164.312(a)(2)(ii)) Emergency access procedure, (§164.312(a)(2)(iii)) Automatic logoff, (§164.312(a)(2)(iv)) Encryption and decryption — the addressable implementation specification.
• §164.312(b) Audit Controls. Hardware, software, and procedural mechanisms that record and examine activity in information systems containing ePHI. OCR expects centralized log retention of at least one year.
• §164.312(c) Integrity. Protect ePHI from improper alteration or destruction. Pair this with §164.402 (2) — encrypted ePHI that is exfiltrated but rendered indecipherable is presumed NOT a breach.
• §164.312(d) Person or Entity Authentication. Verify the identity of the person or entity seeking access to ePHI.
• §164.312(e) Transmission Security. (§164.312(e)(1)) Integrity controls, (§164.312(e)(2)(i)) Encryption. Note NIST SP 800-111 establishes AES-128 as the safe-harbor guidance for the encryption that triggers the §164.402 breach presumption.

The encryption carve-out under §164.402(2) is the most important compliance lever in this section. If ePHI is encrypted to NIST SP 800-111 (or successor guidance) to render it unreadable and indecipherable to unauthorized individuals, OCR presumes no breach — eliminating the §164.404 individual notice, §164.406 media notice, and §164.408 HHS portal notification obligations entirely. ComplianceStack tracks which of your ePHI assets are encrypted to this safe-harbor baseline.

§4 Privacy Rule Uses, Disclosures & Individual Rights (45 CFR §164.500–534)

The Privacy Rule controls how covered entities use and disclose Protected Health Information (PHI). It predates the Security Rule by three years and remains in force alongside it. Pair §164.500–534 use-and-disclosure obligations with §164.502–514 control categories.

• §164.500 — Purpose & Applicability. Establishes the scope: covered entities (healthcare providers conducting standard transactions, health plans, healthcare clearinghouses) and (subject to §164.105) hybrid entities.
• §164.502 — Uses & Disclosures. §164.502(a) general rules; §164.502(b) Minimum Necessary — when using or disclosing PHI (and when requesting PHI from another covered entity), make reasonable efforts to limit to the minimum necessary. This is one of the most-cited Privacy Rule provisions in OCR enforcement.
• §164.504 — Organizational Requirements. Hybrid entities, affiliated covered entities, group health plans, and the requirement for a Business Associate Agreement (BAA) with business associates.
• §164.506 — Treatment, Payment & Healthcare Operations Permitted Uses. The "TPO" exception — the most common lawful basis for use and disclosure without authorization.
• §164.508 — Authorization for Uses & Disclosures. Required when the use or disclosure is not for TPO and is not otherwise permitted — for example, marketing, sale of PHI, or psychotherapy notes.
• §164.510 — Notice of Privacy Practices. Every covered health care provider with direct treatment relationships must provide a Notice of Privacy Practices (NPP) at first delivery and post it prominently.
• §164.512 — Permitted Uses & Disclosures. Including required-by-law, public health, abuse and neglect, judicial proceedings, law enforcement, and (post-Omnibus) limited marketing and fundraising.
• §164.514 — De-identification. §164.514(b)(2)(i) lists the 18 PHI identifiers that must be removed for PHI to be considered de-identified: names, geographic subdivisions smaller than a state, dates (except year) related to an individual, telephone numbers, fax numbers, email addresses, Social Security numbers, medical record numbers, health plan beneficiary numbers, account numbers, certificate/license numbers, vehicle identifiers, device identifiers, URLs, IP addresses, biometric identifiers, full-face photographs, and any other unique identifying number, characteristic, or code.
• §164.522 — Request for Restrictions & Confidential Communications. Individual right to request restrictions on use/disclosure (which the covered entity must grant when the individual has paid out-of-pocket in full) and confidential communications channels.
• §164.524 — Access of Individuals to PHI. Individuals have a right to access their own PHI within 30 days, with one 30-day extension under §164.524(b)(2).
• §164.526 — Amendment. Individuals have the right to have PHI amended, subject to the covered entity's denial grounds in §164.526(a)(2).
• §164.528 — Accounting of Disclosures. The right to receive an accounting of certain disclosures for the six years prior to the request.
• §164.530 — Administrative Requirements. Designate a Privacy Official (§164.530(a)(1)), training (§164.530(b)), safeguards (§164.530(c)), complaints (§164.530(d)), retention of documentation for six years per §164.530(j)(2), and a biennial mitigation strategy when not feasible to comply.

ComplianceStack recommends treating each §164.514 identifier as a checklist row in your Privacy Rule policy binder; OCR investigations routinely open with a request for each identifier's de-identification or re-identification controls.

§5 Breach Notification (45 CFR §164.400–414)

The Breach Notification Rule applies to covered entities AND (per the Omnibus Rule) to business associates. It is the most time-sensitive obligation in HIPAA: the 60-day clock starts at 'discovery' and runs during litigation, CAPs, and parallel state-law notifications.

§164.402 — Breach Definition & Notification Triggers

A 'breach' is the unauthorized acquisition, access, use, or disclosure of unsecured PHI that compromises PHI's confidentiality, integrity, or availability — UNLESS the covered entity demonstrates, through a §164.402(2) risk assessment, that there is a low probability the PHI has been compromised. The four-factor risk assessment weighs (1) the nature and extent of the PHI involved, (2) the unauthorized person who used or received the PHI, (3) whether the PHI was actually acquired or viewed, and (4) the extent risk has been mitigated. Encryption to NIST SP 800-111 effective controls some of these factors and triggers the presumption of non-breach.

§164.404 — Individual Notice (60-Day Clock)

Notice to affected individuals must be provided 'without unreasonable delay and in no case later than 60 calendar days' after discovery of the breach. First-class mail to the last known address is the default; email is permitted if the individual has agreed; telephonic notice is permitted for urgent situations. Substitute notice (web posting + prominent media notice) applies when contact information is insufficient or outdated for 10 or more individuals.

§164.406 — Media Notice (>500 Residents)

If a breach involves more than 500 residents of a state or jurisdiction, the covered entity must notify prominent media outlets serving the affected state or jurisdiction. The 60-day clock applies; in practice, media notice goes out concurrently with individual notice for high-impact events.

§164.408 — HHS Notice (Breach Portal)

If a breach involves more than 500 individuals, the covered entity must notify HHS Secretary via the OCR Breach Portal — and the breach will appear on the public 'Wall of Shame' at ocr.hhs.gov. For breaches involving fewer than 500 individuals, the covered entity must still log the breach and submit an annual summary to HHS no later than 60 days after the end of the calendar year.

§164.410 — Business Associate Notification Obligation

A business associate must notify the covered entity without unreasonable delay after discovery of a breach affecting unsecured PHI. The §164.410 clock is upstream of the §164.404 60-day clock and starts the timeline. BAA enforcement is §164.314(a) — covered entities fail their §164.308 administrative safeguards when their BAAs are missing the §164.314(a)(2)(i) language required by HHS.

§6 OCR 2026 Enforcement Priorities & Penalty Tiers

OCR's enforcement posture in 2026 reflects both the December 2026 NPRM that proposes to retire the addressable/required implementation specification split (elevating every Security Rule safeguard to a Standards-level duty) and the 2025 ransomware-as-breach guidance. The most-investigated safeguards in current OCR enforcement actions are: §164.308(a)(1)(ii)(A) risk analysis, §164.308(a)(5)(ii)(D) password management/training, §164.310(d) device and media controls, §164.312(a)(2)(iv) encryption, and §164.402(2) breach presumption analysis.

Under 45 CFR §160.404, OCR penalty tiers are inflation-adjusted annually under the Federal Civil Penalties Inflation Adjustment Act. The 2026 amounts:

The annual cap under §160.404(b)(1) through (4) for identical violations is $2,190,294 per year. Multiple violation categories can each reach that cap independently, which is how the public Anthem ($16M), Excellus ($2.3M), and Premera ($6.85M) settlements accumulated — every distinct safeguard failure that the covered entity failed to address became a separate violation category.

Under §160.404(c), criminal penalties under 42 USC §1320d-5 are separate and not adjusted for inflation: up to $50,000 and one year imprisonment for knowing violations, with up to $100,000 and five years for violations committed under false pretenses (and up to $250,000 and ten years for violations with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm). The DOJ, not OCR, prosecutes criminal HIPAA violations.

§7 Pair this guide with the ComplianceStack HIPAA tools

Two free ComplianceStack tools pair directly with this pillar guide. The free assessment is the lightweight diagnostic (under 2 minutes); the calculator is the deep gap analyzer with documented risk analysis.

§8 Frequently Asked Questions