HIPAA Security Rule

The foundational policies and procedures that govern the conduct of the workforce and the security measures selected. These are the non-technical, human-centric controls.

• Security Management Process: Requires a risk analysis (identifying potential risks to ePHI) and a risk management plan (implementing measures to reduce those risks to a reasonable level).
• Security Personnel: A designated security official must be assigned responsibility for developing and implementing the entity's security policies.
• Information Access Management: Enforces the Minimum Necessary Rule, ensuring workforce members only access the ePHI required for their specific job role.
• Contingency Planning: Mandates a data backup plan, disaster recovery plan, and emergency mode operation plan to ensure ePHI availability during a crisis.

Controls that protect the physical structures, equipment, and media that store ePHI from unauthorized intrusion, theft, and environmental hazards.

• Facility Access Controls: Procedures to verify access to physical locations based on role, including contingency operations for restoring lost data.
• Workstation Use & Security: Policies specifying the proper functions performed on specific workstations and the physical attributes of the surroundings that protect them.
• Device and Media Controls: Governs the disposal of hardware and electronic media containing ePHI. Requires final disposition through clearing, purging, or physical destruction before reuse or disposal.

The automated technology and software used to protect ePHI and control access to it. These are the most dynamic and critical controls for cloud-based AI systems.

• Access Control: Requires unique user identification, emergency access procedures, and automatic logoff. Often implemented via Role-Based Access Control (RBAC).
• Audit Controls: Mandates hardware, software, and procedural mechanisms that record and examine activity in information systems containing ePHI, creating an immutable audit trail.
• Integrity Controls: Mechanisms to corroborate that ePHI has not been altered or destroyed in an unauthorized manner, often using checksums and digital signatures.
• Transmission Security: Requires encryption in transit via protocols like TLS 1.3 to guard against unauthorized access during network transmission.

A critical distinction in the Security Rule that dictates implementation flexibility. It does not mean optional.

• Required: The specification must be implemented as stated. Example: conducting a risk analysis.
• Addressable: The entity must assess whether the specification is a reasonable and appropriate safeguard. If it is, it must be implemented. If not, the entity must document why and implement an equivalent alternative measure that provides comparable protection.

For example, encryption at rest is addressable. If a hospital decides not to encrypt a database server, it must document the rationale and implement a compensating control like strict physical security and network segmentation.

A companion regulation that activates when the Security Rule fails. It mandates a specific response protocol following the impermissible use or disclosure of unsecured PHI.

• Risk Assessment: The entity must perform a four-factor risk assessment to determine the probability the PHI was compromised. Factors include the nature of the PHI, the unauthorized recipient, whether acquisition occurred, and mitigation success.
• Notification Triggers: If risk is determined, notifications must be sent to affected individuals without unreasonable delay (within 60 days). Breaches affecting 500+ individuals require simultaneous notification to the Secretary of HHS and prominent media outlets.
• Unsecured PHI: PHI that has not been rendered unusable, unreadable, or indecipherable through encryption or destruction. Breaches of secured PHI are exempt from notification.

A legally binding contract that extends HIPAA liability beyond the covered entity to any vendor that creates, receives, maintains, or transmits ePHI on its behalf.

• Chain of Liability: A cloud provider hosting an AI model that processes clinical notes is a business associate and must sign a BAA. Their subcontractors must also sign BAAs.
• Permitted Uses: The BAA strictly limits the associate's use of PHI to the services specified in the contract, prohibiting secondary use like model training without explicit authorization.
• Breach Obligations: The BAA must require the business associate to report any security incident, including breaches of unsecured PHI, to the covered entity, triggering the covered entity's notification obligations.