By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: HIPAA Security Rule
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
The HIPAA Security Rule is the federal regulation that sets national standards for protecting the confidentiality, integrity, and availability of electronic protected health information (ePHI) that covered entities and business associates create, receive, maintain, or transmit.
The HIMSS Dictionary describes the Security Rule as establishing national standards for protecting individuals’ electronic health information handled by covered entities, requiring appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and security of ePHI. The regulation itself appears in Part 160 and in Subparts A and C of Part 164 of Title 45 of the Code of Federal Regulations.
| Safeguard Category | What It Covers | Examples |
|---|---|---|
| Administrative | Policies, procedures, and workforce management | Risk analysis, security officer, training, contingency planning |
| Physical | Facilities, workstations, and devices | Facility access controls, workstation security, device disposal |
| Technical | Technology that protects and controls access to ePHI | Access controls, audit controls, integrity, authentication, transmission security |
| Organizational | Relationships with business associates | Business associate agreements |
| Policies and Documentation | Written policies and records | Retaining documentation for six years |
⚠️ Exam Alert: The Security Rule applies only to electronic PHI. The Privacy Rule covers PHI in all forms and governs uses and disclosures. Required specifications must be implemented; addressable ones must be assessed and implemented if reasonable and appropriate, or documented with an equivalent alternative. Addressable does not mean optional.
🌐 Why It Matters: Real-World Healthcare IT Context
Health information has moved overwhelmingly to electronic systems, and the Security Rule sets the baseline for protecting it. Its standards apply to hospitals, clinics, health plans, clearinghouses, and the business associates that handle ePHI on their behalf.
The rule is designed to be flexible and scalable. Rather than prescribing specific technologies, it requires organizations to consider their size, complexity, capabilities, technical infrastructure, costs, and the likelihood and impact of risks. A small practice and a large health system must meet the same standards, but they can do so in different ways.
Risk analysis is the foundation. Organizations must conduct an accurate and thorough assessment of potential risks and vulnerabilities to ePHI, then implement security measures to reduce them to a reasonable and appropriate level. HHS’s Office for Civil Rights (OCR) frequently cites missing or inadequate risk analyses in enforcement actions, and in 2024 it launched a Risk Analysis Initiative focused on this requirement.
Technical safeguards address how systems control access. They include unique user identification, emergency access procedures, automatic logoff, encryption and decryption as an addressable specification, audit controls, integrity protections, person or entity authentication, and transmission security.
The rule is being reconsidered. In January 2025, HHS published a proposed rule to strengthen the Security Rule in response to rising cyberattacks. Among other changes, it proposed removing the distinction between required and addressable specifications, requiring encryption of ePHI and multifactor authentication with limited exceptions, maintaining technology asset inventories and network maps, and performing regular vulnerability scanning and penetration testing. As of this writing, a final rule has not been issued, so the current rule remains in effect.
The Security Rule works alongside other HIPAA rules. The Breach Notification Rule requires notification after breaches of unsecured PHI, and HHS guidance explains that PHI encrypted consistent with NIST guidance is not considered unsecured. Congress also amended the HITECH Act in 2021 to require HHS to consider whether organizations had recognized security practices in place for the prior 12 months when making certain enforcement decisions.
Availability is easy to overlook. The rule protects not only confidentiality but also the integrity and availability of ePHI. Ransomware that locks clinicians out of the EHR is a Security Rule problem even if no data leaves the organization, which is why contingency planning, data backup, disaster recovery, and emergency mode operations are required elements of the administrative safeguards.
Common Security Rule compliance gaps:
- Missing, outdated, or incomplete risk analysis
- Risk management plans that are never carried out
- Unencrypted laptops and portable media
- Weak access controls and shared accounts
- Inadequate audit log review
- Business associate agreements missing or outdated
Practices that support compliance:
- Enterprise-wide risk analysis updated regularly and after major changes
- Documented risk management plans with owners and timelines
- Encryption of devices and data in transit
- Multifactor authentication and least-privilege access
- Regular audit log review and incident response testing
- Ongoing workforce security awareness training
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
The Security Rule is carried out through organizational systems and policies, but nursing habits determine whether many safeguards work in practice.
At the Bedside
Workstation security is a daily responsibility. Locking or logging off unattended computers, positioning screens away from public view, and never sharing login credentials help protect ePHI on busy units. Automatic logoff and badge tap-in tools exist because workstations are shared constantly.
Mobile devices and portable media deserve care. Using only approved, managed devices and avoiding storing patient information on personal phones or USB drives keep ePHI within protected systems.
In Clinical Workflow
Audit controls record who accesses records. Nurses should access only the records needed for their work, knowing that access is monitored and that inappropriate access can lead to sanctions.
Suspicious emails, unexpected login prompts, or unusual system behavior should be reported promptly to the help desk or security team. Early reporting supports incident response, a required part of the Security Rule’s administrative safeguards.
When systems go down, contingency plans keep care going. Nurses familiar with downtime procedures, such as paper documentation and read-only systems, help maintain availability of critical information, one of the rule’s core goals.
Annual security training may feel routine, but it reflects a rule requirement and covers threats that change each year, such as new phishing techniques.
Physical safeguards apply on units too. Keeping medication rooms, workstation areas, and device storage secured, and returning shared devices to their chargers, supports the facility and device controls the rule requires.
In EHR Implementation (Go-Live Perspective)
During an Epic Go-Live, security teams configure user roles, audit logging, automatic logoff, encryption, and remote access controls, and they update the risk analysis to reflect the new environment. Downtime procedures and backups are tested before cutover.
At-the-elbow support analysts reinforce secure habits, such as never sharing logins to get past access problems. Routing access issues through proper requests keeps both care and compliance on track.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
The HIPAA Security Rule appears in security, privacy, and compliance questions:
| CAHIMS Domain | How the Security Rule Appears |
|---|---|
| Healthcare & Technology Environments | HIPAA regulations; OCR enforcement; proposed rule changes |
| Clinical Informatics | Workstation security, access monitoring, downtime procedures |
| Healthcare Information & Systems Management | Technical safeguards, encryption, audit controls, risk analysis |
| Management & Leadership | Security governance, policies, training, business associate oversight |
Key Terms to Know Alongside HIPAA Security Rule
- ePHI — protected health information in electronic form
- Risk Analysis — assessment of risks and vulnerabilities to ePHI
- Administrative Safeguards — policies and procedures that manage security measures and workforce conduct
- Technical Safeguards — technology and related policies that protect and control access to ePHI
- Addressable Specification — a specification that must be assessed and implemented if reasonable, or documented with an alternative
- Office for Civil Rights (OCR) — the HHS office that enforces HIPAA
HIMSS Organizational Position
HIMSS engages with HHS on HIPAA security policy, including comments on proposed rules, and supports organizations through its Healthcare Cybersecurity Community and cybersecurity research. Members can find related education and research through the HIMSS Resource Center.
🔗 Explore Further: External References
- HHS — The Security Rule https://www.hhs.gov/hipaa/for-professionals/security/index.html
- HHS — Security Rule Laws and Regulations https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html
- HHS — HIPAA Security Rule Notice of Proposed Rulemaking Fact Sheet https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet/index.html
- Federal Register — HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (Proposed Rule) https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information
- HHS — Guidance on Risk Analysis https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html
- HIMSS — Healthcare Cybersecurity Community https://www.himss.org/networking/communities/healthcare-cybersecurity/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply