About this Framework
The HIPAA Security Rule establishes national standards to protect electronic protected health information (ePHI) created, received, used or maintained by covered entities. Requiring administrative, physical and technical safeguards, violations result in civil penalties from $100 to $50,000 per violation with annual caps reaching $1.9 million per violation category, plus potential criminal prosecution.
Key Control Domains
Administrative Safeguards
Physical Safeguards
Technical Safeguards
Organisational Requirements
Policies & Procedures
Documentation Requirements
Who Needs This?
- Healthcare providers (hospitals, clinics, physicians)
- Health plans and health insurance companies
- Healthcare clearinghouses
- Business associates handling ePHI (IT vendors, cloud providers, consultants)
Compliance Benefits
- Legal compliance and avoidance of OCR fines
- Patient trust and protection of sensitive health data
- Prerequisite for healthcare IT vendor contracts
- Structured ePHI risk management program
Official Reference
HHS HIPAA Security Rule
https://www.hhs.gov/hipaa/for-professionals/security/index.html
Assessment Details
Share this Assessment
Share this permanent link with your team, clients or auditors.
https://grcopilot.app/frameworks/hipaa-security-rule