HIPAA (the Health Insurance Portability and Accountability Act) sets the rules for how healthcare organizations use, disclose, and protect PHI. In a cybersecurity context, HIPAA isn't a history lesson—it's the standard that determines what safeguards your organization is required to put in place.
HIPAA's requirements break down into three safeguard categories, and understanding them is the foundation for everything else in this guide:
Administrative safeguards cover the policies, training, and risk management processes that govern how your organization handles PHI—things like designating a security official, running regular risk assessments, and training staff on how to handle patient data.
Physical safeguards govern the physical access to the systems and locations where PHI lives, from locked server rooms to workstation access controls.
Technical safeguards are where cybersecurity does most of its work: encryption, access controls, audit logs, and the tools that protect electronic PHI (ePHI) from unauthorized access.
These safeguards are enforced through two core rules. The Privacy Rule sets the national standard for who can access PHI and under what circumstances. The Security Rule requires the administrative, physical, and technical safeguards above for ePHI specifically. A third rule, the Breach Notification Rule, requires organizations to notify affected individuals, HHS, and in some cases the media when a breach occurs—more on that later in this guide.
