HIPAA's Security Rule requires covered entities and business associates to
implement technical safeguards protecting electronic protected health
information (ePHI). But the regulation's language is deliberately general
— leaving many organizations uncertain what "adequate" actually looks
like. Here are the 10 technical safeguards that OCR auditors focus on.
1
Unique User Identification
Every user accessing ePHI must have a unique ID. Shared logins are a
direct HIPAA violation and a common audit finding. Implement SSO with
individual accounts and audit active user lists quarterly.
Workstations and applications accessing ePHI must auto-lock after a
period of inactivity. Most OCR auditors expect 15 minutes or less.
3
Encryption in Transit and at Rest
All ePHI must be encrypted using NIST-approved algorithms. TLS 1.2+
for data in transit; AES-256 for data at rest. Unencrypted laptops
holding ePHI are the most common breach vector in healthcare.
4
Audit Controls and Logging
Hardware, software, and procedural mechanisms must record and examine
activity in systems containing ePHI. Logs must be retained for at
least 6 years and reviewed regularly.
5
Email Authentication (DMARC/SPF/DKIM)
Phishing via spoofed provider email is the #1 initial access vector in
healthcare breaches. Proper DMARC enforcement prevents attackers from
impersonating your domain. This also directly impacts your
cybersecurity rating.
6
Multi-Factor Authentication
While not explicitly mandated by the 2013 HIPAA Rule, OCR's 2024 NPRM
is expected to make MFA a required implementation specification. All
organizations should implement MFA now for any system accessing ePHI.
OCR investigators and third-party auditors increasingly use cybersecurity
ratings as a risk-triage tool. A D or F rating often flags the same
deficiencies that lead to HIPAA violations: missing email authentication,
unpatched software, and exposed credentials. Improving your security
rating is effectively a proxy for improving HIPAA compliance posture.
See your security rating and get a HIPAA-specific remediation roadmap.
No system access needed.
Get My Free Assessment