The HIPAA Security Rule is a 2005 addition to the original Health Insurance Portability and Accountability Act of 1996 (HIPAA). HIPAA required the Secretary of the US Department of Health and Human Services (HHS) to develop regulations protecting the privacy and security of certain health information.
The HIPAA Security Rule operationalizes the protections contained in the HIPAA Privacy Rule by addressing the administrative, physical, and technical safeguards that organizations called covered entities must put in place to secure individuals’ electronic protected health information or ePHI.
Specifically, covered entities must:
A primary goal of the Security Rule is to protect the privacy of individuals’ health information while allowing covered entities to adopt new technologies to improve the quality and efficiency of patient care. The Security Rule is designed to be flexible and scalable so a covered entity can implement policies, procedures, and technologies appropriate for the entity’s size, organizational structure, and risks to consumers’ ePHI.