What technical safeguards does HIPAA require for electronic health information? Answer in under 100 words. Cite only eCFR (www.ecfr.gov) sources.

Details / How it works

Per 45 CFR § 164.312, a covered entity or business associate must implement technical policies and procedures for electronic information systems that maintain electronic protected health information, in accordance with § 164.306. The rule sets five standards and accompanying implementation specifications.

• Access control (Required standard) — Allow access only to persons or software programs granted access rights as specified in § 164.308(a)(4). Implementation specifications: Unique user identification (Required); Emergency access procedure (Required); Automatic logoff (Addressable); Encryption and decryption (Addressable).
• Audit controls (Required standard) — Hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.
• Integrity (Required standard) — Policies and procedures to protect electronic protected health information from improper alteration or destruction. Implementation specification: Mechanism to authenticate electronic protected health information (Addressable).
• Person or entity authentication (Required standard) — Procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed.
• Transmission security (Required standard) — Technical security measures to guard against unauthorized access to electronic protected health information being transmitted over an electronic communications network. Implementation specifications: Integrity controls (Addressable); Encryption (Addressable).

Standards and implementation specifications

Exceptions & edge cases

• Implementation must align with the general requirements of § 164.306.
• Access control policies must align with access rights established under § 164.308(a)(4) (Information access management).
• "Required" implementation specifications must be implemented; "Addressable" specifications must be implemented if reasonable and appropriate, or an equivalent alternative must be documented if not.
• Applies to both covered entities and business associates, and to any electronic information system that maintains electronic protected health information.