---
title: "What technical safeguards does HIPAA require for electronic health information? Answer in under 100 words. Cite only eCFR (www.ecfr.gov) sources."
canonical: https://www.m-i-n-d.ai/minds/hipaa/hipaa-technical-safeguards-ephi
jurisdiction: "US Federal"
last_verified: 2026-08-27
license: CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/
attribution: "Source: MIND (m-i-n-d.ai)"
---

# What technical safeguards does HIPAA require for electronic health information? Answer in under 100 words. Cite only eCFR (www.ecfr.gov) sources.

Under 45 CFR § 164.312, as published at 68 FR 8376 (Feb. 20, 2003) and amended at 78 FR 5694 (Jan. 25, 2013), covered entities and business associates must implement five technical safeguards for electronic protected health information in accordance with § 164.306: access control, audit controls, integrity, person or entity authentication, and transmission security. Access control policies must align with the access rights specified in § 164.308(a)(4). Required implementation specifications include unique user identification and an emergency access procedure, with addressable specifications covering automatic logoff and encryption/decryption.

## Details / How it works

Per 45 CFR § 164.312, a covered entity or business associate must implement technical policies and procedures for electronic information systems that maintain electronic protected health information, in accordance with § 164.306. The rule sets five standards and accompanying implementation specifications.

- **Access control (Required standard)** — Allow access only to persons or software programs granted access rights as specified in § 164.308(a)(4). Implementation specifications: Unique user identification (Required); Emergency access procedure (Required); Automatic logoff (Addressable); Encryption and decryption (Addressable).
- **Audit controls (Required standard)** — Hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.
- **Integrity (Required standard)** — Policies and procedures to protect electronic protected health information from improper alteration or destruction. Implementation specification: Mechanism to authenticate electronic protected health information (Addressable).
- **Person or entity authentication (Required standard)** — Procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed.
- **Transmission security (Required standard)** — Technical security measures to guard against unauthorized access to electronic protected health information being transmitted over an electronic communications network. Implementation specifications: Integrity controls (Addressable); Encryption (Addressable).

## Standards and implementation specifications

| Standard | Implementation specification | Type |
|---|---|---|
| Access control (§ 164.312(a)(1)) | Unique user identification (§ 164.312(a)(2)(i)) | Required |
| Access control (§ 164.312(a)(1)) | Emergency access procedure (§ 164.312(a)(2)(ii)) | Required |
| Access control (§ 164.312(a)(1)) | Automatic logoff (§ 164.312(a)(2)(iii)) | Addressable |
| Access control (§ 164.312(a)(1)) | Encryption and decryption (§ 164.312(a)(2)(iv)) | Addressable |
| Audit controls (§ 164.312(b)) | — | (standard only) |
| Integrity (§ 164.312(c)(1)) | Mechanism to authenticate electronic protected health information (§ 164.312(c)(2)) | Addressable |
| Person or entity authentication (§ 164.312(d)) | — | (standard only) |
| Transmission security (§ 164.312(e)(1)) | Integrity controls (§ 164.312(e)(2)(i)) | Addressable |
| Transmission security (§ 164.312(e)(1)) | Encryption (§ 164.312(e)(2)(ii)) | Addressable |

## Exceptions & edge cases

- Implementation must align with the general requirements of § 164.306.
- Access control policies must align with access rights established under § 164.308(a)(4) (Information access management).
- "Required" implementation specifications must be implemented; "Addressable" specifications must be implemented if reasonable and appropriate, or an equivalent alternative must be documented if not.
- Applies to both covered entities and business associates, and to any electronic information system that maintains electronic protected health information.

## Sources

- [1] U.S. Government Publishing Office / Department of Health and Human Services — 45 CFR 164.312 — Technical safeguards for electronic protected health information · https://www.ecfr.gov/current/title-45/section-164.312 · as of 2026-08-27