The HIPAA Security Rule's technical safeguards are the technology controls set out in 45 CFR §164.312, the section of the rule that governs how covered entities protect electronic protected health information (ePHI) through access controls, audit logs, encryption, and authentication. This HIPAA technical safeguards checklist for small medical practices breaks down every specification in that section, flags what the HHS Office for Civil Rights (OCR), the federal agency that enforces HIPAA and investigates breach reports, expects during an audit or investigation, and gives solo physician offices, two to five provider clinics, and specialty practices without dedicated IT staff a direct path to implementation.
The rule groups technical safeguards into five standards: access control, audit controls, integrity, person or entity authentication, and transmission security. Each standard has implementation specifications that are either required, meaning you must implement them exactly as written, or addressable, meaning you must assess whether the control fits your practice and either implement it or document an equivalent alternative. Getting that distinction right before you start remediation work prevents both wasted effort and dangerous gaps.
According to the HHS Office for Civil Rights breach portal, more than 700 large-scale healthcare breaches were reported in 2023, with hacking and unauthorized access as the dominant cause. Practice size does not create an exemption: OCR investigates incidents affecting as few as one patient.
Quick Answer
HIPAA's technical safeguards checklist under 45 CFR §164.312 covers five standards: access control, audit controls, integrity, authentication, and transmission security. Unique user identification, an emergency access procedure, audit controls, and person or entity authentication are required outright, while automatic logoff, encryption, integrity monitoring, and transmission encryption are addressable, meaning you must assess them and either implement them or document an equivalent alternative. Addressable does not mean optional. Most small practices find that implementing every addressable specification costs far less than the liability of skipping it.
Key Takeaway
- Two specifications are required outright: unique user identification and person or entity authentication, now generally met with multi-factor authentication (MFA).
- Addressable specifications like encryption, automatic logoff, and transmission integrity controls still need a written assessment, not a skip.
- Encrypting ePHI on devices qualifies for the HIPAA breach notification safe harbor under 45 CFR §164.402, removing the duty to report a lost or stolen encrypted device as a breach.
- Audit logs must be retained for six years and reviewed on a defined schedule, not just switched on.
- OCR investigates breaches affecting as few as one patient, so practice size creates no exemption from §164.312.
Healthcare Data Breach Risk by the Numbers
IBM's 2024 Cost of a Data Breach Report attributes the higher healthcare figure to the sensitivity and resale value of medical records compared with other data types, which is part of why §164.312 compliance carries more weight in a medical practice than it might in a lower-risk business.
Before working through the checklist, understand the required versus addressable framework, because misreading it is the most common compliance error among small practices. Many administrators see 'addressable' and assume it means optional. HHS has stated plainly that this reading is wrong.
An addressable specification requires your practice to assess whether the control is reasonable and appropriate given your size, capabilities, and the ePHI you handle. If it is, you must implement it. If you decide it is not, a high bar to clear, you must document that determination in writing and put an equivalent alternative measure in place.
For most small medical practices, the addressable technical safeguards under §164.312, automatic logoff, encryption, integrity monitoring, and transmission encryption, are all reasonable and appropriate to implement. Configurable session timeouts built into most EHR platforms, AES-256 encryption software, and TLS-enabled hosting cost little relative to the liability of skipping them.
Access control is the entry point for the technical safeguards framework. Section 164.312(a)(1) requires technical policies that limit ePHI access to authorized users, programs, or processes. Four specifications fall under this standard, and the first two are required outright.
Unique user identification (required). Every staff member who touches ePHI, physicians, nurses, medical assistants, front desk staff, and billing personnel, needs their own username and password. Shared logins violate this specification directly and make audit logs useless, because without unique identifiers you cannot determine who viewed or changed a record. Set up role-based access through your EHR's user management tools so a front desk coordinator does not hold the same access level as an attending physician.
Emergency access procedure (required). Your practice needs a documented procedure for reaching ePHI when normal authentication is unavailable, during a system outage, a vendor incident, or a medical emergency that requires immediate record access. Write the procedure into policy, communicate it to the staff who need it, and test it at least once a year.
Automatic logoff (addressable). Workstations and EHR sessions should lock automatically after a set period of inactivity. Most EHR platforms let you configure this, and 15 minutes is the industry standard. It matters most in shared clinical spaces where several staff members use the same workstation throughout the day.
Encryption and decryption (addressable). Apply AES-256 encryption, a federally approved encryption standard, to ePHI stored on workstations, servers, laptops, mobile devices, and USB drives. This addressable specification carries one of the most concrete benefits available to a small practice: the HIPAA breach notification safe harbor.
The HIPAA Encryption Safe Harbor
Under 45 CFR §164.402, ePHI encrypted using NIST-approved methods is excluded from the definition of a reportable breach if the decryption key was not also compromised. A lost or stolen encrypted laptop does not trigger notification duties to OCR or to patients. For a practice that uses laptops or portable storage, this is one of the most valuable protections in the technical safeguards framework, and one more reason to treat encryption as effectively required even though its specification status is addressable.
Audit controls, §164.312(b) (required). Your practice must implement hardware, software, and procedural mechanisms that record and examine activity in any system containing ePHI, your EHR, billing software, cloud storage, email, and remote access tools included. Logs should capture login and logout events, record views and edits, bulk exports, failed logins, and permission changes. HIPAA requires retaining this documentation for six years, and logs need review at least monthly, with anomalies such as off-hours access or repeated failed logins investigated promptly.
Integrity, §164.312(c)(1) (addressable). ePHI must not be altered or destroyed without detection. Practices on a cloud-based EHR should confirm with their vendor that integrity controls are built into the platform, usually documented in the Business Associate Agreement (BAA), the contract that binds a vendor to HIPAA's security requirements, and its security addendum. Practices running on-premises servers should deploy file integrity monitoring or confirm their backup tool includes checksum verification.
Person or entity authentication, §164.312(d) (required). Your practice must verify the identity of anyone requesting ePHI access before granting it. In 2026, multi-factor authentication (MFA), a login method that requires at least two independent proofs of identity such as a password plus a one-time code, is the recognized way to satisfy this requirement. NIST Special Publication 800-63B sets the federal digital identity guidelines that align with this standard. SMS-based MFA has documented weaknesses to SIM-swapping attacks, so an authenticator app or a hardware security key gives stronger assurance. Pairing MFA with strong, unique passwords, a combination the Cybersecurity and Infrastructure Security Agency (CISA) recommends, addresses the two most commonly exploited authentication weaknesses in healthcare settings.
HIPAA Technical Safeguards Implementation Steps
Complete a HIPAA security risk assessment
Conduct a formal risk assessment under §164.308(a)(1) before implementing technical safeguards. Document every ePHI location, access path, and potential threat.
Inventory every ePHI system and access point
List each system where ePHI is stored, processed, or transmitted: EHR, billing software, email, cloud storage, mobile devices, telehealth platforms, and networked medical equipment.
Assign unique credentials and remove shared logins
Create an individual account for every staff member who accesses ePHI, and eliminate shared accounts. Configure role-based access so each user reaches only the ePHI their job requires.
Deploy multi-factor authentication
Turn on MFA for every ePHI-bearing system, starting with the EHR, email, and remote access tools. Prefer authenticator apps or hardware security keys over SMS codes.
Enable and configure audit logging
Turn on audit log features across the EHR, billing system, and cloud platforms. Assign a staff member to review logs at least monthly and retain them for six years.
Encrypt ePHI at rest and in transit
Apply AES-256 encryption to workstations, servers, laptops, and portable media. Confirm TLS 1.2 or higher is active on every web-based ePHI transmission, and use an encrypted email gateway for external messages.
Configure automatic session timeouts
Set workstations and EHR sessions to lock after 15 minutes of inactivity, and confirm the setting applies to both in-office and remote sessions.
Document every addressable specification decision
For each addressable specification, record in writing whether you implemented it or adopted an equivalent alternative, along with your risk-based rationale. Retain this file for six years.
Execute business associate agreements
Confirm a signed BAA is in place with every vendor handling ePHI: EHR provider, billing service, cloud storage platform, email provider, and telehealth vendor.
Schedule annual reviews and staff training
Review and update technical safeguards at least once a year and after any significant system change, new vendor relationship, or security incident. Pair technical controls with regular HIPAA staff training.
The transmission security standard requires technical measures that protect ePHI against unauthorized access while it moves across a network. Both of its implementation specifications are addressable, but OCR expects both in virtually every practice where ePHI travels across a network.
Integrity controls in transit. Transport Layer Security (TLS) 1.2 or higher, a protocol that encrypts data and verifies it was not altered in transit, covers web-based ePHI transmissions. Your patient portal, telehealth platform, and EHR web interface should all run on TLS 1.2 or 1.3. Check your vendor's BAA addendum or security whitepaper for confirmation.
Transmission encryption. Encrypt ePHI whenever it crosses a public network. Standard, unencrypted SMTP email is not a compliant channel. Use a HIPAA-compliant secure messaging platform or a secure email gateway that applies transport-layer or end-to-end encryption to outbound messages.
Where Transmission Encryption Applies
- Patient portal messages and appointment reminders that contain ePHI
- Telehealth video sessions and in-session file or image sharing
- Electronic referrals and care coordination messages between providers
- ePHI sent to business associates such as labs, imaging centers, and billing services
- Remote staff accessing the EHR or patient records over a public internet connection
Before using any third-party platform to send ePHI, confirm you have a signed business associate agreement with that vendor. Transmission security extends past standard IT too, networked clinical equipment and connected diagnostic tools transmit ePHI and need the same TLS and encryption controls. Practices offering virtual visits should also see our guide to HIPAA-compliant video conferencing for telehealth providers for platform-specific requirements.
MythAn 'addressable' specification is optional.
An 'addressable' specification is optional.
HHS requires every addressable specification to be assessed and either implemented or replaced with a documented equivalent alternative. Silence is not an acceptable response.
MythA practice with only a few employees is too small for OCR to investigate.
A practice with only a few employees is too small for OCR to investigate.
OCR investigates breaches affecting as few as one patient and has assessed civil monetary penalties against solo practitioners and small clinics.
MythBecause encryption is addressable, it can be skipped without consequence.
Because encryption is addressable, it can be skipped without consequence.
Encryption is the only reliable way to qualify for the HIPAA breach notification safe harbor under 45 CFR §164.402, and HHS treats it as the expected baseline for any practice handling ePHI.
Implementing technical safeguards is only half the requirement. Section 164.316 requires written policies and procedures for every Security Rule requirement, including the reasoning behind each addressable specification decision, retained for six years from its creation date or last effective date, whichever is later.
For each item on your technical safeguards checklist, your file should note the date the control was implemented, the staff member or vendor responsible, the system or scope it covers, and the next scheduled review date. Any addressable specification you did not implement in the standard form also needs the risk assessment rationale and a description of the alternative measure adopted.
Annual reviews are a Security Rule requirement under §164.306(e), which directs covered entities to review and update their security measures as needed. In practice, that means a full review of the technical safeguards program at least once a year, plus a review after any of the triggering events below.
When to Review Your Technical Safeguards Outside the Annual Cycle
- A change in your EHR platform, billing software, or cloud services
- Addition of a new office location or remote access capability
- Onboarding a new business associate, such as a telehealth vendor or cloud storage provider
- A security incident or near-miss, even if it did not become a reportable breach
- Staff changes that affect system access permissions at an administrative or clinical level
A well-configured MFA system or audit log provides no protection if staff bypass it or share credentials, so pair every technical control with regular HIPAA staff training. Technical controls and workforce training depend on each other, neither is sufficient alone.
These same §164.312 requirements apply without modification to specialty practices. Our guide to HIPAA compliance for chiropractors covers how the technical safeguards checklist applies outside a standard physician office. For background on how access control, audit logs, and encryption map to the properties the Security Rule is built to protect, see our explainer on the CIA triad of confidentiality, integrity, and availability. For primary-source implementation detailNIST Special Publication 800-66 Revision 2 was written specifically to help healthcare organizations implement the Security Rule's technical and administrative requirements at scale.
Managed endpoint security for your §164.312 program
Bellator Core combines managed EDR, remote monitoring, and Ransomware Rollback to support the endpoint-level pieces of a HIPAA technical safeguards program, continuous monitoring, audit visibility, and ransomware recovery, at $33 per device per month.
Schedule Your HIPAA Endpoint Review
Get a practical review of how your current endpoints measure up against the §164.312 technical safeguards your practice is required to document.
Frequently Asked Questions
HIPAA technical safeguards are the technology controls required under the HIPAA Security Rule at 45 CFR §164.312 to protect electronic protected health information (ePHI). They cover five standards: access control, audit controls, integrity, person or entity authentication, and transmission security. These standards define how information systems must restrict access, monitor activity, protect stored data, verify user identity, and secure ePHI in transit, distinct from the Security Rule's physical and administrative safeguard categories.
Not every specification carries the same status. 'Required' specifications must be implemented exactly as written. 'Addressable' specifications must be assessed for whether they are reasonable and appropriate, then either implemented or replaced with a documented equivalent alternative. HHS has stated that addressable does not mean optional; the documentation obligation applies regardless of the decision. Most small practices find it reasonable and appropriate to implement every addressable technical safeguard.
Yes. The HIPAA Security Rule applies to every covered entity that creates, receives, maintains, or transmits ePHI, including solo practitioners and small clinics. There is no small-business exemption from §164.312. The rule allows flexibility in how a practice implements controls based on size and resources, but it does not waive any standard, and OCR has assessed civil monetary penalties against solo practitioners and small clinics.
Under HHS's tiered civil penalty structure at 45 CFR §160.404, OCR can assess penalties ranging from roughly $137 to $68,928 per violation, with annual caps up to about $2,067,813 per violation category. Which tier applies depends on whether the violation was unknowing, due to reasonable cause, or the result of willful neglect. Technical safeguard failures found during a breach investigation tend to draw higher penalties because they point to a systemic gap in the security program, and state attorneys general can also bring their own enforcement actions under HITECH.
Encryption is formally an addressable specification under both §164.312(a) for data at rest and §164.312(e) for data in transit, so it is not an absolute requirement in the text of the rule. In practice, HHS guidance treats encryption as the expected baseline, and a practice that skips it carries real documentation and liability exposure. Encryption is also the only reliable way to qualify for the HIPAA breach notification safe harbor under 45 CFR §164.402, which excludes properly encrypted ePHI from the definition of a reportable breach when the decryption key was not also compromised.
The HIPAA Security Rule divides its requirements into three categories. Administrative safeguards (§164.308) are the policies, procedures, and workforce programs that govern security management, including the risk analysis, training program, and contingency planning. Physical safeguards (§164.310) govern physical access to ePHI-bearing systems and devices: facility access controls, workstation placement, and device disposal. Technical safeguards (§164.312) are the technology controls, access restrictions, audit logging, encryption, and authentication, that protect ePHI wherever it is stored, processed, or transmitted electronically.
From requirement to defensible practice
Turn HIPAA requirements into safeguards that fit patient care
A useful compliance path makes the obligation clear, identifies the evidence to retain, and connects written policy to the safeguards used every day.
People also look for
Keep exploring HIPAA security
Connect HIPAA requirements to the safeguards, assessments, and everyday decisions a healthcare practice can actually implement.
- Common question: HIPAA cybersecurity requirementsUse the plain-language HIPAA guideUnderstand administrative, physical, and technical safeguards without sorting through legal language.
- Common question: HIPAA security risk assessmentPrepare for a HIPAA risk assessmentIdentify vulnerabilities, document risk, and prioritize the gaps that matter most.
- Common question: HIPAA Security Rule explainedReview the HIPAA Security RuleSee how the standards and implementation specifications fit together.
- Common question: healthcare ransomware protectionReduce healthcare ransomware riskProtect patient data and keep clinical operations recoverable after an attack.
- Common question: HIPAA endpoint securityProtect practice workstations and devicesApply managed endpoint detection to the devices that access protected health information.
