HIPAA Security Rule Safeguards: Administrative, Physical & Technical Controls Explained

The HIPAA Security Rule (45 CFR Part 164, Subpart C) protects electronic protected health information (ePHI) through safeguards in three categories: administrative, physical, and technical. Every requirement in the rule — and every question in the official HHS risk assessment — maps to one of these three buckets.

A key design feature: the rule is flexible and scalable. Standards say what must be protected, but implementations are “reasonable and appropriate” for the organization’s size, complexity, and risk. A two-provider dental office and a regional hospital are assessed against the same standards and very different implementations.

1. Administrative Safeguards (45 CFR § 164.308)

Administrative safeguards are the management and process controls that govern how the organization handles ePHI — the policies, people, and procedures layer. They include:

• Risk analysis and risk management — the required assessment at 45 CFR § 164.308(a)(1)(ii)(A), plus a plan that reduces identified risks to an acceptable level
• Workforce security and training — authorization and supervision of staff, plus security awareness training for every workforce member
• Business associate agreements — contracts requiring third parties to safeguard ePHI they handle for you
• Contingency planning — data backup, disaster recovery, and emergency-mode operation plans
• Incident response — documented procedures for responding to security incidents and suspected breaches
• Periodic evaluations — reviewing the effectiveness of safeguards in response to changes

Real-world examples: an annual risk assessment, a written security policy that staff actually sign, role-based access to records, and a tested backup restore procedure.

2. Physical Safeguards (45 CFR § 164.310)

Physical safeguards protect the facilities and devices where ePHI lives. The standards cover:

• Facility access controls — limiting physical access to areas where ePHI is stored, with contingency operations for emergencies (badges, locks, visitor logs)
• Workstation use and security — defining how workstations must function and be positioned to protect ePHI (screen placement, session locks)
• Device and media controls — policies for moving, reusing, and disposing of hardware and media that contain ePHI (encrypted disposal, asset tracking, offsite backups)

Real-world examples: a locked server closet, a clean-desk policy, laptops that employees never leave unlocked in public, and a documented wipe-and-recycle process for retired devices.

3. Technical Safeguards (45 CFR § 164.312)

Technical safeguards are the automated mechanisms that control access to and protect ePHI in systems. The standards cover:

• Access control — unique user identification, emergency access procedures, automatic logoff, and encryption and decryption of ePHI
• Audit controls — recording and examining who did what in systems that handle ePHI
• Integrity — mechanisms to confirm ePHI has not been improperly altered or destroyed
• Transmission security — protecting ePHI in transit, including encryption when appropriate (TLS for portals and email)

Real-world examples: unique logins (no shared accounts), multi-factor authentication, full-disk encryption on laptops, an audit log on the EHR, and HTTPS-only connections for anything carrying patient data.

How the Safeguards Map to the Risk Assessment

The seven SRA sections cover the full rule: policies and workforce questions exercise the administrative safeguards, facility and device questions exercise the physical safeguards, and data access and encryption questions exercise the technical safeguards — with a Threats & Vulnerabilities block in each section scored on a 3×3 likelihood/impact matrix. Run the assessment once and you get a coverage map across all three categories, which is exactly what a Security Rule review, complaint investigation, or settlement monitors. The rule’s teeth are real: the 2026 Spencer Gifts case shows OCR enforcing the same standards against a national retailer’s group health plan.

Want the full process? Read our step-by-step guide to running a HIPAA risk assessment, or jump straight into the tool.