How to HIPAA: Data Security
Free HIPAA guide · 7 controls · 2 templates
Encryption, integrity, and transmission security for ePHI at rest and in motion. The sections below are assembled from the same control catalog, threat library, and enforcement mapping our free assessment runs on.
The controls in this area
The 45 CFR §164 requirements HIPAA places here: 7 of the 103 controls in our catalog. Our free templates and assessment track each one:
164.310(d)(2)(iv) · 164.312(a)(2)(iv) · 164.312(c)(1) · 164.312(c)(2) · 164.312(e)(1) · 164.312(e)(2)(i) · 164.312(e)(2)(ii)
What enforcement looks like here
OCR's recurring investigation findings in this area:
- Encryption of ePHI 164.312(a)(2)(iv) / (e)(2)(ii)
- Transmission security 164.312(e)(1)
Breach causes reported to HHS that implicate these controls: Hacking/IT · Improper Disposal
Related threat scenarios
Common threats (NIST SP 800-30 classes) that this area's controls defend against:
- StructuralExpired TLS / certificate failure
Exploits: No transmission integrity monitoring · 164.312(e) Transmission Security
- AdversarialStolen / lost device
Exploits: Endpoint not encrypted · 164.312(a)(2)(iv) Encryption; 164.310(d) Device Controls
- AdversarialMalicious insider / excess access
Exploits: No least-privilege; no access reviews · 164.308(a)(4) Access Mgmt; 164.312(a) Access Control
- AccidentalAccidental disclosure / over-share
Exploits: No access controls on shares · 164.312(a) Access Control; 164.514(d)
Free templates for this area
De-branded policy and procedures templates mapped to this area's controls. Read the full text free, then adapt them to your organization:
See where your organization stands on the 7 controls in this area.
Join Us