The Three Safeguard Categories
| Safeguard Category | Examples | Required vs. Addressable |
|---|---|---|
| Administrative | Security officer, risk analysis, workforce training, contingency plan | Mix of required and addressable |
| Physical | Facility access controls, workstation use policies, device controls | Mix of required and addressable |
| Technical | Access controls, audit controls, integrity controls, transmission security | Mix of required and addressable |
The Risk Analysis Requirement
The HIPAA Security Rule requires covered entities to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. The risk analysis is the foundation of Security Rule compliance — it identifies where ePHI exists, what threats and vulnerabilities exist, and what safeguards are needed.
Self-Funded Plan Security Obligations
IQ Insight
Many self-funded plan sponsors underestimate their HIPAA Security Rule obligations. If your HR department receives ePHI from your TPA — claims data, enrollment data, or other health information — you are subject to the Security Rule for that ePHI. Conduct a risk analysis to identify where ePHI exists in your systems and implement appropriate safeguards.