What is the HIPAA Security Rule?

The HIPAA Security Rule, located at 45 CFR Part 164, Subpart C, establishes national standards to protect electronic protected health information (ePHI). It requires covered entities and business associates to implement administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of ePHI.

Does the HIPAA Security Rule apply to small medical and dental practices?

Yes. The Security Rule applies to all covered entities that create, receive, maintain, or transmit electronic protected health information, regardless of size. Most health care providers, including small medical and dental practices, are covered entities. The rule allows flexibility in how safeguards are implemented based on the size and complexity of the organization.

What is a HIPAA risk analysis and is it required?

A HIPAA risk analysis is an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. It is required under 45 CFR 164.308(a)(1)(ii)(A). OCR has made the risk analysis a primary enforcement focus and has said that most of its large breach investigations reveal a lack of a compliant risk analysis.

What is the difference between required and addressable implementation specifications?

Under 45 CFR 164.306(d), required specifications must be implemented. For addressable specifications, a covered entity must assess whether the specification is reasonable and appropriate. If so, it must be implemented. If not, the entity must document why and implement an equivalent alternative measure if reasonable and appropriate.

What are the HIPAA breach notification requirements?

Under the Breach Notification Rule at 45 CFR 164.400-414, covered entities must notify affected individuals, the HHS Secretary, and (for breaches affecting more than 500 residents of a state or jurisdiction) prominent media outlets. Individual and media notices must be provided without unreasonable delay and no later than 60 days after discovery. Breaches affecting fewer than 500 individuals may be reported to HHS annually.

HIPAA Security for Small Practices Explained

HIPAA security for small practices means complying with the Security Rule at 45 CFR Part 164, Subpart C. According to HHS, the Security Rule "establishes national standards to protect individuals' electronic protected health information that is created, received, used, or maintained by a covered entity or its business associate." The rule applies to all covered entities regardless of size, including small medical and dental practices. HHS allows flexibility in how safeguards are implemented based on an organization's size, complexity, and capabilities, but the obligation to protect ePHI is the same for a solo practitioner as for a hospital system.

What does the HIPAA Security Rule actually require?

The Security Rule requires covered entities and business associates to implement three categories of safeguards to protect ePHI. According to the regulation text at 45 CFR 164.306(a), covered entities must: ensure the confidentiality, integrity, and availability of all ePHI; protect against reasonably anticipated threats or hazards; protect against impermissible uses or disclosures; and ensure workforce compliance. The three safeguard categories are:

Administrative safeguards (164.308): Policies and procedures to manage the security program, including the risk analysis, assigned security responsibility, workforce security, security awareness training, contingency planning, and business associate contracts.
Physical safeguards (164.310): Measures to protect electronic information systems and the facilities housing them, including facility access controls, workstation use and security, and device and media controls.
Technical safeguards (164.312): Technology and policies to protect ePHI and control access, including access control, audit controls, integrity controls, and transmission security.

The rule distinguishes between "required" and "addressable" implementation specifications. Under 45 CFR 164.306(d), required specifications must be implemented. For addressable specifications, a covered entity must assess whether the specification is "a reasonable and appropriate safeguard in its environment." If so, it must be implemented. If not, the entity must "document why it would not be reasonable and appropriate to implement the implementation specification" and "implement an equivalent alternative measure if reasonable and appropriate." Addressable does not mean optional.

Why is the risk analysis so important?

The risk analysis is the foundation of a compliant security program. The regulation at 45 CFR 164.308(a)(1)(ii)(A) states the requirement: "Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate." This is a required specification, not addressable.

HHS Office for Civil Rights (OCR) has made risk analysis a primary enforcement focus through its Risk Analysis Initiative. In a December 2024 compliance update presentation, OCR stated that "most OCR large breach investigations reveal a lack of a compliant risk analysis." In an April 2025 press release announcing a settlement with Northeast Radiology, OCR Acting Director Anthony Archeval stated: "A HIPAA risk analysis is essential to identifying where electronic protected health information is stored, and the security measures in place to protect it. A failure to conduct a risk analysis often foreshadows a future HIPAA breach."

HHS and the Office of the National Coordinator for Health IT (ONC) jointly developed a Security Risk Assessment Tool specifically for small and medium-sized practices. The free tool walks users through the risk assessment using a wizard-based approach and runs locally on Windows systems or in an Excel workbook format.

What has OCR enforced in recent risk analysis cases?

OCR's Risk Analysis Initiative has produced multiple enforcement actions. According to HHS press releases:

Northeast Radiology (April 10, 2025): A radiology provider in New York and Connecticut settled for $350,000 after unauthorized access to a PACS server exposed data on 298,532 patients. OCR found NERAD "had failed to conduct an accurate and thorough risk analysis."
BST & Co. CPAs (August 18, 2025): A New York accounting firm acting as a business associate settled for $175,000 following a ransomware attack. OCR found BST "had failed to conduct an accurate and thorough risk analysis."
Top of the World Ranch Treatment Center (February 19, 2026): A substance use disorder treatment provider in Illinois settled for $103,000 after a phishing attack compromised the ePHI of 1,980 patients. OCR found that TWRTC "failed to conduct an accurate and thorough risk analysis."
Four ransomware settlements (April 23, 2026): OCR announced settlements totaling $1,165,000 with four regulated entities: Regional Women's Health Group (Axia Women's Health), $320,000; Assured Imaging, $375,000; Consociate Health, $225,000; and Star Group Health Benefits Plan, $245,000.

The Northeast Radiology, BST, and Top of the World Ranch corrective action plans each required a new risk analysis, a risk management plan, and workforce training, monitored by OCR.

What are business associates and why do they matter?

A business associate is any person or entity that handles protected health information on behalf of a covered entity. For a small practice, common business associates include IT service providers, cloud EHR vendors, billing companies, and consultants who access patient data.

Under 45 CFR 164.308(b) and 164.314, the rule permits a business associate to create, receive, maintain, or transmit ePHI on your behalf only with satisfactory assurances, documented in a written contract (the BAA). The BAA must require the business associate to comply with the Security Rule, ensure that any subcontractors also agree to comply, and report security incidents including breaches.

This matters because a vendor with access to your data can become the path to it. BST, above, is a business associate whose ransomware attack exposed a client's patient data. We covered one such example in the ConnectWise Cloud Backup breach, where an exposed vendor credential put Microsoft 365 tenants at risk, including tenants an IT provider had connected on a customer's behalf. A BAA does not eliminate vendor risk, but it creates accountability and requires the vendor to maintain their own security controls.

What are the breach notification requirements?

The HIPAA Breach Notification Rule at 45 CFR 164.400-414 requires notification following a breach of unsecured protected health information. According to HHS:

Individual notice: Covered entities must notify affected individuals in writing without unreasonable delay and no later than 60 days after discovery. The notice must describe the breach, the types of information involved, steps individuals should take, and what the entity is doing in response.
Notice to the Secretary: Breaches affecting 500 or more individuals must be reported to HHS without unreasonable delay and no later than 60 days. Breaches affecting fewer than 500 individuals may be reported annually, no later than 60 days after the end of the calendar year.
Media notice: If a breach affects more than 500 residents of a state or jurisdiction, the covered entity must also notify prominent media outlets serving that area within the same 60-day period.

The 500-individual mark decides whether a breach is reported to HHS within 60 days or in the annual log, and media notice applies when more than 500 residents of one state or jurisdiction are affected. For more on notification requirements across jurisdictions, see our coverage of data breach notification laws.

Is the HIPAA Security Rule changing?

On January 6, 2025, HHS published a Notice of Proposed Rulemaking (NPRM) titled "HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information" in the Federal Register (90 FR 898). As of October 2026, this remains a proposed rule. The federal regulatory agenda lists final action as a long-term action projected for July 2027, though that date may change. No final rule has been published.

The HHS fact sheet stated: "While the Department is undertaking this rulemaking, the current Security Rule remains in effect." Small practices should focus on the current rule and monitor for updates.

What guidance is available for small practices?

NIST published Special Publication 800-66 Revision 2, "Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide" in February 2024. The publication provides practical guidance for regulated entities of all sizes, including mappings to the NIST Cybersecurity Framework and SP 800-53 controls. The HHS and ONC Security Risk Assessment Tool mentioned earlier is also designed for small practices and is free to use.

HIPAA security for small practices: what to check today

Based on OCR enforcement patterns and the Security Rule requirements, a small medical or dental practice should be able to confirm:

Risk analysis on file and current: A documented risk analysis that identifies where ePHI is stored, the threats and vulnerabilities, and the security measures in place. This should be updated when the environment changes.
MFA on EHR, email, and remote access: Multi-factor authentication on any system that accesses ePHI, including the electronic health record, email, and any remote access portal. Credential theft is a common attack vector.
Encryption of laptops and backups: ePHI on portable devices and backup media should be encrypted. Encryption provides a safe harbor under the Breach Notification Rule: if encrypted data is accessed but the key is not compromised, notification may not be required.
Access reviews: A periodic check that only current workforce members and authorized users have access to ePHI. Former employees and former contractors should have access revoked promptly. Our guide to access reviews covers how to build this habit.
Audit logs: The technical safeguard at 164.312(b) requires audit controls that "record and examine activity in information systems that contain or use electronic protected health information." Someone should be reviewing these logs for unusual access.
Backup and recovery testing: The contingency plan standard at 164.308(a)(7) requires a data backup plan and disaster recovery plan. Backups that have not been tested may fail when needed. Our piece on backup assumptions that fail covers common gaps.
BAAs signed with IT providers and cloud vendors: Every vendor that handles ePHI should have a signed business associate agreement on file.

Canadian readers should note that Canadian clinics fall under provincial health privacy laws and PIPEDA, not HIPAA. The requirements differ, and Canadian practices should consult guidance specific to their jurisdiction.

A question to ask your IT provider

A useful question to put to your IT lead or managed service provider this week: "When was our last HIPAA risk analysis completed, and where is the documentation?"

If the answer is uncertain or "we don't have one," that is the gap to close first. The risk analysis is required, and it is the focus of OCR's Risk Analysis Initiative.

If you are unsure where your practice stands on the security controls that underpin HIPAA compliance, a free cybersecurity assessment can help identify which areas need attention. The assessment takes under 5 minutes, covers 22 security areas, and requires no signup. It is not a HIPAA risk analysis, but it can surface gaps in the fundamentals that any compliant program needs to address.

This article is intended for general informational purposes only and does not constitute professional security, legal, or compliance advice. HIPAA requirements are based on the regulation text at 45 CFR Part 164 and official HHS guidance as of the date of publication and may change. Cyber Unit does not provide HIPAA certification (no such official credential exists) and is not a law firm. Organizations should consult qualified legal, privacy, and cybersecurity professionals to determine their specific HIPAA compliance obligations.