Protecting electronic health data (Security Rule)
HIPAA (Health Insurance Portability and Accountability Act) governs the protection of health information in the United States, but serves as an international reference for any organization processing electronic protected health information (ePHI) - including outside the United States, for contractual reasons with American partners. The framework covered here is specifically the Security Rule (Title 45, Parts 160, 162 and 164 Subpart C): the security safeguards, not the Privacy Rule or the Breach Notification Rule, which fall under a separate legal scope.
Three categories of safeguards
The Security Rule structures its requirements into administrative safeguards (risk analysis, access management, training), physical safeguards (access control to premises and workstations, media management) and technical safeguards (logical access control, encryption, logging of access to ePHI). An organization cannot settle for the technical side alone: the administrative risk analysis is the prerequisite that justifies the choice and sizing of the other measures.
Covered entities and business associates
The rule distinguishes covered entities (healthcare providers, health insurers) from their business associates that access ePHI on their behalf - a cloud host or a vendor of patient record management software is one of them, and must sign a specific Business Associate Agreement setting out its own security obligations.
Suggestion provided for educational purposes - human validation required. This guide does not constitute legal advice and does not replace an accredited external auditor.