HIPAA Security Rule
45 CFR Part 164, Subpart C · Read 2026-08-15
In force. Covered entities and business associates apply the safeguards to electronic protected health information.
Identifier
- Identifier
- 45 CFR Part 164, Subpart C
- Level
- Federal
- Status
- In force
- Adopted
- 2003-02-20
- Applies from
- 2005-04-20
- Supervisory bodies
- HHS OCR
Named requirements
Administrative safeguards
Risk analysis, workforce access, training and incident procedures.
Physical safeguards
Facility access, workstation use and media handling.
Technical safeguards
Access control, audit controls, integrity and transmission security.
Business associate contracts
Written terms with every party that handles the data on your behalf.
Official source
EU acts on the same ground
- CELEX 32016R0679
Both texts require documented security measures and written terms with processors. HIPAA is limited to health data, the EU text is not.
United States case law
20 decisions · Read from CourtListener, Free Law Project on 2026-08-22.
- Queerdoc, Pllc v. DOJ - United States Department of Justice
9th Cir.Open to review by a higher court, the source does not state the outcome
Ask NovaCopilotGet the opinionRetrieved directly from Court of Appeals for the Ninth Circuit when you click. No permanent storage on our side.
- Daniel Mook v. G. Hall
4th Cir.Open to review by a higher court, the source does not state the outcome
Ask NovaCopilotGet the opinionRetrieved directly from Court of Appeals for the Fourth Circuit when you click. No permanent storage on our side.
- Jannease Johnson v. DC
D.C. Cir.Open to review by a higher court, the source does not state the outcome
Ask NovaCopilotGet the opinionRetrieved directly from Court of Appeals for the D.C. Circuit when you click. No permanent storage on our side.
- William Clements v. Gunnar Optiks, LLC
7th Cir.Open to review by a higher court, the source does not state the outcome
Ask NovaCopilotGet the opinionRetrieved directly from Court of Appeals for the Seventh Circuit when you click. No permanent storage on our side.
- Andrea Tumbleson v. Lakota Local Sch. Dist.
6th Cir.Open to review by a higher court, the source does not state the outcome
Ask NovaCopilotGet the opinionRetrieved directly from Court of Appeals for the Sixth Circuit when you click. No permanent storage on our side.
- Greg Hale v. ARcare, Inc
8th Cir.Open to review by a higher court, the source does not state the outcome
Ask NovaCopilotGet the opinionRetrieved directly from Court of Appeals for the Eighth Circuit when you click. No permanent storage on our side.
- Axis Insurance Company v. Barracuda Networks, Inc.
1st Cir.Open to review by a higher court, the source does not state the outcome
Ask NovaCopilotGet the opinionRetrieved directly from Court of Appeals for the First Circuit when you click. No permanent storage on our side.
- Blakesley v. Marcus
1st Cir.Open to review by a higher court, the source does not state the outcome
Ask NovaCopilotGet the opinionRetrieved directly from Court of Appeals for the First Circuit when you click. No permanent storage on our side.
- Kirstyn Bashaw v. Majestic Care of Whitehall
130 F.4th 5426th Cir.Open to review by a higher court, the source does not state the outcome
Ask NovaCopilotGet the opinionRetrieved directly from Court of Appeals for the Sixth Circuit when you click. No permanent storage on our side.
- Doe v. Integris Health
123 F.4th 118910th Cir.Open to review by a higher court, the source does not state the outcome
Ask NovaCopilotGet the opinionRetrieved directly from Court of Appeals for the Tenth Circuit when you click. No permanent storage on our side.
- Michael Terpin v. at and T Mobility LLC
118 F.4th 11029th Cir.Open to review by a higher court, the source does not state the outcome
Ask NovaCopilotGet the opinionRetrieved directly from Court of Appeals for the Ninth Circuit when you click. No permanent storage on our side.
- Wiener v. AXA Equitable Ins. Co.
2d Cir.Open to review by a higher court, the source does not state the outcome
Ask NovaCopilotGet the opinionRetrieved directly from Court of Appeals for the Second Circuit when you click. No permanent storage on our side.
Change monitoring
The row is re-read against the publisher's own publication on a fixed interval. The dates below can be checked on the spot and travel with the API response.
| Field | Value |
|---|---|
| Register | HHS OCR, 45 CFR Part 164, Subpart C |
| Publisher | U.S. Department of Health and Human Services, Office for Civil Rights |
| Last read | 2026-08-15 |
| Interval | Every 30 days |
| Next re-read | 2026-09-14 |
| Status | Re-read overdue |
Row history
Dated events concerning this exact row, newest first. No event appears here without a date in a primary source.
| Date | Event | Source |
|---|---|---|
| 2026-08-15 | Row read against the official publication | U.S. Department of Health and Human Services, Office for Civil Rights |
| 2005-04-20 | Date of application according to the publisher | U.S. Department of Health and Human Services, Office for Civil Rights |
| 2003-02-20 | Adopted under 45 CFR Part 164, Subpart C | U.S. Department of Health and Human Services, Office for Civil Rights |
Monitoring states when the row was checked, not how the legal position should be assessed.
Cite this row
The string below travels with a memo, a case file or an agent chain. The same string sits in the citation field of the API response.
45 CFR Part 164, Subpart C, HIPAA Security Rule. NovaCopilot, https://legal.exploreworldai.com/us/regler/hipaa-security-rule (hämtad 2026-10-23, bevis sha256:716cfb9447f93f6b, bygge legal-2026-10-23).
- sha256:
- 716cfb9447f93f6bf53cbd545fa1f09bdda6366f2c38ec72922b8094e963ed81
- hämtad:
- 2026-10-23
- source_confidence:
- official
- bygge:
- legal-2026-10-23
Official publication. The address points to the authority or court that published the row. Office of the Federal Register, eCFR.
The row is a source reference with an official identifier. No legal advice and no compliance decision.
Verifiable trust signals
- Source-linked answers and explicit evidence gaps
- Obligations, controls, risks and consequences
- Stable objects and verifiable checksums
- Rule-based objects, optional source-linked reasoning
- Model card, source status and audit