HIPAA Security Rule
45 CFR Part 164, Subpart C · Read 2026-08-15
In force. Covered entities and business associates apply the safeguards to electronic protected health information.
Identifier
- Identifier
- 45 CFR Part 164, Subpart C
- Level
- Federal
- Status
- In force
- Adopted
- 2003-02-20
- Applies from
- 2005-04-20
- Supervisory bodies
- HHS OCR
Named requirements
Administrative safeguards
Risk analysis, workforce access, training and incident procedures.
Physical safeguards
Facility access, workstation use and media handling.
Technical safeguards
Access control, audit controls, integrity and transmission security.
Business associate contracts
Written terms with every party that handles the data on your behalf.
Official source
EU acts on the same ground
- CELEX 32016R0679
Both texts require documented security measures and written terms with processors. HIPAA is limited to health data, the EU text is not.
United States case law
20 decisions · Read from CourtListener, Free Law Project on 2026-08-22.
- Queerdoc, Pllc v. DOJ - United States Department of Justice
9th Cir.Open to review by a higher court, the source does not state the outcome
- Daniel Mook v. G. Hall
4th Cir.Open to review by a higher court, the source does not state the outcome
- Jannease Johnson v. DC
D.C. Cir.Open to review by a higher court, the source does not state the outcome
- William Clements v. Gunnar Optiks, LLC
7th Cir.Open to review by a higher court, the source does not state the outcome
- Andrea Tumbleson v. Lakota Local Sch. Dist.
6th Cir.Open to review by a higher court, the source does not state the outcome
- Greg Hale v. ARcare, Inc
8th Cir.Open to review by a higher court, the source does not state the outcome
- Axis Insurance Company v. Barracuda Networks, Inc.
1st Cir.Open to review by a higher court, the source does not state the outcome
- Blakesley v. Marcus
1st Cir.Open to review by a higher court, the source does not state the outcome
- Kirstyn Bashaw v. Majestic Care of Whitehall
130 F.4th 5426th Cir.Open to review by a higher court, the source does not state the outcome
- Doe v. Integris Health
123 F.4th 118910th Cir.Open to review by a higher court, the source does not state the outcome
- Michael Terpin v. at and T Mobility LLC
118 F.4th 11029th Cir.Open to review by a higher court, the source does not state the outcome
- Wiener v. AXA Equitable Ins. Co.
2d Cir.Open to review by a higher court, the source does not state the outcome
Change monitoring
The row is re-read against the publisher's own publication on a fixed interval. The dates below can be checked on the spot and travel with the API response.
| Field | Value |
|---|---|
| Register | HHS OCR — 45 CFR Part 164, Subpart C |
| Publisher | U.S. Department of Health and Human Services, Office for Civil Rights |
| Last read | 2026-08-15 |
| Interval | Every 30 days |
| Next re-read | 2026-09-14 |
| Status | Checked against the publisher |
Row history
Dated events concerning this exact row, newest first. No event appears here without a date in a primary source.
| Date | Event | Source |
|---|---|---|
| 2026-08-15 | Row read against the official publication | U.S. Department of Health and Human Services, Office for Civil Rights |
| 2005-04-20 | Date of application according to the publisher | U.S. Department of Health and Human Services, Office for Civil Rights |
| 2003-02-20 | Adopted under 45 CFR Part 164, Subpart C | U.S. Department of Health and Human Services, Office for Civil Rights |
Monitoring states when the row was checked, not how the legal position should be assessed.
Cite this row
The string below travels with a memo, a case file or an agent chain. The same string sits in the citation field of the API response.
45 CFR Part 164, Subpart C, HIPAA Security Rule. ExploreWorld Legal, https://legal.exploreworldai.com/us/regler/hipaa-security-rule (hämtad 2026-08-25, bevis sha256:cd4b92cac534b4dc, bygge legal-2026-08-25).
- sha256:
- cd4b92cac534b4dcddd246f3a3dbac8d241641847745851e603feab7ddc0c403
- hämtad:
- 2026-08-25
- source_confidence:
- official
- bygge:
- legal-2026-08-25
Official publication. The address points to the authority or court that published the row. Office of the Federal Register, eCFR.
The row is a source reference with an official identifier. No legal advice and no compliance decision.
Verifiable trust signals
- Six fixed blocks, one source per line
- No sentence written by a language model
- Engine version and read date on every answer
- No customer data, no documents, no advice
- Model card and audit published under the EU AI Act