Assess each addressable safeguard for reasonableness and appropriateness. Implement it when appropriate; otherwise document the decision and an equivalent alternative measure when appropriate. Addressable: implement when reasonable and appropriate; otherwise document why and an equivalent alternative measure when appropriate under 45 CFR 164.306(d)(3).
HIGHeCFRDraft · internal validation
HIPAA Security Rule
45 CFR Part 164 · Department of Health and Human Services
Draft policy wording checks for US medical and dental HIPAA covered entities. Upload policies without patient data only. Privacy, Breach Notification, health-plan and clearinghouse-specific duties are outside this preview; addressable safeguards allow documented alternatives where appropriate.
Requirements63atomic checksCRITICAL3severityHIGH60severityWith official link63/63eCFR section URLRule effectiveMar 26, 2013current textPack version0.1.0-draft.1authored Oct 6, 2026
Requirements
Showing 8 of 63 · official summariesReview and modify security measures when needed and update the corresponding documentation.
HIGHeCFRSecurity policies prevent, detect, contain, and correct security violations.
HIGHeCFRConduct an accurate and thorough risk analysis covering potential threats and vulnerabilities across all systems, devices, and media holding ePHI.
CRITICALeCFRReduce identified risks and vulnerabilities through security measures, corrective actions, and accountable owners.
HIGHeCFRApply appropriate sanctions and disciplinary action for workforce security policy violations.
HIGHeCFRRegularly review audit logs, access reports, and security incident tracking records with assigned reviewers.
HIGHeCFRIdentify the Security Official responsible for developing and implementing security policies.
HIGHeCFR