On this page
The HIPAA safeguards are the three types of protection the Security Rule requires for electronic protected health information (ePHI): administrative safeguards such as risk analysis, training and vendor contracts; physical safeguards such as facility, workstation and device controls; and technical safeguards such as access control, audit controls, integrity, authentication and transmission security. HHS says the rule sets forth the safeguards that covered entities and business associates "must put in place to secure individuals' electronic protected health information" (HHS), so they reach the marketing vendors that handle ePHI too. Curve Compliance, which is SOC 2 Type II and signs a BAA on every plan, checked each source below on November 2, 2026.
Book a call. Is a marketing tool on your site part of your Security Rule picture? Curve Compliance replaces browser ad pixels with one script, sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.
The three safeguard types
The Security Rule defines each type in 45 CFR 164.304 and lists its standards in its own section (eCFR). Most standards have implementation specifications, each marked "Required" or "Addressable."
| Type | How 45 CFR 164.304 defines it | Section | Standards |
|---|---|---|---|
| Administrative | Administrative actions, and policies and procedures, to manage security measures and the conduct of the workforce in protecting ePHI | 164.308 | Security management process, assigned security responsibility, workforce security, information access management, security awareness and training, security incident procedures, contingency plan, evaluation, business associate contracts |
| Physical | Physical measures, policies and procedures to protect electronic information systems and related buildings and equipment from hazards and unauthorized intrusion | 164.310 | Facility access controls, workstation use, workstation security, device and media controls |
| Technical | "the technology and the policy and procedures for its use that protect electronic protected health information and control access to it" | 164.312 | Access control, audit controls, integrity, person or entity authentication, transmission security |
Two more sections sit beside them: organizational requirements for business associate contracts (164.314) and policies, procedures and documentation (164.316). The rule covers electronic PHI only. HHS says "Unlike the Privacy and Breach Notification Rules, the Security Rule does not apply to PHI that is maintained or transmitted on paper or verbally" (HHS). See what ePHI is.
Administrative safeguards
Administrative safeguards are the largest group, and they start with risk. Under the security management process standard, an organization must "Implement policies and procedures to prevent, detect, contain, and correct security violations" (45 CFR 164.308(a)(1)). Its parts:
- Risk analysis (Required). "Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information." See how to run a HIPAA risk assessment.
- Risk management, sanction policy and system activity review (all Required). Reduce risks to a reasonable level, sanction staff who break the policies, and regularly review audit logs and access reports.
- Assigned security responsibility. Name a security official. See privacy and security officers.
- Workforce security and information access management. Give each person access to ePHI only as their role needs, and end access when they leave.
- Security awareness and training. A program for all workforce members, including management, with security reminders, malware protection, log-in monitoring and password management (Addressable).
- Security incident procedures and contingency plan. Respond to and document incidents; keep backup, disaster recovery and emergency mode plans (Required).
- Evaluation. Periodic technical and nontechnical evaluations, including after operational changes.
- Business associate contracts. A covered entity may let a business associate handle ePHI "only if the covered entity obtains satisfactory assurances" in a written contract or other arrangement (164.308(b)).
Physical safeguards
Physical safeguards protect the places and devices where ePHI lives. Facility access controls mean policies "to limit physical access to its electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed." Workstation use and workstation security cover the laptops and desktops that can reach ePHI. Device and media controls govern hardware moving in and out, with two Required specifications: disposal of ePHI and the media it sits on, and removal of ePHI "from electronic media before the media are made available for re-use" (45 CFR 164.310). For a marketing team, that is the shared laptop logged in to the CRM and the export left on a USB drive.
Technical safeguards
Technical safeguards are the controls inside the systems (45 CFR 164.312):
- Access control. Allow access "only to those persons or software programs that have been granted access rights," with unique user identification and an emergency access procedure (Required) and automatic logoff and encryption (Addressable).
- Audit controls. Mechanisms "that record and examine activity in information systems that contain or use electronic protected health information."
- Integrity. Protect ePHI "from improper alteration or destruction."
- Person or entity authentication. Verify that a person or entity seeking access "is the one claimed."
- Transmission security. Guard against unauthorized access to ePHI "that is being transmitted over an electronic communications network," with integrity controls and encryption (Addressable).
Required and addressable specifications
A Required specification must be implemented. For an Addressable one, an organization must assess whether it is "a reasonable and appropriate safeguard in its environment," implement it if so, and if not, document why and implement an equivalent alternative if reasonable (45 CFR 164.306(d)). HHS is direct about it: the label "does not mean that an implementation specification is optional" (HHS). In choosing measures, the rule lets an organization weigh its size and capabilities, its technical infrastructure, the costs of security measures, and "The probability and criticality of potential risks to electronic protected health information" (164.306(b)).
What safeguards mean for marketing vendors
Since the HITECH Act, the Security Rule's safeguards apply to business associates "in the same manner that they apply to covered entities," HHS says, and business associates "are civilly and criminally liable for penalties for violations of these provisions" (HHS). A business associate contract must say the vendor will "Comply with the applicable requirements of this subpart," flow the same terms down to subcontractors, and report security incidents (45 CFR 164.314). A form tool, CRM or analytics vendor that holds ePHI for a clinic is in this group.
HHS's tracking bulletin ties it to websites. It lists "Addressing the use of tracking technologies in the regulated entity's Risk Analysis and Risk Management processes" and safeguards such as "encrypting ePHI that is transmitted to the tracking technology vendor" (HHS). Ad platforms that do not sign a BAA are a different case: if a vendor is not a business associate, HHS says "the individuals' HIPAA-compliant authorizations are required before the PHI is disclosed to the vendor" (HHS). See which ad platforms sign a BAA and why a BAA may not be enough.
The proposed Security Rule changes
HHS issued a proposed rule on December 27, 2024, published in the Federal Register on January 6, 2025, with comments due March 7, 2025 (Federal Register). The Federal Register lists no final rule for it as of November 2, 2026. Among the proposals, HHS would remove the split between required and addressable specifications and "make all implementation specifications required with specific, limited exceptions," "Require encryption of ePHI at rest and in transit, with limited exceptions," require multi-factor authentication, and require a technology asset inventory and a network map of how ePHI moves (HHS). HHS adds: "While the Department is undertaking this rulemaking, the current Security Rule remains in effect." See the proposed Security Rule changes for marketers and a network map for marketing tools.
How Curve Compliance helps
Curve Compliance is SOC 2 Type II and signs a BAA on every plan for its own handling of your data; see Curve's security page. On the marketing side, Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, contact identifiers are off by default on Meta, Google Ads and TikTok, and Curve strips PHI before data reaches an ad platform.
Event Logs show what Curve sent to each platform and what the platform accepted, a record you can bring to an evaluation. Curve Forms have read-only and full-access roles, and every view or export of submissions is logged. Curve's team does the setup, typically live in about a week. Your own safeguards still depend on your systems and risks, so talk to your counsel about what your organization needs.
Sources, checked November 2, 2026: HHS, Summary of the HIPAA Security Rule; HHS, Security Rule NPRM fact sheet; HHS, Use of Online Tracking Technologies; HHS, Summary of the HIPAA Privacy Rule; eCFR, 45 CFR 164.304, 164.306, 164.308, 164.310, 164.312, 164.314, 164.316 and 164.530; Federal Register, 90 FR 898 (2025).
Frequently Asked Questions
What are the HIPAA safeguards?
They are the administrative, physical and technical safeguards the HIPAA Security Rule requires covered entities and business associates to put in place for electronic PHI (HHS; 45 CFR 164.306).
What are the three types of safeguards defined in the security rule?
Administrative safeguards (45 CFR 164.308), physical safeguards (164.310) and technical safeguards (164.312), each defined in 164.304 (eCFR).
What are technical safeguards?
The Security Rule defines them as "the technology and the policy and procedures for its use that protect electronic protected health information and control access to it." Its five standards are access control, audit controls, integrity, person or entity authentication and transmission security (45 CFR 164.304; 164.312).
Which is not one of the three types of safeguards required by the security rule?
Anything other than administrative, physical and technical. Organizational requirements (164.314) and policies, procedures and documentation (164.316) are separate sections, not a fourth safeguard type (45 CFR 164.306(c)).
What are the reasonable safeguards required under HIPAA?
The Privacy Rule requires "appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information" in any form (45 CFR 164.530(c)). HHS gives examples such as shredding documents and securing records with lock and key or pass code (HHS).
Is encryption required under HIPAA?
Today encryption is an Addressable specification for stored and transmitted ePHI, so you implement it where reasonable and appropriate or document why not and use an equivalent alternative if reasonable and appropriate (45 CFR 164.312). The proposed rule would require it, with limited exceptions (HHS).
What are the new HIPAA security rules in 2026?
The Security Rule update is still a proposed rule, published January 6, 2025, and HHS says the current rule remains in effect (Federal Register; HHS). See the new HIPAA rules in 2026.
Talk to Curve Compliance
Book a call. Want conversion tracking that fits your security review? Curve Compliance is SOC 2 Type II, signs a BAA on every plan and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.