AuditRubric
Administrative Safeguards HIPAA Security Rule 2003

HIPAA Security Rule: Administrative Safeguards Security Controls

Policies, procedures, and processes to manage the selection, development, implementation, and maintenance of security measures protecting ePHI and workforce conduct.

9 controls
4 critical
80h est. effort
9 categories

Security Management Process

hipaa-as-1

Implement a security management process to prevent, detect, contain, and correct security violations

The foundation of HIPAA Security Rule compliance is a formal security management process. Organizati...

Assigned Security Responsibility

hipaa-as-2

Designate a security official responsible for developing and implementing security policies and procedures

Every covered entity and business associate must designate a specific individual as the security off...

Workforce Security

hipaa-as-3

Implement procedures to ensure workforce members have appropriate access to ePHI and prevent unauthorized access

Not every workforce member should have access to all ePHI. Organizations must implement procedures t...

Information Access Management

hipaa-as-4

Implement policies and procedures for authorizing access to ePHI

Access to ePHI must be granted based on the minimum necessary standard: workforce members should acc...

Security Awareness and Training

hipaa-as-5

Implement a security awareness and training program for all workforce members

Human error and social engineering are the leading causes of healthcare data breaches. HIPAA require...

Security Incident Procedures

hipaa-as-6

Implement policies and procedures to address security incidents involving ePHI

Security incidents involving ePHI are not a matter of if but when. HIPAA requires organizations to i...

Contingency Plan

hipaa-as-7

Establish and implement contingency plans to respond to emergencies that damage systems containing ePHI

Ransomware, natural disasters, hardware failures, and other emergencies can render ePHI unavailable ...

Evaluation

hipaa-as-8

Perform periodic technical and non-technical evaluations of security controls in response to environmental or operational changes

Security controls that were effective last year may not be effective today. Systems change, new thre...

Business Associate Contracts

hipaa-as-9

Obtain satisfactory assurances from business associates that they will appropriately safeguard ePHI

When a covered entity shares ePHI with a vendor or partner that performs functions on its behalf, th...