What Are the HIPAA Security Rule Administrative Safeguards?

The HIPAA Security Rule defines administrative safeguards as administrative actions, and policies and procedures, to manage the selection, development, implementation, and maintenance of security measures to protect electronic protected health information (ePHI) and to manage the conduct of the workforce in relation to protecting that information (45 CFR 164.304). They apply to covered entities and business associates.

45 CFR 164.308 sets nine administrative safeguard standards: security management process, assigned security responsibility, workforce security, information access management, security awareness and training, security incident procedures, contingency plan, evaluation, and business associate contracts and other arrangements.

Many standards include implementation specifications marked Required or Addressable. Required specifications include risk analysis, risk management, a sanction policy, and information system activity review under the security management process. Response and reporting for security incidents, a data backup plan, a disaster recovery plan, an emergency mode operation plan, and a written business associate contract are also required (45 CFR 164.308). The security awareness and training standard covers each member of the workforce, including management, and lists four addressable specifications: security reminders, protection from malicious software, log-in monitoring, and password management (45 CFR 164.308(a)(5)).

An addressable specification still calls for action. The covered entity or business associate assesses whether the specification is a reasonable and appropriate safeguard in its environment and implements it if so. If it is not reasonable and appropriate, the entity documents why and implements an equivalent alternative measure if reasonable and appropriate (45 CFR 164.306(d)). The evaluation standard calls for a periodic technical and nontechnical evaluation, based initially on the standards implemented under the rule and later in response to environmental or operational changes, that establishes the extent to which the entity's security policies and procedures meet the rule's requirements (45 CFR 164.308(a)(8)). Physical and technical safeguards are separate standards in 45 CFR 164.310 and 164.312, and the HIPAA Privacy Rule is in Subpart E.

HHS published a proposed rule on January 6, 2025 that would revise the Security Rule (90 FR 898). As of October 25, 2026, no final rule has been published from that proposal, and the eCFR text shows 164.308 as last amended in 2013 (78 FR 5694).