HIPAA Security Rule
Administrative

HIPAA Security Rule 164.306: Security Standards: General Rules

Covered entities and business associates must ensure the confidentiality, integrity, and availability of all electronic protected health information (ePHI) they create, receive, maintain, or transmit; protect against reasonably anticipated threats; protect against reasonably anticipated impermissible uses or disclosures; and ensure workforce compliance. Entities may use flexibility of approach considering size, complexity, capabilities, technical infrastructure, costs, and probability and criticality of risks to ePHI.

What else in your programme already covers this

This control maps to 100 controls across 30 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

SOC 2 · 10 controls

  • SOC2-C1.1 Confidential information is identified and protected during receipt, processing, storage
  • SOC2-CC1.1 COSO principle 1: Demonstrates commitment to integrity and ethical values
  • SOC2-CC3.1 COSO principle 6: Specifies objectives to identify and assess risks
  • SOC2-CC3.2 COSO principle 7: Identifies risks and analyzes to determine how managed
  • SOC2-CC5.1 COSO principle 10: Selects and develops control activities to mitigate risks
  • SOC2-CC5.2 COSO principle 11: Selects and develops general controls over technology
  • SOC2-CC6.1 Implements logical access security software, infrastructure and architectures over protected information assets
  • SOC2-CC6.3 Role-based access and least privilege are enforced
  • SOC2-CC9.1 Identifies, selects and develops risk mitigation activities
  • SOC2-P6.3 Creates and retains a complete, accurate, and timely record of detected or reported unauthorized disclosures (including breaches) of personal information to meet the entity's objectives related to privacy. The following point of focus, which

CMMC 2.0 · 7 controls

ISO 27002:2022 · 7 controls

  • 5.1 Policies for information security
  • 5.31 Legal, statutory, regulatory and contractual requirements
  • 5.34 Privacy and protection of PII
  • 5.36 Compliance with policies, rules and standards for information security
  • 5.4 Management responsibilities
  • 6.3 Information security awareness, education and training
  • 8.27 Secure system architecture and engineering principles

NIST SP 800-53 Rev 5 · 7 controls

  • NIST800-CA-7 Continuous monitoring
  • NIST800-PL-10 Baseline selection
  • NIST800-PM-1 Information Security Program Plan. Develop and disseminate an organization-wide information security program plan that: Provides an overview of the requirements for the security program and a description of the security program management controls and
  • NIST800-RA-3 Risk assessment
  • NIST800-SC-8 Transmission confidentiality and integrity
  • NIST800-SR-7 Supply Chain Operations Security. Employ the following Operations Security (OPSEC) controls to protect supply chain-related information for the system, system component, or system service: [organization-defined]
  • SP800-53-SR Supply Chain Risk Management Family

ISO 22301:2019 · 6 controls

  • 4.2.1 General
  • 4.2.2 Legal and regulatory requirements
  • 4.3.1 General
  • 5.1 Leadership and commitment
  • 6.1.2 Addressing risks and opportunities
  • 8.2.3 Risk assessment

ISO 27001:2022 · 6 controls

  • 5.15 Access control
  • 5.2 Information security roles and responsibilities
  • 5.31 Legal, statutory, regulatory and contractual requirements
  • 5.34 Privacy and protection of personal identifiable information (PII)
  • 5.4 Management responsibilities
  • 8.13 Information backup

NIST Cybersecurity Framework 2.0 · 6 controls

  • NIST-CSF-GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
  • NIST-CSF-GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
  • NIST-CSF-GV.RM-01 Risk management objectives are established and agreed to by organizational stakeholders
  • NIST-CSF-PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
  • NIST-CSF-PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
  • NIST-CSF-PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 4 controls

  • CFTC-SS-1 Program of Risk Analysis and Oversight
  • CFTC-SS-12 Capacity and Performance Planning Category
  • CFTC-SS-3 Information Security Category
  • CFTC-SS-7 Generally Accepted Standards and Best Practices

ISO 27701:2019 · 4 controls

  • 5.3.1 Leadership and commitment
  • 5.4.1 Actions to address risks and opportunities
  • 6.15.1 Compliance with legal and contractual requirements
  • 6.4.2 During employment

PCI DSS 4.0 · 4 controls

  • 12.1.1 An overall information security policy is: • Established. • Published. • Maintained. • Disseminated to all relevant personnel, as well as to relevant vendors and business partners
  • 12.1.2 The information security policy is: • Reviewed at least once every 12 months. • Updated as needed to reflect changes to business objectives or risks to the environment
  • 12.6.3 Security awareness training delivered
  • 12.8.2 Written agreements with TPSPs

APEC Cross-Border Privacy Rules (CBPR) System · 3 controls

APRA CPS 234 · 3 controls

  • CPS234-15 Information Security Capability
  • CPS234-19 Information Security Policy Framework
  • CPS234-21 Implementation of Information Security Controls

C5 (Germany) · 3 controls

  • C5-COM-01 Identification of applicable legal, regulatory, self-imposed or contractual requirements
  • C5-OIS-01 Information Security Management System (ISMS)
  • C5-OIS-02 Information Security Policy

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

APPI · 2 controls

  • APPI-A23 Security Control Measures
  • APPI-A46 Security and Proper Handling of Anonymized Personal Information

APRA CPS 220 Risk Management · 2 controls

  • CPS220-P22 Framework Structure for Managing Each Material Risk
  • CPS220-P46 Scope of the Comprehensive Review

AWS Well-Architected Security Pillar · 2 controls

  • SEC01-BP03 Identify and validate control objectives
  • SEC07-BP02 Apply data protection controls based on data sensitivity

Australia Consumer Data Right - Banking (CDR) · 2 controls

  • AUCDR-IS-STEP3 Step 3 - Have and maintain an information security capability
  • AUCDR-PS-12 Privacy Safeguard 12 - Security of CDR data and destruction or de-identification of redundant CDR data

Australia My Health Records Act 2012 · 2 controls

FedRAMP High · 2 controls

  • PL-2 System Security and Privacy Plans
  • RA-3 Risk Assessment

FedRAMP Moderate · 2 controls

  • PL-2 System Security and Privacy Plans
  • RA-3 Risk Assessment

NIST SP 800-171 Rev 3 · 2 controls

NIST SP 800-53 Rev 5 LOW · 2 controls

  • PL-2 System Security and Privacy Plans
  • RA-3 Risk Assessment

NIST SP 800-53 Rev 5 MODERATE · 2 controls

  • PL-2 System Security and Privacy Plans
  • RA-3 Risk Assessment

NIST SP 800-53 Revision 5.1 HIGH · 2 controls

  • PL-2 System Security and Privacy Plans
  • RA-3 Risk Assessment

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-P25 Information and Technology Capability and Asset Health

Australian Privacy Principles (APPs) · 1 control

  • APP-11 APP 11 - Security of personal information

Azure Security Benchmark · 1 control

  • ASBv3-GS-3 Define and implement data protection strategy

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-218 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Administrative

You are reading one control. How much of HIPAA Security Rule have you already done?

HIPAA Security Rule 164.306 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of HIPAA Security Rule your existing evidence covers. Hold ISO 27001:2022 and 53 of 67 HIPAA Security Rule controls already carry evidence.

If you hold ISO 27001:202279.1% covered · 14 gapsIf you hold ISO 27002:202279.1% covered · 14 gapsIf you hold FedRAMP Moderate77.6% covered · 15 gapsIf you hold NIST SP 800-53 Rev 577.6% covered · 15 gapsIf you hold C5 (Germany)76.1% covered · 16 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.167.2% covered · 22 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 64 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 100 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll HIPAA Security Rule controls