Does the Security Rule apply to paper records?

No. The Security Rule covers electronic PHI. Paper records are protected by the Privacy Rule’s safeguards requirement (45 CFR 164.530(c)).

Is encryption required by HIPAA?

It is an addressable specification, so you must assess it and either implement it or document why an alternative is reasonable. Encrypted data that meets HHS guidance is also not “unsecured PHI” for breach notification.

How often should a risk analysis be done?

The rule sets no fixed interval. HHS describes risk analysis as ongoing, reviewed regularly and when systems or operations change. Many organisations review it at least annually.

The HIPAA Security Rule

The Security Rule (45 CFR Part 164, Subpart C) requires covered entities and business associates to protect the confidentiality, integrity, and availability of electronic PHI. It is deliberately flexible, which is why the risk analysis sits at the centre of it.

Last reviewed against the Code of Federal Regulations (45 CFR Parts 160 and 164) and HHS OCR guidance linked on this page on October 22, 2026.

The short answer

The Security Rule applies only to electronic PHI. It sets standards in three groups — administrative, physical, and technical safeguards — and expects each organisation to choose measures that fit its size, systems, and risks, based on a documented risk analysis.

The three groups of safeguards

The three groups of safeguards
Safeguard	Regulation	Examples of standards
Administrative	164.308	Risk analysis and risk management; a designated security official; workforce security and training; incident procedures; contingency (backup and disaster recovery) plans; periodic evaluation; business associate contracts.
Physical	164.310	Facility access controls; workstation use and security; device and media controls, including disposal and re-use.
Technical	164.312	Access control (unique user IDs, emergency access, automatic logoff, encryption); audit controls; integrity controls; person or entity authentication; transmission security.

Organizational requirements (business associate contracts) are at 164.314; policies and documentation at 164.316.

“Required” versus “addressable”

Each standard has implementation specifications marked required or addressable (45 CFR 164.306(d) (opens in a new tab)). Addressable does not mean optional. For an addressable specification, the organisation assesses whether it is reasonable and appropriate; if it is, implement it; if not, document why and implement an equivalent alternative where reasonable. Encryption of ePHI at rest and in transit is addressable — and is also what makes lost data “secured” under the breach rule.

The risk analysis

45 CFR 164.308(a)(1)(ii)(A) (opens in a new tab) requires an accurate and thorough assessment of the potential risks and vulnerabilities to the ePHI you hold. HHS’s risk analysis guidance (opens in a new tab) describes what it should cover: where ePHI is created, received, maintained, or transmitted; threats and vulnerabilities; current security measures; likelihood and impact; and a documented risk level. It is followed by risk management — putting measures in place to reduce the risks found. HHS and ONC offer a free Security Risk Assessment Tool (opens in a new tab) aimed at small and medium practices.

How flexible is it?

The rule lets an organisation consider its size and complexity, its technical infrastructure, the cost of security measures, and the probability and criticality of potential risks (45 CFR 164.306(b)). A two-clinician practice is not expected to buy what a hospital system buys, but it is expected to have analysed its own risks and documented its choices.

Common questions

Does the Security Rule apply to paper records?: No. The Security Rule covers electronic PHI. Paper records are protected by the Privacy Rule’s safeguards requirement (45 CFR 164.530(c)).
Is encryption required by HIPAA?: It is an addressable specification, so you must assess it and either implement it or document why an alternative is reasonable. Encrypted data that meets HHS guidance is also not “unsecured PHI” for breach notification.
How often should a risk analysis be done?: The rule sets no fixed interval. HHS describes risk analysis as ongoing, reviewed regularly and when systems or operations change. Many organisations review it at least annually.

Sources

Summary of the HIPAA Security Rule (opens in a new tab) — HHS Office for Civil Rights
45 CFR § 164.306 — Security standards: general rules (required vs addressable) (opens in a new tab) — Electronic Code of Federal Regulations
45 CFR § 164.308 — Administrative safeguards (opens in a new tab) — Electronic Code of Federal Regulations
45 CFR § 164.312 — Technical safeguards (opens in a new tab) — Electronic Code of Federal Regulations
Guidance on Risk Analysis (opens in a new tab) — HHS Office for Civil Rights
Security Risk Assessment Tool (opens in a new tab) — HHS Office of the National Coordinator for Health IT / OCR

Questions about this page

Ask about anything explained here, or tell us if a citation is out of date. We can point you to the HHS source; we cannot advise on your organisation’s obligations. Do not send protected health information through this form.

Get in touch

Last reviewed against the Code of Federal Regulations (45 CFR Parts 160 and 164) and HHS OCR guidance linked on this page on October 22, 2026.

Every requirement on this page is cited to the regulation or to HHS guidance. If you find one that has changed, tell us and we will correct it.