Domain G: Technical Safeguards
Encryption, audit logging, transmission security, and automatic logoff.
Every item here is already part of the current, final HIPAA Security Rule. Items marked NPRM: would become Required are currently Addressable, OCR’s pending 2025 proposed rule would eliminate that flexibility and make them mandatory if finalized (not yet in effect).
Unique user identification enforced at the system level
45 C.F.R. §164.312(a)(2)(i) · Source: www.ecfr.gov/current/title-45/section-164.312
Emergency access procedure implemented technically
45 C.F.R. §164.312(a)(2)(ii) · Source: www.ecfr.gov/current/title-45/section-164.312
Automatic logoff enforced by configuration
45 C.F.R. §164.312(a)(2)(iii) · Source: www.ecfr.gov/current/title-45/section-164.312
Encryption of ePHI at rest, or documented compensating rationale
45 C.F.R. §164.312(a)(2)(iv) · Source: www.ecfr.gov/current/title-45/section-164.312
Audit control mechanisms recording and examining system activity
45 C.F.R. §164.312(b) · Source: www.ecfr.gov/current/title-45/section-164.312
Mechanism to authenticate ePHI has not been improperly altered or destroyed
45 C.F.R. §164.312(c)(2) · Source: www.ecfr.gov/current/title-45/section-164.312
Person-or-entity authentication (credential verification; multifactor is the accepted 2026 standard for remote and privileged access)
45 C.F.R. §164.312(d) · Source: www.ecfr.gov/current/title-45/section-164.312
Transmission integrity controls for ePHI in transit
45 C.F.R. §164.312(e)(2)(i) · Source: www.ecfr.gov/current/title-45/section-164.312
Encryption of ePHI in transit, or documented compensating rationale
45 C.F.R. §164.312(e)(2)(ii) · Source: www.ecfr.gov/current/title-45/section-164.312
Technical access control capabilities are identified for each ePHI system, including network segmentation
45 C.F.R. §164.312(a)(2)(i) · Source: www.ecfr.gov/current/title-45/section-164.312
Access control procedures are implemented in the selected hardware and software for each ePHI system
45 C.F.R. §164.312(a)(2)(i) · Source: www.ecfr.gov/current/title-45/section-164.312
The audit scope is set from the risk analysis, with defined record content: user, event, date and time
45 C.F.R. §164.312(b) · Source: www.ecfr.gov/current/title-45/section-164.312
Audit and activity review tools are selected and deployed
45 C.F.R. §164.312(b) · Source: www.ecfr.gov/current/title-45/section-164.312
Sources that could alter or destroy ePHI without authorization are identified
45 C.F.R. §164.312(c)(2) · Source: www.ecfr.gov/current/title-45/section-164.312
Integrity mechanisms are monitored, with a response process when alteration is detected
45 C.F.R. §164.312(c)(2) · Source: www.ecfr.gov/current/title-45/section-164.312
Where authentication applies is documented for every system and application holding ePHI
45 C.F.R. §164.312(d) · Source: www.ecfr.gov/current/title-45/section-164.312
Authentication options (something known, held, or biometric) are evaluated for each system
45 C.F.R. §164.312(d) · Source: www.ecfr.gov/current/title-45/section-164.312
Multi-factor authentication is enforced for remote and privileged access
45 C.F.R. §164.312(d) · Source: www.ecfr.gov/current/title-45/section-164.312
Every path ePHI travels (email, file transfer, portals, apps) is inventoried with who could intercept it
45 C.F.R. §164.312(e)(2)(i) · Source: www.ecfr.gov/current/title-45/section-164.312
Encryption in transit uses algorithms of sufficient strength, configured so they cannot silently downgrade
45 C.F.R. §164.312(e)(2)(ii) · Source: www.ecfr.gov/current/title-45/section-164.312