Compliance
Security, Privacy, and Breach Notification support for covered entities and business associates.
NorthStar helps covered entities and business associates design, implement, and operate the administrative, physical, and technical safeguards described in 45 CFR Part 164. We are not a certifying body, and this page is not a promise that the Office for Civil Rights or any other authority will find your organization in compliance. The summary below is general information about the HIPAA Security, Privacy, and Breach Notification Rules, not legal advice. Your organization remains responsible for its own compliance determinations. For the controlling text, read 45 CFR Part 164 on the electronic Code of Federal Regulations.
This is a plain-language map of the Security, Privacy, and Breach Notification Rules. It is not a substitute for the regulation itself.
Except as otherwise provided, 45 CFR 164.104 applies these standards to health plans, health care clearinghouses, and health care providers who transmit health information in electronic form in connection with a transaction covered by the HIPAA Administrative Simplification rules. Where the Part provides, the standards also apply to business associates. The Security Rule in Subpart C applies to covered entities and business associates with respect to electronic protected health information (45 CFR 164.302).
Covered entities and business associates must ensure the confidentiality, integrity, and availability of electronic protected health information, protect it against reasonably anticipated threats and impermissible uses or disclosures, and ensure workforce compliance (45 CFR 164.306(a)). They must implement the standards in 45 CFR 164.308 (administrative safeguards), 164.310 (physical safeguards), 164.312 (technical safeguards), 164.314 (organizational requirements), and 164.316 (policies, procedures, and documentation). Some implementation specifications are required and others are addressable; addressable does not mean optional. Under 45 CFR 164.306(d), you must implement an addressable specification if it is reasonable and appropriate, or document why it is not and implement an equivalent alternative measure if reasonable and appropriate. Encryption, for example, is an addressable technical specification in 45 CFR 164.312, not a blanket mandate.
A risk analysis is a required implementation specification. You must conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (45 CFR 164.308(a)(1)(ii)(A)). Risk management, also required, means implementing security measures sufficient to reduce those risks and vulnerabilities to a reasonable and appropriate level (45 CFR 164.308(a)(1)(ii)(B)). Other required administrative standards include a sanction policy, information system activity review, security incident response and reporting, and a contingency plan with data backup, disaster recovery, and emergency-mode operation (45 CFR 164.308). You must also implement a security awareness and training program for all members of the workforce, including management (45 CFR 164.308(a)(5)).
The Privacy Rule in Subpart E governs uses and disclosures of protected health information. When the minimum necessary standard applies, a covered entity or business associate must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request (45 CFR 164.502(b)). That standard does not apply in the situations listed in 45 CFR 164.502(b)(2), including disclosures to or requests by a health care provider for treatment. A covered entity may disclose protected health information to a business associate, or allow a business associate to create, receive, maintain, or transmit it on the covered entity's behalf, only if the covered entity obtains satisfactory assurance that the information will be appropriately safeguarded, documented in a written contract or other written agreement that meets 45 CFR 164.504(e) (45 CFR 164.502(e)).
Following discovery of a breach of unsecured protected health information, a covered entity must notify each individual whose information has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed as a result of the breach (45 CFR 164.404(a)). Except as provided in 45 CFR 164.412 for a law enforcement delay, that notice must be provided without unreasonable delay and in no case later than 60 calendar days after discovery (45 CFR 164.404(b)). If a breach involves more than 500 residents of a State or jurisdiction, the covered entity must also notify prominent media outlets serving that State or jurisdiction, on the same 60-day outer timeline (45 CFR 164.406). The covered entity must notify the Secretary of Health and Human Services. For breaches involving 500 or more individuals, that notice is contemporaneous with individual notice. For breaches involving fewer than 500 individuals, the covered entity must keep a log and notify the Secretary not later than 60 days after the end of the calendar year (45 CFR 164.408). A business associate must notify the covered entity of a breach without unreasonable delay and in no case later than 60 calendar days after discovery (45 CFR 164.410).
You must implement reasonable and appropriate policies and procedures to comply with the Security Rule, and maintain those policies and procedures in written (which may be electronic) form (45 CFR 164.316). Required documentation must be retained for 6 years from the date of its creation or the date when it last was in effect, whichever is later (45 CFR 164.316(b)(2)(i)). Documentation must be available to the people who implement the procedures, and must be reviewed periodically and updated as needed when environmental or operational changes affect the security of electronic protected health information (45 CFR 164.316(b)(2)(ii) and (iii)). Security measures themselves must be reviewed and modified as needed under 45 CFR 164.306(e).
We help you implement and document the work the Rule describes. We do not certify HIPAA compliance, and we cannot guarantee an audit or investigation outcome.
A structured assessment of risks and vulnerabilities to electronic protected health information, mapped to the Security Rule standards, with a prioritized plan for risk management.
Access control, unique user identification, audit controls, integrity protections, authentication, and transmission security, along with supporting administrative processes such as workforce training and incident procedures.
Written policies, procedures, and records that support the documentation and retention requirements in 45 CFR 164.316, so you have evidence you can show during an audit or investigation.
Ongoing review of system activity, security incident response support, and help assembling the facts a covered entity may need for individual, media, or Secretary notifications when a breach of unsecured protected health information is discovered.
Preparation of the risk analysis, system documentation, and book of evidence investigators typically ask to see. Readiness is not a guarantee that an OCR review will be closed or that any finding will be favorable.
Alignment of HIPAA safeguards with your broader cybersecurity program, backup and recovery plans, and the control evidence many cyber insurers ask for at application or renewal.
HIPAA work sits alongside industry, security, and insurance support already on this site.
This case study is already published on our site. It describes one engagement, not a typical or guaranteed result.
Read the controlling text and official agency guidance. If this page and a source differ, the source controls.
This page is general information about the HIPAA Security, Privacy, and Breach Notification Rules. It is not legal advice, does not create an attorney-client relationship, and is not a substitute for counsel or for reading 45 CFR Part 164. Your organization remains responsible for its own compliance determinations. NorthStar helps you design, implement, and operate technical and administrative safeguards and documentation. NorthStar is not a regulator or a certifying body and does not guarantee any audit, investigation, or enforcement outcome.
About the author
Ken Satkunam, CISM
President & Founder, NorthStar Technology Group
Ken has spent over 25 years in IT leadership, serving in roles from technical support to CIO for organizations as large as 23,000 employees. He founded NorthStar Technology Group in 2000 to help regulated organizations build secure, compliant, and operationally resilient technology environments. Ken holds the Certified Information Security Manager (CISM) credential from ISACA and is the co-author of the Amazon best-seller "Cyber Attack Prevention." He has been quoted in industry publications including eWeek and DM News, and NorthStar has been recognized on the Inc. 5000 list in both 2024 and 2025.
We can review your current risk analysis, policies, and technical controls and outline a practical path to implement and document the work 45 CFR Part 164 describes. Your organization remains responsible for its own compliance determinations.
