What it asks for. The HIPAA Security Rule is a US federal regulation that requires covered entities and their business associates to protect electronic protected health information. It requires a risk analysis and risk management, and sets out administrative, physical and technical safeguards. Some implementation specifications are required, while others are addressable, meaning the organisation must assess them and implement them or document a reasonable alternative.
In practice. Organisations perform and update a documented risk analysis covering all systems holding electronic health information, then implement safeguards such as access control, audit logging, integrity protection, transmission security, workforce training and contingency planning. Evidence includes the risk analysis, policies, business associate agreements, access reviews and audit log records. European organisations meet it mainly when serving US healthcare clients.
Common gaps. An incomplete or outdated risk analysis is a common enforcement finding. Addressable specifications are sometimes treated as optional without the required documented decision.