[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:hipaa\u002Fsecurity-rule":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"hipaa","security-rule","Security Rule","HIPAA Security Rule",181,"US Department of Health and Human Services (HHS)","**What it asks for.** The HIPAA Security Rule is a US federal regulation that requires covered entities and their business associates to protect electronic protected health information. It requires a risk analysis and risk management, and sets out administrative, physical and technical safeguards. Some implementation specifications are required, while others are addressable, meaning the organisation must assess them and implement them or document a reasonable alternative.\n\n**In practice.** Organisations perform and update a documented risk analysis covering all systems holding electronic health information, then implement safeguards such as access control, audit logging, integrity protection, transmission security, workforce training and contingency planning. Evidence includes the risk analysis, policies, business associate agreements, access reviews and audit log records. European organisations meet it mainly when serving US healthcare clients.\n\n**Common gaps.** An incomplete or outdated risk analysis is a common enforcement finding. Addressable specifications are sometimes treated as optional without the required documented decision.",null,"https:\u002F\u002Fwww.hhs.gov\u002Fhipaa\u002Ffor-professionals\u002Fsecurity\u002Findex.html","Read about the Security Rule at HHS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},135,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"critical-vulnerabilities-in-medical-imaging-software-threaten-patient-data","Critical Vulnerabilities in Medical Imaging Software Threaten Patient Data","2026-10-15T18:21:06.642+00:00",{"slug":24,"title":25,"published_at":26},"irhythm-breach-third-party-app-risk-exposes-360000-patients","iRhythm Breach: Third-Party App Risk Exposes 360,000 Patients","2026-10-12T12:21:39.014+00:00",{"slug":28,"title":29,"published_at":30},"hospital-employee-reprimanded-for-unauthorized-patient-record-access","Hospital Employee Reprimanded for Unauthorized Patient Record Access","2026-10-09T10:20:42.004+00:00",{"slug":32,"title":33,"published_at":34},"oracle-healths-legacy-cerner-breach-exposes-20-million-records","Oracle Health's Legacy Cerner Breach Exposes 20 Million Records","2026-10-08T10:20:39.04+00:00",{"slug":36,"title":37,"published_at":38},"ransomware-groups-now-target-backups-first-recovery-is-no-longer-guaranteed","Ransomware Groups Now Target Backups First — Recovery Is No Longer Guaranteed","2026-10-07T16:21:31.344+00:00",{"slug":40,"title":41,"published_at":42},"social-engineering-and-ransomware-expose-250000-healthcare-patients","Social Engineering and Ransomware Expose 250,000 Healthcare Patients","2026-10-05T14:21:11.44+00:00",{"slug":44,"title":45,"published_at":46},"ai-powered-vulnerability-discovery-raises-access-control-and-governance-stakes","AI-Powered Vulnerability Discovery Raises Access Control and Governance Stakes","2026-10-01T08:20:18.932+00:00",{"slug":48,"title":49,"published_at":50},"social-engineering-attack-leads-to-health-data-breach-at-astrana-health","Social Engineering Attack Leads to Health Data Breach at Astrana Health","2026-09-24T10:20:22.639+00:00",{"slug":52,"title":53,"published_at":54},"ot-and-medical-devices-dangerously-exposed-due-to-poor-network-isolation","OT and Medical Devices Dangerously Exposed Due to Poor Network Isolation","2026-09-22T14:22:40.404+00:00",{"slug":56,"title":57,"published_at":58},"french-hospital-fined-500k-after-524000-patient-records-exposed","French Hospital Fined €500K After 524,000 Patient Records Exposed","2026-09-16T14:21:37.111+00:00",{"slug":60,"title":61,"published_at":62},"healthcare-provider-exposes-280k-patient-records-in-june-2026-breach","Healthcare Provider Exposes 280K Patient Records in June 2026 Breach","2026-09-16T12:22:04.316+00:00",{"slug":64,"title":65,"published_at":66},"italian-health-agency-fined-24k-for-weak-ehr-access-controls-and-missing-anomaly-detection","Italian Health Agency Fined €24K for Weak EHR Access Controls and Missing Anomaly Detection","2026-09-16T10:22:17.207+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",56,{"slug":74,"name":75,"problem":76,"stories":77},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",41,{"slug":79,"name":80,"problem":81,"stories":82},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",38,{"slug":84,"name":85,"problem":86,"stories":87},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",33,{"slug":89,"name":90,"problem":91,"stories":92},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",25,{"slug":94,"name":95,"problem":96,"stories":97},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",23,[99,105,111,116,122,127,132,137],{"family":100,"item":101,"code":102,"title":103,"together":104},"gdpr","32","Article 32","Security of processing",74,{"family":106,"item":107,"code":108,"title":109,"together":110},"cis","6","Control 6","Access Control Management",72,{"family":106,"item":112,"code":113,"title":114,"together":115},"3","Control 3","Data Protection",70,{"family":117,"item":118,"code":119,"title":120,"together":121},"nist-800-53","ac-2","AC-2","Account Management",52,{"family":106,"item":123,"code":124,"title":125,"together":126},"13","Control 13","Network Monitoring and Defense",45,{"family":100,"item":128,"code":129,"title":130,"together":131},"33","Article 33","Notification of a personal data breach to the supervisory authority",29,{"family":133,"item":134,"code":135,"title":135,"together":136},"itil","overview","ITIL",28,{"family":106,"item":138,"code":139,"title":140,"together":136},"12","Control 12","Network Infrastructure Management"]