What it covers. NIST resource guide for organisations subject to the US HIPAA Security Rule, which protects electronic protected health information. It explains the rule's standards and provides practical activities, risk assessment and risk management guidance, and mappings to other NIST resources.
In practice. Regulated organisations perform a risk analysis of electronic health information, implement administrative, physical and technical safeguards, and document how each requirement is met. The guide is useful outside the US as a structured healthcare security reference. Evidence includes risk analyses, policies, safeguard documentation and business associate arrangements.
Common gaps. Common gaps are outdated risk analyses, incomplete inventories of where health information is stored and weak oversight of service providers. Many organisations also treat the guide as a checklist rather than using its risk management approach.