[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-sp\u002F800-66":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-sp","800-66","SP 800-66","SP 800-66 Rev. 2: Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide",17,"US National Institute of Standards and Technology (NIST)","**What it covers.** NIST resource guide for organisations subject to the US HIPAA Security Rule, which protects electronic protected health information. It explains the rule's standards and provides practical activities, risk assessment and risk management guidance, and mappings to other NIST resources.\n\n**In practice.** Regulated organisations perform a risk analysis of electronic health information, implement administrative, physical and technical safeguards, and document how each requirement is met. The guide is useful outside the US as a structured healthcare security reference. Evidence includes risk analyses, policies, safeguard documentation and business associate arrangements.\n\n**Common gaps.** Common gaps are outdated risk analyses, incomplete inventories of where health information is stored and weak oversight of service providers. Many organisations also treat the guide as a checklist rather than using its risk management approach.",null,"https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fsp800","Find it among NIST SP 800 publications","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"critical-vulnerabilities-in-medical-imaging-software-threaten-patient-data","Critical Vulnerabilities in Medical Imaging Software Threaten Patient Data","2026-10-15T18:21:06.642+00:00",{"slug":23,"title":24,"published_at":25},"healthcare-provider-exposes-280k-patient-records-in-june-2026-breach","Healthcare Provider Exposes 280K Patient Records in June 2026 Breach","2026-09-16T12:22:04.316+00:00",{"slug":27,"title":28,"published_at":29},"french-hospital-fined-500k-after-524000-patient-records-breached","French Hospital Fined €500K After 524,000 Patient Records Breached","2026-09-15T16:22:32.507+00:00",{"slug":31,"title":32,"published_at":33},"irish-hospital-fined-300k-after-ransomware-exposes-84000-patients-health-data","Irish Hospital Fined €300K After Ransomware Exposes 84,000 Patients' Health Data","2026-08-19T10:20:51.934+00:00",{"slug":35,"title":36,"published_at":37},"ransomware-group-exfiltrates-150k-patient-records-from-california-hospital","Ransomware Group Exfiltrates 150K Patient Records from California Hospital","2026-08-04T10:20:38.11+00:00",{"slug":39,"title":40,"published_at":41},"ransomware-breach-at-medical-billing-firm-exposes-126-million-patient-records","Ransomware Breach at Medical Billing Firm Exposes 1.26 Million Patient Records","2026-07-28T10:20:20.913+00:00",{"slug":43,"title":44,"published_at":45},"unencrypted-ble-transmission-and-dos-flaw-expose-apollo-pharmacy-glucose-monitor-users","Unencrypted BLE Transmission and DoS Flaw Expose Apollo Pharmacy Glucose Monitor Users","2026-06-18T19:21:08.666+00:00",{"slug":47,"title":48,"published_at":49},"2m-medical-professional-records-exposed-in-healthcare-data-breach","2M+ Medical Professional Records Exposed in Healthcare Data Breach","2026-06-10T17:21:30.886+00:00",{"slug":51,"title":52,"published_at":53},"healthcare-data-company-exposes-2m-medical-professional-records","Healthcare Data Company Exposes 2M+ Medical Professional Records","2026-06-10T17:21:20.779+00:00",{"slug":55,"title":56,"published_at":57},"healthcare-data-breach-exposes-25k-patient-records","Healthcare Data Breach Exposes 25K+ Patient Records","2026-06-09T16:21:11.919+00:00",{"slug":59,"title":60,"published_at":61},"hospital-patient-records-exposed-by-threat-actor-black0utexi","Hospital Patient Records Exposed by Threat Actor Black0ut_Exi","2026-06-07T02:20:16.911+00:00",{"slug":63,"title":64,"published_at":65},"34m-french-medical-records-allegedly-compromised-in-dmp-database-breach","34M French Medical Records Allegedly Compromised in DMP Database Breach","2026-06-01T23:06:05.981+00:00",[67,72,77,82,86,91],{"slug":68,"name":69,"problem":70,"stories":71},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",11,{"slug":73,"name":74,"problem":75,"stories":76},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",7,{"slug":78,"name":79,"problem":80,"stories":81},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",5,{"slug":83,"name":84,"problem":85,"stories":81},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",{"slug":87,"name":88,"problem":89,"stories":90},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",3,{"slug":92,"name":93,"problem":94,"stories":95},"patch-management","Automated patch management","Known holes get closed in days, not months.",2,[97,103,109,115,119,124,130,135],{"family":98,"item":99,"code":100,"title":101,"together":102},"cis","3","Control 3","Data Protection",16,{"family":104,"item":105,"code":106,"title":107,"together":108},"hipaa","security-rule","Security Rule","HIPAA Security Rule",14,{"family":110,"item":111,"code":112,"title":113,"together":114},"gdpr","32","Article 32","Security of processing",9,{"family":98,"item":116,"code":117,"title":118,"together":114},"13","Control 13","Network Monitoring and Defense",{"family":98,"item":120,"code":121,"title":122,"together":123},"6","Control 6","Access Control Management",8,{"family":125,"item":126,"code":127,"title":128,"together":129},"nist-csf","pr-ds","PR.DS-1","Data Security",6,{"family":131,"item":132,"code":133,"title":134,"together":129},"iso","27799","ISO\u002FIEC 27799","ISO 27799: Health informatics: Information security management in health using ISO\u002FIEC 27002",{"family":98,"item":136,"code":137,"title":138,"together":139},"17","Control 17","Incident Response Management",4]