Compliance & Assurance
HIPAA
HIPAA Security Rule (Health Insurance Portability and Accountability Act)
By Clear Infosec · Last reviewed: August 2026
The HIPAA Security Rule sets US federal requirements for protecting electronic protected health information (ePHI) through administrative, physical, and technical safeguards.
What is HIPAA?
HIPAA applies to covered entities (health plans, clearinghouses, and most healthcare providers) and their business associates. The Security Rule requires safeguards for the confidentiality, integrity, and availability of ePHI.
A recurring, documented risk analysis is a foundational requirement (45 CFR 164.308(a)(1)(ii)(A)), alongside the Privacy Rule and Breach Notification Rule.
Who does HIPAA apply to?
US covered entities and business associates that create, receive, maintain, or transmit ePHI.
Key security expectations
- Administrative safeguards: risk analysis, risk management, workforce training, and access management.
- Physical safeguards: facility access, workstation, and device controls.
- Technical safeguards: access control, audit controls, integrity, and transmission security.
- Business Associate Agreements with vendors handling ePHI.
- Breach notification processes.
How an assessment works
- 1 Scope systems and data flows that involve ePHI.
- 2 Perform the required security risk analysis.
- 3 Assess safeguards against the Security Rule.
- 4 Remediate gaps and document a risk management plan.
- 5 Maintain evidence and repeat the risk analysis periodically.
Typical evidence
Testing and HIPAA: HIPAA does not name penetration testing explicitly, but the required risk analysis and technical evaluation commonly include vulnerability assessment and penetration testing to identify technical risks to ePHI.
How Clear Infosec helps with HIPAA
Related Clear Infosec services that support HIPAA:
Risk Assessment & Compliance Readiness
Know your risk. Be audit-ready.
Vulnerability Assessment & Penetration Testing
Find and prove real risk before attackers do.
Policy & Procedure Development
Policies that fit your business and pass audit.
Security Awareness Training
Turn your people into a human firewall.
Digital Forensics & Incident Response
Contain, investigate, recover.
Frequently asked questions
Does HIPAA require a risk assessment?
Yes. The HIPAA Security Rule requires a documented risk analysis of risks to electronic protected health information (45 CFR 164.308(a)(1)(ii)(A)), and it must be kept current.
Does HIPAA require penetration testing?
HIPAA does not explicitly require penetration testing. It requires a risk analysis and periodic technical evaluation, which commonly include vulnerability assessment and penetration testing.
This page is general information, not legal or regulatory advice. Requirements are defined by the authoritative body linked above.
Preparing for HIPAA?
Talk to Clear Infosec about a readiness assessment, gap analysis, or testing aligned to HIPAA.
Contact us