How the Security Rule is built
The Security Rule, 45 CFR Part 164 Subpart C, protects electronic protected health information through standards grouped into administrative, physical and technical safeguards, plus organizational requirements and documentation rules. Most standards have implementation specifications that say how to meet them. Each specification is either required or addressable.
Across the three safeguard sections there are 18 standards and 36 implementation specifications: 14 required and 22 addressable. Documentation adds three more required specifications under 164.316.
What addressable means
Not optional. Under 164.306(d)(3) you assess whether an addressable specification is a reasonable and appropriate safeguard in your environment. If it is, you implement it. If it isn't, you document why, and implement an equivalent alternative measure if that's reasonable and appropriate. HHS said in its 2025 proposal that compliance with addressable specifications is not, and should not be, optional, and the proposal would remove the distinction altogether.
Required means do it. Addressable means do it, or write down a very good reason and do something just as good.Your engineer
Every standard and specification
Linked entries have their own page with the text, what it means, the evidence OCR asks for and the cases where it was missing. The rest are summarized here and will get pages of their own.
| Citation | Type | Name |
|---|---|---|
| Administrative safeguards, 164.308 | ||
164.308(a)(1)(i) | Standard | Security management process |
164.308(a)(1)(ii)(A) | Required | Risk analysis |
164.308(a)(1)(ii)(B) | Required | Risk management |
164.308(a)(1)(ii)(C) | Required | Sanction policy |
164.308(a)(1)(ii)(D) | Required | Information system activity review |
164.308(a)(2) | Standard | Assigned security responsibility |
164.308(a)(3)(i) | Standard | Workforce security |
164.308(a)(3)(ii)(A) | Addressable | Authorization and/or supervision |
164.308(a)(3)(ii)(B) | Addressable | Workforce clearance procedure |
164.308(a)(3)(ii)(C) | Addressable | Termination procedures |
164.308(a)(4)(i) | Standard | Information access management |
164.308(a)(4)(ii)(A) | Required | Isolating health care clearinghouse functions |
164.308(a)(4)(ii)(B) | Addressable | Access authorization |
164.308(a)(4)(ii)(C) | Addressable | Access establishment and modification |
164.308(a)(5)(i) | Standard | Security awareness and training |
164.308(a)(5)(ii)(A) | Addressable | Security reminders |
164.308(a)(5)(ii)(B) | Addressable | Protection from malicious software |
164.308(a)(5)(ii)(C) | Addressable | Log-in monitoring |
164.308(a)(5)(ii)(D) | Addressable | Password management |
164.308(a)(6)(i) | Standard | Security incident procedures |
164.308(a)(6)(ii) | Required | Response and reporting |
164.308(a)(7)(i) | Standard | Contingency plan |
164.308(a)(7)(ii)(A) | Required | Data backup plan |
164.308(a)(7)(ii)(B) | Required | Disaster recovery plan |
164.308(a)(7)(ii)(C) | Required | Emergency mode operation plan |
164.308(a)(7)(ii)(D) | Addressable | Testing and revision procedures |
164.308(a)(7)(ii)(E) | Addressable | Applications and data criticality analysis |
164.308(a)(8) | Standard | Evaluation |
164.308(b)(1) | Standard | Business associate contracts and other arrangements |
164.308(b)(3) | Required | Written contract or other arrangement |
| Physical safeguards, 164.310 | ||
164.310(a)(1) | Standard | Facility access controls |
164.310(a)(2)(i) | Addressable | Contingency operations |
164.310(a)(2)(ii) | Addressable | Facility security plan |
164.310(a)(2)(iii) | Addressable | Access control and validation procedures |
164.310(a)(2)(iv) | Addressable | Maintenance records |
164.310(b) | Standard | Workstation use |
164.310(c) | Standard | Workstation security |
164.310(d)(1) | Standard | Device and media controls |
164.310(d)(2)(i) | Required | Disposal |
164.310(d)(2)(ii) | Required | Media re-use |
164.310(d)(2)(iii) | Addressable | Accountability |
164.310(d)(2)(iv) | Addressable | Data backup and storage |
| Technical safeguards, 164.312 | ||
164.312(a)(1) | Standard | Access control |
164.312(a)(2)(i) | Required | Unique user identification |
164.312(a)(2)(ii) | Required | Emergency access procedure |
164.312(a)(2)(iii) | Addressable | Automatic logoff |
164.312(a)(2)(iv) | Addressable | Encryption and decryption |
164.312(b) | Standard | Audit controls |
164.312(c)(1) | Standard | Integrity |
164.312(c)(2) | Addressable | Mechanism to authenticate ePHI |
164.312(d) | Standard | Person or entity authentication |
164.312(e)(1) | Standard | Transmission security |
164.312(e)(2)(i) | Addressable | Integrity controls |
164.312(e)(2)(ii) | Addressable | Encryption |
| Organizational requirements and documentation, 164.314 and 164.316 | ||
164.314(a) | Standard | Business associate contracts or other arrangements |
164.314(b) | Standard | Requirements for group health plans |
164.316(a) | Standard | Policies and procedures |
164.316(b)(1) | Standard | Documentation |
164.316(b)(2)(i) | Required | Time limit: retain six years |
164.316(b)(2)(ii) | Required | Availability |
164.316(b)(2)(iii) | Required | Updates |
How to use this
Start with the required specifications under 164.308(a)(1): risk analysis, risk management, sanctions and activity review. They're the ones OCR asks about first and the ones most settlements cite. Then the technical safeguards, because they decide whether a lost laptop is a breach. Then the rest, in the order your risk analysis tells you.
With AccuSights: the platform's assessment walks every standard and specification above, tags each as required or addressable, asks the plain-English question, names the evidence that proves it, and lets your named engineer answer "how far do we take this one?"