HIPAA §164.312 Technical Safeguards: Access, Audit, Integrity, Authentication, Transmission

§164.312 At a Glance

R = Required implementation specification; A = Addressable. Confirm the live CFR text for your programme.

NPRM Context

The January 2025 NPRM proposed elevating several technical expectations (including encryption and MFA-related controls). Those proposals are not final. See Security Rule 2025–2026 update.

How CyberSilo Helps

• ThreatHawk supports §164.312(b) audit examination with correlated ePHI-system logs
• CSA stores Access Control decisions, authentication evidence, and encryption status notes

Frequently Asked Questions

Which §164.312 standards are Required?

Audit Controls (b) and Person or Entity Authentication (d) are Required standards. Access Control, Integrity, and Transmission Security include Required and/or Addressable implementation specifications as listed in the CFR.

Is encryption required under §164.312 today?

Encryption/decryption under Access Control and encryption under Transmission Security are Addressable today. The 2025 NPRM proposed making encryption required — not final as of 2026.

What do audit controls require?

§164.312(b) requires hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI.

Related HIPAA Resources

HIPAA hub · HIPAA SIEM · MFA · CSA