What do the HIPAA technical safeguards cover?
The technical safeguards are the part of the HIPAA Security Rule that governs the technology protecting electronic protected health information (ePHI). They are codified at 45 CFR §164.312, which, in the version current on October 1, 2026, was last amended on January 25, 2013 (78 FR 5694).
The section contains five standards and seven implementation specifications. Of the seven specifications, two are required and five are addressable. In a dental practice they apply to the practice-management server and database, the imaging library, the workstations that open both, and the network and remote-access paths that connect them.
| Standard | Implementation specification | Status |
|---|---|---|
| (a) Access control | Unique user identification | Required |
| (a) Access control | Emergency access procedure | Required |
| (a) Access control | Automatic logoff | Addressable |
| (a) Access control | Encryption and decryption | Addressable |
| (b) Audit controls | None; the standard itself applies | Standard |
| (c) Integrity | Mechanism to authenticate ePHI | Addressable |
| (d) Person or entity authentication | None; the standard itself applies | Standard |
| (e) Transmission security | Integrity controls | Addressable |
| (e) Transmission security | Encryption | Addressable |
What does “addressable” mean?
“Addressable” does not mean optional. Under 45 CFR §164.306(d)(3), a covered entity must assess whether each addressable specification is a reasonable and appropriate safeguard in its environment; if it is, it must be implemented, and if it is not, the entity must document why and implement an equivalent alternative measure if one is reasonable and appropriate.
The same section, §164.306(b), lets a practice choose its security measures by weighing its size, complexity and capabilities, its technical infrastructure, the cost of the measures, and the probability and criticality of the risks to ePHI. Flexibility of approach changes how a safeguard is met for a four-chair office versus a large group, not whether the standard applies.
What does the access control standard require?
The access control standard, §164.312(a), requires technical policies and procedures that allow access to ePHI only to people or software programs that have been granted access rights. Its four specifications translate into four concrete practices: a unique login for every person, a way to reach patient data during an emergency, sessions that end after inactivity, and encryption of stored ePHI where reasonable and appropriate.
Unique user identification means no shared front-desk or operatory accounts, because a shared name makes it impossible to tell who opened a record. The regulation does not set the idle time for automatic logoff; the practice chooses a period that fits operatory workflow and records the decision. Emergency access means a documented procedure for reaching charts and imaging if the normal path is down, for example when the server is offline.
What are audit controls in a dental office?
The audit controls standard, §164.312(b), requires hardware, software or procedural mechanisms that record and examine activity in systems that contain or use ePHI. In practice that means turning on and keeping the audit logging built into the practice-management software, the operating system and the remote-access tools, and having someone review them.
The rule has no separate specification for audit controls, so the logging must be real and reviewable rather than a policy statement. Documentation of the policies, and of any action, activity or assessment the rule requires to be documented, must be kept for 6 years from the date it was created or last in effect, whichever is later, under §164.316(b)(2)(i).
How does the integrity standard apply to backups and records?
The integrity standard, §164.312(c), requires policies and procedures that protect ePHI from improper alteration or destruction, with one addressable specification: an electronic mechanism to corroborate that ePHI has not been altered or destroyed in an unauthorized manner. For a dental practice, the practical evidence is a backup that has been restored successfully, not only a backup job that reported success.
Checksums, database consistency checks and tested restores are the mechanisms most practices can show. The glossary entry on HIPAA backup verification for dental describes what a dated restore test record should contain, and the guide to whether dental backups actually work walks through the test.
How do person authentication and transmission security work?
Person or entity authentication, §164.312(d), requires procedures to verify that anyone seeking access to ePHI is who they claim to be. The current text does not name multi-factor authentication; the 2025 proposal to revise the Security Rule would make it a requirement, as described in the explainer on the proposed Security Rule changes, which was not final law as of that article’s publication.
Transmission security, §164.312(e), requires technical measures against unauthorized access to ePHI sent over an electronic network, with two addressable specifications: integrity controls, so transmitted ePHI is not modified without detection, and encryption whenever deemed appropriate. For a practice this covers email containing patient information, claims and portal connections, and remote-access sessions to the office network.
What evidence can a practice show for each safeguard?
A practice can demonstrate the technical safeguards with a small set of dated artifacts rather than a large binder. Examples of evidence, not a legal checklist:
- A list of user accounts with the access each holds, and no shared logins (access control).
- The configured idle-timeout setting for operatory and front-desk workstations, with the reason for the chosen period (automatic logoff).
- Sample audit log entries and a record of who reviewed them and when (audit controls).
- A restore test record showing the date, dataset and result (integrity).
- Encryption status of servers, laptops and backups, or the documented reason an addressable item was handled differently (encryption).
- The remote-access and email configuration showing encrypted connections (transmission security).
System-health monitoring can supply some of this evidence without reading patient records; the article on HIPAA-friendly monitoring without PHI access explains where that line sits, and a glass-box RMM keeps an owner-visible log of what the tool saw and did. This article is general information, not legal advice; confirm requirements for a specific practice with a compliance professional or counsel.
Related
Frequently asked questions
Is encryption required by the HIPAA technical safeguards?
Under the current text, encryption is an addressable specification in two places, access control (encryption and decryption of stored ePHI) and transmission security. Addressable means the practice must assess it, implement it if reasonable and appropriate, or document why not and use an equivalent alternative. A 2025 proposal would make encryption required; it was not final law when this article was published.
Does HIPAA require multi-factor authentication today?
The current §164.312(d) requires procedures to verify that a person seeking access is the one claimed, without naming multi-factor authentication. The 2025 proposed update would require it. Many practices enable it now because it is a widely used way to meet the authentication standard.
How long can a workstation sit idle before automatic logoff?
The regulation does not give a number. Automatic logoff is an addressable specification that requires procedures ending a session after a predetermined period of inactivity, so the practice sets and documents the period that suits each location.
Do the technical safeguards apply to a small dental practice?
Yes. They apply to every covered entity and business associate that handles ePHI regardless of size. Under §164.306(b) a small practice may choose measures suited to its size, infrastructure, cost and risk, but it must still meet each standard.