A former medical assistant left your practice on a Friday. On Tuesday, your office manager notices her login still works in the practice management system, and the audit log shows two chart views over the weekend. That single fact pattern touches four of the five HIPAA technical safeguards standards at once — access control, audit controls, authentication, and the workforce termination procedures that hang off them.

This article is for the person who has to fix that: the practice owner, privacy officer, security officer, or compliance lead. It walks through 45 CFR 164.312 standard by standard, names who owns each control inside a small or mid-sized practice, and describes exactly what the documented evidence looks like when someone asks for it.

What HIPAA Technical Safeguards Require Under 45 CFR 164.312

The Security Rule's technical safeguards section contains five standards. Every covered entity and business associate that creates, receives, maintains, or transmits electronic PHI must address all five.

  1. Access Control — unique user identification (required), emergency access procedure (required), automatic logoff (addressable), encryption and decryption (addressable).
  2. Audit Controls — record and examine activity in systems containing ePHI (required; no separate implementation specifications).
  3. Integrity — protect ePHI from improper alteration or destruction, with a mechanism to authenticate ePHI (addressable).
  4. Person or Entity Authentication — verify that a person seeking access is who they claim to be (required).
  5. Transmission Security — integrity controls (addressable) and encryption in transit (addressable).

The full regulatory text and OCR's guidance material live on the HHS Security Rule page. NIST's implementation companion, SP 800-66 Revision 2, maps each standard to concrete controls and is the single most useful free document for a practice building this from scratch.

"Addressable" Does Not Mean Optional — It Means Documented

This is where most practices get into trouble during an investigation. Addressable implementation specifications give you three lawful paths, and only three.

  • Implement the specification as written.
  • Implement an equivalent alternative measure, and document why it is reasonable and appropriate.
  • Implement nothing, and document why the specification is not reasonable and appropriate and why no alternative exists.

Skipping encryption on a laptop because "we didn't get around to it" is not one of the three. If you chose not to encrypt something, that decision needs a dated entry in your risk analysis with the name of the person who made it and the compensating control you put in place instead.

Note also that OCR published a proposed rule in January 2025 that would eliminate the required/addressable distinction and make specifications like encryption and multi-factor authentication mandatory. As of this writing that rulemaking is not final. Practices that already treat encryption and MFA as baseline will have very little work to do if and when it lands.

Access Control: The Termination Clock Your Front Office Keeps Missing

Unique user identification

Every workforce member gets their own credential. No shared front-desk login, no "nurse1" account rotating among four people, no generic scanner account with write access to the chart. Shared credentials destroy the evidentiary value of every audit log you keep.

Your documented evidence: a current user roster exported from each system that touches ePHI — EHR, practice management, imaging, patient messaging, cloud storage, email — with the human name attached to each account and the last login date.

Termination and role change

Write the rule down and make it boring: access is disabled the same business day employment ends, before the person leaves the building for an involuntary separation. Assign one accountable owner — usually the office manager — and one backup.

The offboarding checklist should cover the EHR, the practice management system, email, the VPN or remote desktop, the fax portal, the clearinghouse, the payer portals, the badge or door code, and any shared password vault. Signed and dated by the person who executed it. Keep it six years.

Emergency access procedure

This one is required and almost universally missing in practices under 20 providers. You need a documented way for authorized clinicians to reach ePHI during an outage — a break-glass account whose credentials are sealed and stored securely, a downtime read-only copy, or a defined call path to your IT vendor with a service-level commitment.

Test it once a year. Write down the date, who participated, how long access took, and what broke.

Automatic logoff

Addressable, and easy. Set session timeouts by location risk: short at the check-in counter and in any workstation visible from a waiting area, longer at a workstation inside a locked provider office. Document the timeout values and the justification for each. Screen privacy filters are a reasonable supplement, never a substitute.

Audit Controls: Recording Is Half the Standard, Reviewing Is the Other Half

Section 164.312(b) requires mechanisms that record and examine activity. Nearly every practice has logging enabled by default. Very few have any evidence that a human looked at the logs.

Build a review cadence you can actually sustain:

  • Monthly: failed login spikes, after-hours access, logins from unexpected locations, accounts with no activity in 60 days.
  • Quarterly: a targeted sample — VIP or employee charts, any patient sharing a surname with a staff member, records involved in a known dispute.
  • Event-driven: every termination, every patient complaint about privacy, every time a staff member reports a colleague's curiosity.

The evidence is a one-page log review memo per cycle: date, reviewer, systems examined, period covered, anomalies found, disposition of each anomaly. Two paragraphs is fine. Zero pages is a finding.

Snooping cases are the reason this matters. OCR's breach portal is full of incidents that began with an employee viewing a chart they had no business reason to open, and the resolution almost always turns on whether the entity could reconstruct who saw what and when.

Authentication and Transmission Security

Person or entity authentication

The standard is required; the method is yours to choose. In 2025, password-only authentication on any internet-facing system holding ePHI is very hard to defend as reasonable and appropriate. Turn on MFA for remote access, email, the EHR if the vendor supports it, and every administrative account.

Document the exceptions. If a legacy imaging system cannot support MFA, record that limitation, restrict it to the internal network, and put it on your remediation plan with a target date.

Transmission security and the encryption safe harbor

Encryption of ePHI in transit is technically addressable, but the practical calculus settles it. Under the Breach Notification Rule, PHI that has been encrypted consistent with HHS guidance is not "unsecured" — and an incident involving properly encrypted data does not trigger notification. A stolen encrypted laptop is a property loss. A stolen unencrypted laptop is a reportable breach, a patient notification mailing, and a portal entry.

Concretely: full-disk encryption on every laptop, desktop, and tablet that touches ePHI; TLS on email and portal traffic; encrypted backups; encrypted removable media, or a written prohibition on removable media enforced by port control. Keep the encryption status report from your endpoint management tool as evidence — a screenshot with a date beats an assertion in a policy binder.

Where Your Vendors Sit Inside the Technical Safeguards

Half the controls above run on infrastructure you do not own. Your EHR vendor holds the audit logs. Your IT managed service provider holds domain administrator credentials. Your backup vendor holds a full copy of your database. Your transcription service holds dictation audio.

Each of them is a business associate, and each needs an executed agreement before ePHI moves. The agreement is not a formality — it is the instrument that obligates the vendor to apply the same technical safeguards, to report security incidents to you within a defined window, and to return or destroy PHI at termination. When you find an unpapered vendor during your inventory, you can generate a signature-ready Business Associate Agreement through a six-step wizard and export it as PDF or DOCX the same afternoon, rather than waiting on outside counsel for a routine document.

Build the vendor list first. One row per vendor: what data they touch, whether a BAA is executed, the effective date, the incident-notification window, and who at your practice owns the relationship. Practices that skip this step consistently discover two or three unpapered vendors — a fax-to-email service, a marketing agency with portal access, a scanning contractor.

A 90-Day Sequence That Actually Closes Gaps

Days 1–30 — Inventory and baseline. List every system, device, and vendor that touches ePHI. Pull user rosters from each system and reconcile them against your current payroll. Confirm encryption status on every endpoint. Run the free HHS/ONC Security Risk Assessment Tool if you do not have a current risk analysis.

Days 31–60 — Remediate the required items. Kill shared accounts. Write and test the emergency access procedure. Enable MFA everywhere it is supported. Encrypt anything that is not. Execute missing BAAs.

Days 61–90 — Build the recurring evidence. Set the audit log review calendar and complete the first cycle. Set session timeouts by location. Update your written policies to match what you actually do — not what a template says. Train staff on the changes and keep the sign-in sheet.

Then repeat annually, and any time you change EHRs, open a location, or add a system that touches ePHI. If you would rather not assemble the risk analysis and policy set by hand, tools that automate the HIPAA risk analysis and full compliance document set can compress that work considerably — though the operational discipline still has to come from your staff.

What an Investigator Asks For

When OCR opens a case — usually after a breach report or a patient complaint — the data request is predictable. Expect to produce your current risk analysis with dates, your risk management plan showing remediation progress, your written technical safeguards policies, your workforce termination checklists, sample audit log reviews, encryption status documentation, and your executed BAAs.

Every item on that list is something you can build before anyone asks. None of it requires a large budget. Nearly all of it requires an owner and a calendar.

If your vendor inventory turned up agreements you cannot find or never signed, close that gap first — it is the fastest fix on the list. Build and export a compliant BAA in one sitting, one-time purchase, no subscription, then move on to the audit log review you have been postponing.