The Security Rule requires providers to maintain reasonable and appropriate administrative, technical, and physical safeguards for protecting e-PHI. Specifically, providers must: 

• Ensure the confidentiality, integrity, and availability of all e-PHI they create, receive, maintain, or transmit
• Identify and protect against reasonably anticipated threats to the security or integrity of the information
• Protect against reasonably anticipated, impermissible uses or disclosures
• Ensure compliance with their workforce

The Security Rule defines “confidentiality” to mean that e-PHI is not available or disclosed to unauthorized persons. The Security Rule’s confidentiality requirements support the Privacy Rule’s prohibitions against improper uses and disclosures of PHI. The Security rule also promotes the two additional goals of maintaining the integrity and availability of e-PHI. Under the Security Rule, “integrity” means that e-PHI is not altered or destroyed in an unauthorized manner. “Availability” means that e-PHI is accessible and usable on demand by an authorized person. 

HHS recognizes that providers range from the smallest provider to the largest, multi-state health plan. Therefore the Security Rule is flexible and scalable to allow providers to analyze their own needs and implement solutions appropriate for their specific environments. What is appropriate for a particular provider will depend on the nature of the provider’s business, as well as the provider’s size and resources.  

Therefore, when a provider is deciding which security measures to use, the Rule does not dictate those measures but requires the provider to consider: 

• Its size, complexity, and capabilities
• Its technical, hardware, and software infrastructure
• The costs of security measures  
• The likelihood and the possible impact of potential risks to e-PHI

Providers must review and modify their security measures to continue protecting e-PHI in a changing environment.