HIPAA Security Implementation, Version 1.0

The Security Rule has several key concepts:

• Principle based. The Security Rule presents a series of security best practices and principles with which CEs must comply . No step by step checklists are provided.

• Reasonableness. CEs must do everything that is appropriate to avert all reasonably anticipated risks to their EPHI. They must balance their resources and business requirements against the risks to EPHI.

• Full compliance. All CE staff, including management and those who work at home, must comply with the Security Rule.

• Developed from multiple security guidelines and standards. The creators of the Security Rule found no existing single security standard or best practice that described how to comprehensively protect EPHI. The rule therefore, is based on many different security guidelines, standards, and best practices.

• Documentation. CEs must document a variety of security processes, policies, and procedures. They must also document Security Rule implementation decisions.

• Ongoing compliance. CEs must regularly train employees and revise security policies and procedures as needed.