--- title: "45 CFR 164.306 HIPAA: Security standards: General rules" canonical: "https://dposchool.com/hipaa/section/164.306" source: "https://www.ecfr.gov/current/title-45/section-164.306" source_note: "Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 45 CFR 164.306 HIPAA · Part 164: SECURITY AND PRIVACY · Subpart C: Security Standards for the Protection of Electronic Protected Health Information # 45 CFR 164.306 HIPAA: Security standards: General rules eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text ### 45 CFR 164.306(a) **(a)** General requirements. Covered entities and business associates must do the following: #### 45 CFR 164.306(a)(1) **(1)** Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits. #### 45 CFR 164.306(a)(2) **(2)** Protect against any reasonably anticipated threats or hazards to the security or integrity of such information. #### 45 CFR 164.306(a)(3) **(3)** Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under subpart E of this part. #### 45 CFR 164.306(a)(4) **(4)** Ensure compliance with this subpart by its workforce. ### 45 CFR 164.306(b) **(b)** Flexibility of approach. (1) Covered entities and business associates may use any security measures that allow the covered entity or business associate to reasonably and appropriately implement the standards and implementation specifications as specified in this subpart. #### 45 CFR 164.306(b)(2) **(2)** In deciding which security measures to use, a covered entity or business associate must take into account the following factors: ##### 45 CFR 164.306(b)(2)(i) **(i)** The size, complexity, and capabilities of the covered entity or business associate. ##### 45 CFR 164.306(b)(2)(ii) **(ii)** The covered entity's or the business associate's technical infrastructure, hardware, and software security capabilities. ##### 45 CFR 164.306(b)(2)(iii) **(iii)** The costs of security measures. ##### 45 CFR 164.306(b)(2)(iv) **(iv)** The probability and criticality of potential risks to electronic protected health information. ### 45 CFR 164.306(c) **(c)** Standards. A covered entity or business associate must comply with the applicable standards as provided in this section and in §§ 164.308, 164.310, 164.312, 164.314 and 164.316 with respect to all electronic protected health information. ### 45 CFR 164.306(d) **(d)** Implementation specifications. In this subpart: #### 45 CFR 164.306(d)(1) **(1)** Implementation specifications are required or addressable. If an implementation specification is required, the word “Required” appears in parentheses after the title of the implementation specification. If an implementation specification is addressable, the word “Addressable” appears in parentheses after the title of the implementation specification. #### 45 CFR 164.306(d)(2) **(2)** When a standard adopted in § 164.308, § 164.310, § 164.312, § 164.314, or § 164.316 includes required implementation specifications, a covered entity or business associate must implement the implementation specifications. #### 45 CFR 164.306(d)(3) **(3)** When a standard adopted in § 164.308, § 164.310, § 164.312, § 164.314, or § 164.316 includes addressable implementation specifications, a covered entity or business associate must— ##### 45 CFR 164.306(d)(3)(i) **(i)** Assess whether each implementation specification is a reasonable and appropriate safeguard in its environment, when analyzed with reference to the likely contribution to protecting electronic protected health information; and ##### 45 CFR 164.306(d)(3)(ii) **(ii)** As applicable to the covered entity or business associate— ###### 45 CFR 164.306(d)(3)(ii)(A) **(A)** Implement the implementation specification if reasonable and appropriate; or ###### 45 CFR 164.306(d)(3)(ii)(B) **(B)** If implementing the implementation specification is not reasonable and appropriate— $(1) Document why it would not be reasonable and appropriate to implement the implementation specification; and $(2) Implement an equivalent alternative measure if reasonable and appropriate. ### 45 CFR 164.306(e) **(e)** Maintenance. A covered entity or business associate must review and modify the security measures implemented under this subpart as needed to continue provision of reasonable and appropriate protection of electronic protected health information, and update documentation of such security measures in accordance with § 164.316(b)(2)(iii). ## Source Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. Source credit: \[68 FR 8376, Feb. 20, 2003; 68 FR 17153, Apr. 8, 2003; 78 FR 5693, Jan. 25, 2013\] [45 CFR 164.306 on eCFR](https://www.ecfr.gov/current/title-45/section-164.306) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [HIPAA Navigator](https://dposchool.com/hipaa) / 45 CFR 164.306 Previous: [45 CFR 164.304 HIPAA: Definitions](https://dposchool.com/hipaa/section/164.304) Next: [45 CFR 164.308 HIPAA: Administrative safeguards](https://dposchool.com/hipaa/section/164.308) ## For AI agents - Machine-readable index: https://dposchool.com/hipaa/llms.txt - JSON API: https://dposchool.com/hipaa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents