--- title: "45 CFR Appendix A to Subpart C of Part 164 HIPAA: Security Standards: Matrix" canonical: "https://dposchool.com/hipaa/section/appendix-a-to-subpart-c-of-part-164" source: "https://www.ecfr.gov/current/title-45/part-164/appendix-Appendix%20A%20to%20Subpart%20C%20of%20Part%20164" source_note: "Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 45 CFR Appendix A to Subpart C of Part 164 HIPAA · Part 164: SECURITY AND PRIVACY · Subpart C: Security Standards for the Protection of Electronic Protected Health Information # 45 CFR Appendix A to Subpart C of Part 164 HIPAA: Security Standards: Matrix eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text | Standards | Sections | Implementation Specifications (R) = Required, (A) = Addressable | | --- | --- | --- | | Administrative Safeguards | | Security Management Process | 164.308(a)(1) | Risk Analysis (R) | | | | Risk Management (R) | | | | Sanction Policy (R) | | | | Information System Activity Review (R) | | Assigned Security Responsibility | 164.308(a)(2) | (R) | | Workforce Security | 164.308(a)(3) | Authorization and/or Supervision (A) | | | | Workforce Clearance Procedure | | | | Termination Procedures (A) | | Information Access Management | 164.308(a)(4) | Isolating Health care Clearinghouse Function (R) | | | | Access Authorization (A) | | | | Access Establishment and Modification (A) | | Security Awareness and Training | 164.308(a)(5) | Security Reminders (A) | | | | Protection from Malicious Software (A) | | | | Log-in Monitoring (A) | | | | Password Management (A) | | Security Incident Procedures | 164.308(a)(6) | Response and Reporting (R) | | Contingency Plan | 164.308(a)(7) | Data Backup Plan (R) | | | | Disaster Recovery Plan (R) | | | | Emergency Mode Operation Plan (R) | | | | Testing and Revision Procedure (A) | | | | Applications and Data Criticality Analysis (A) | | Evaluation | 164.308(a)(8) | (R) | | Business Associate Contracts and Other Arrangement | 164.308(b)(1) | Written Contract or Other Arrangement (R) | | Physical Safeguards | | Facility Access Controls | 164.310(a)(1) | Contingency Operations (A) | | | | Facility Security Plan (A) | | | | Access Control and Validation Procedures (A) | | | | Maintenance Records (A) | | Workstation Use | 164.310(b) | (R) | | Workstation Security | 164.310(c) | (R) | | Device and Media Controls | 164.310(d)(1) | Disposal (R) | | | | Media Re-use (R) | | | | Accountability (A) | | | | Data Backup and Storage (A) | | Technical Safeguards (see § 164.312) | | Access Control | 164.312(a)(1) | Unique User Identification (R) | | | | Emergency Access Procedure (R) | | | | Automatic Logoff (A) | | | | Encryption and Decryption (A) | | Audit Controls | 164.312(b) | (R) | | Integrity | 164.312(c)(1) | Mechanism to Authenticate Electronic Protected Health Information (A) | | Person or Entity Authentication | 164.312(d) | (R) | | Transmission Security | 164.312(e)(1) | Integrity Controls (A) | | | | Encryption (A) | ## Source Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. [45 CFR Appendix A to Subpart C of Part 164 on eCFR](https://www.ecfr.gov/current/title-45/part-164/appendix-Appendix%20A%20to%20Subpart%20C%20of%20Part%20164) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [HIPAA Navigator](https://dposchool.com/hipaa) / 45 CFR Appendix A to Subpart C of Part 164 Previous: [45 CFR 164.318 HIPAA: Compliance dates for the initial implementation of the security standards](https://dposchool.com/hipaa/section/164.318) Next: [45 CFR 164.400 HIPAA: Applicability](https://dposchool.com/hipaa/section/164.400) ## For AI agents - Machine-readable index: https://dposchool.com/hipaa/llms.txt - JSON API: https://dposchool.com/hipaa/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents