Question 1

What are the HIPAA Security Rule technical safeguards and how do you test for them?

Accepted Answer

The HIPAA Security Rule technical safeguards are defined in 45 CFR § 164.312 and cover four categories: access controls (unique user IDs, emergency access procedures, automatic logoff, encryption/decryption), audit controls (hardware, software, and procedural mechanisms to record and examine access to ePHI), integrity controls (mechanisms to authenticate ePHI and protect it from improper alteration or destruction), and transmission security (encryption and integrity controls for ePHI transmitted over electronic networks). Our assessments test each of these controls through manual penetration testing and configuration review — validating that access controls enforce least privilege, audit logs capture all ePHI access events, integrity mechanisms detect unauthorized modification, and transmission channels use TLS 1.2+ or equivalent encryption. Deliverables map every finding directly to the relevant § 164.312 subsection for audit submission.

Question 2

How do you secure medical devices and IoMT equipment on hospital networks?

Accepted Answer

Medical devices and Internet of Medical Things (IoMT) equipment — infusion pumps, patient monitors, imaging systems, and connected diagnostic devices — often run legacy operating systems that cannot be patched or updated. Our approach centers on network micro-segmentation: isolating clinical device VLANs from administrative networks, EHR systems, and internet-facing segments using firewall rules and access control lists that permit only the specific traffic flows each device requires. We conduct device inventory and traffic analysis to map communication patterns, then design segmentation policies that maintain clinical workflows while eliminating lateral movement paths. For devices that require internet connectivity for vendor updates or cloud reporting, we implement monitored jump points with protocol-level inspection rather than allowing direct outbound access.

Question 3

Does HIPAA require penetration testing?

Accepted Answer

HIPAA does not explicitly mandate penetration testing by name. However, the Security Rule requires covered entities to conduct a "technical evaluation" (45 CFR § 164.308(a)(8)) in response to environmental or operational changes, and HHS Office for Civil Rights (OCR) guidance strongly recommends penetration testing as part of the required risk analysis under § 164.308(a)(1). In practice, OCR enforcement actions and resolution agreements have consistently cited the absence of penetration testing as evidence of insufficient risk analysis. The 2024 HIPAA Security Rule NPRM proposes making penetration testing an explicit requirement every 12 months. Organizations preparing for compliance should treat annual penetration testing as a de facto requirement — both because OCR expects it and because it is the most effective method for validating that technical safeguards actually function under adversarial conditions.

Question 4

What are the HIPAA encryption requirements for ePHI at rest and in transit?

Accepted Answer

HIPAA classifies encryption as an "addressable" implementation specification under both the access control standard (§ 164.312(a)(2)(iv) for data at rest) and the transmission security standard (§ 164.312(e)(2)(ii) for data in transit). "Addressable" does not mean optional — it means the covered entity must implement encryption if reasonable and appropriate, or document an equivalent alternative safeguard if encryption is not feasible. In practice, there is no defensible alternative to encryption for most healthcare environments. For data in transit, HHS guidance references NIST SP 800-52 and recommends TLS 1.2 or higher for all ePHI transmissions. For data at rest, AES-256 encryption is the standard for databases, file systems, and backup media containing ePHI. Our assessments verify encryption implementation across all ePHI storage locations and transmission paths, including database connections, API integrations, email systems, backup processes, and removable media policies.

Question 5

What are the HIPAA breach notification requirements and timelines?

Accepted Answer

Under the HIPAA Breach Notification Rule (45 CFR §§ 164.400–414), covered entities must notify affected individuals without unreasonable delay and no later than 60 calendar days after a breach of unsecured ePHI is discovered. Breaches affecting 500 or more individuals must also be reported to HHS OCR at the same time as individual notice, and breaches affecting more than 500 residents of a single state or jurisdiction additionally require notice to prominent media outlets serving that area within the same 60-day window. Breaches affecting fewer than 500 individuals are logged and reported to HHS annually, within 60 days after the end of the calendar year. Business associates must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery — though many business associate agreements contractually require faster notice. A breach is presumed to have occurred for any unauthorized acquisition, access, use, or disclosure of ePHI unless the covered entity demonstrates through a four-factor risk assessment that there is a low probability the ePHI was compromised. The best way to avoid breach notification obligations is to encrypt all ePHI — encrypted data that is lost or stolen is not considered "unsecured" ePHI and does not trigger notification requirements.

Question 6

How does the NY SHIELD Act affect healthcare providers in New York?

Accepted Answer

The New York SHIELD Act (S5575B) expanded data breach notification requirements and imposed affirmative data security obligations on any business that holds private information of New York residents — including healthcare providers already subject to HIPAA. The SHIELD Act requires "reasonable safeguards" across three categories: administrative (designating a security coordinator, employee training, vendor due diligence), technical (risk assessment, intrusion detection, testing and monitoring of controls), and physical (secure disposal, access controls for data storage). For healthcare organizations, the key impact is that SHIELD Act obligations exist in addition to HIPAA — they are not preempted by federal law. The SHIELD Act also broadened the definition of "private information" to include biometric data and account credentials such as email addresses with passwords or security questions. Our compliance assessments evaluate your controls against both HIPAA and SHIELD Act requirements simultaneously, producing a unified gap analysis that satisfies both frameworks without duplicating remediation effort.

Cybersecurity for NYC Healthcare Organizations

Why Do Healthcare Organizations Choose Fortress?

HIPAA Technical Safeguard Alignment

Medical Device Network Segmentation

EHR & Patient Portal Security

NYC Regulatory Depth

What Does the Regulatory Landscape Look Like for Healthcare?

What Cybersecurity Services Does Fortress Offer Healthcare Organizations?

Managed Network Infrastructure

Penetration Testing for HIPAA

Web Application Security

Is your organization ready for a HIPAA audit?

Have Questions About Healthcare Cybersecurity?