Sources

> Disclaimer: This content is for educational and reference purposes for software builders only. It does not constitute medical, legal, financial, or regulatory advice. Consult a qualified professional before making decisions based on this content.

Authoritative Primary Sources

HIPAA Regulations (US Federal - Public Domain)

  • 45 CFR Part 160 - General Administrative Requirements
URL: https://www.ecfr.gov/current/title-45/part-160 Description: Definitions, enforcement, and breach notification general provisions.
  • 45 CFR Part 162 - Administrative Requirements (Transaction and Code Set Standards)
URL: https://www.ecfr.gov/current/title-45/part-162 Description: EDI transaction standards (837, 835, 270/271, etc.) required for healthcare billing and eligibility.
  • 45 CFR Part 164 - Security and Privacy (HIPAA Security Rule + Privacy Rule)
URL: https://www.ecfr.gov/current/title-45/part-164 Description: The core HIPAA Security Rule (Subpart C) and Privacy Rule (Subpart E) requirements.
  • HHS HIPAA Home - Official Guidance Portal
URL: https://www.hhs.gov/hipaa/index.html Description: Official HHS portal for HIPAA guidance, FAQs, enforcement actions, and rulemaking.
  • HHS Office for Civil Rights (OCR) - HIPAA Enforcement
URL: https://www.hhs.gov/ocr/privacy/hipaa/enforcement/index.html Description: Resolution agreements, corrective action plans, and civil monetary penalty decisions - de-facto implementation guidance.
  • HHS Security Risk Assessment (SRA) Tool
URL: https://www.healthit.gov/topic/privacy-security-and-hipaa/security-risk-assessment-tool Description: Free HHS-sponsored tool for conducting HIPAA Security Rule risk analyses.

NIST Publications

  • NIST SP 800-66 Rev. 2 - Implementing the HIPAA Security Rule
URL: https://csrc.nist.gov/publications/detail/sp/800-66/rev-2/final Description: NIST's authoritative guide for translating HIPAA Security Rule requirements into specific technical and administrative controls.
  • NIST Cybersecurity Framework (CSF) 2.0
URL: https://www.nist.gov/cyberframework Description: Risk-based framework widely used by healthcare organisations to structure HIPAA Security Rule implementation.
  • NIST SP 800-111 - Guide to Storage Encryption Technologies for End User Devices
URL: https://csrc.nist.gov/publications/detail/sp/800-111/final Description: Guidance on selecting and implementing encryption for ePHI stored on portable devices.

Federal Register - HIPAA Rulemaking

  • HIPAA Security Rule Final Rule (2003), 68 FR 8334
URL: https://www.federalregister.gov/documents/2003/02/20/03-3877/health-insurance-reform-security-standards Description: Original HIPAA Security Rule preamble with HHS commentary on implementation expectations.
  • HIPAA Omnibus Rule Final Rule (2013), 78 FR 5565
URL: https://www.federalregister.gov/documents/2013/01/25/2013-01073/modifications-to-the-hipaa-privacy-security-enforcement-and-breach-notification-rules Description: HITECH-mandated modifications, business associate direct liability, and breach risk assessment standard.

HHS Guidance Documents

  • HHS Guidance on HIPAA and Cloud Computing
URL: https://www.hhs.gov/hipaa/for-professionals/special-topics/cloud-computing/index.html Description: Authoritative guidance on BAA requirements, shared responsibility, and cloud-hosted ePHI.
  • HHS Guidance on Mobile Devices and HIPAA
URL: https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/hipaa-and-health-information-technology/index.html Description: Guidance on mobile app HIPAA applicability and technical safeguards for mobile ePHI.
  • HHS Guidance on De-Identification of PHI
URL: https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html Description: Detailed explanation of the Expert Determination and Safe Harbor de-identification methods.

CISA Healthcare Cybersecurity Resources

  • CISA Healthcare and Public Health Sector
URL: https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/healthcare-and-public-health-sector Description: Sector-specific cybersecurity advisories, alerts, and resources relevant to HIPAA-covered software.
  • CISA #StopRansomware - Healthcare
URL: https://www.cisa.gov/stopransomware Description: Joint advisories on ransomware groups targeting healthcare, relevant to security incident preparedness.

ONC Interoperability Resources

  • ONC 21st Century Cures Act - Information Blocking Rule
URL: https://www.healthit.gov/topic/information-blocking Description: Prohibition on information blocking by healthcare developers and their API interoperability obligations.
  • ONC FHIR API Requirements (SMART on FHIR)
URL: https://www.healthit.gov/topic/standards-technology/smart-app-launch Description: Standards for FHIR-based patient app access and OAuth 2.0 scoped PHI authorisation.