Government and public statistics

45 CFR 164.308: Administrative safeguards

Legal Information Institute, Cornell Law School, 2026

Read on October 16, 2026

What it is: The HIPAA Security Rule section on administrative safeguards, including the required risk analysis.
How much weight it carries: The federal regulation as published by Cornell LII. It is primary law.

Facts taken from this source

Under the HIPAA Security Rule, a covered entity may let a business associate create, receive, maintain or transmit electronic protected health information only if it obtains satisfactory assurances that the business associate will safeguard it.
“A covered entity may permit a business associate to create, receive, maintain, or transmit electronic protected health information on the covered entity's behalf only if the covered entity obtains satisfactory assurances” (164.308(b)(1))
The HIPAA Security Rule makes an accurate and thorough risk analysis of the risks to the confidentiality, integrity and availability of electronic protected health information a required implementation specification.
“Risk analysis (Required). Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality , integrity , and availability of electronic protected health information” (45 CFR 164.308(a)(1)(ii)(A))