Government and public statistics
45 CFR 164.312: Technical safeguards (HIPAA Security Rule)
U.S. Department of Health and Human Services (text reproduced by Cornell Legal Information Institute), 2013
Read the originalRead on October 16, 2026
- What it is
- The federal regulation setting technical safeguards for electronic protected health information, including the encryption and decryption specification. It labels encryption as addressable, meaning covered entities must assess and document whether to implement it.
- How much weight it carries
- Binding federal regulation. The copy used is the Cornell Legal Information Institute reproduction of the Code of Federal Regulations; the official text is on eCFR. The regulation does not require any particular dictation product.
Facts taken from this source
- The HIPAA Security Rule's technical safeguards include an audit controls standard: mechanisms that record and examine activity in systems that contain or use electronic protected health information.
“Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.” (45 CFR 164.312(b))
- The HIPAA Security Rule lists automatic logoff, which ends an electronic session after a predetermined time of inactivity, as an addressable implementation specification.
“Automatic logoff (Addressable). Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity.” (§ 164.312(a)(2)(iii))
- The HIPAA Security Rule requires a unique name or number for identifying and tracking each user of an electronic system that holds electronic protected health information.
“Unique user identification (Required). Assign a unique name and/or number for identifying and tracking user identity.” (§ 164.312(a)(2)(i))
- The HIPAA Security Rule lists encryption and decryption of electronic protected health information as an addressable implementation specification.
“(iv) Encryption and decryption (Addressable). Implement a mechanism to encrypt and decrypt electronic protected health information.”
Pages that rest on this source
- Is Dictation HIPAA Compliant? What Makes It SafeGuide
- Is Apple Dictation Private? What Apple KeepsGuide
- Is Apple Dictation HIPAA compliant?Question
- Is on-device dictation HIPAA compliant?Question
- Which dictation apps and software are HIPAA compliant?Question
- Protected health information (PHI)Glossary
- Can you do medical transcription from home?Question
- Dictation for Work: Doctors, Lawyers, Writers, StudentsTopic
- Speech to Text Privacy: Where Your Voice GoesTopic
- Dictation Machines: What They Do and Who Still Uses ThemGuide
- Professional Dictation Software for Specialist FieldsGuide
- Why do doctors dictate their notes?Question