5 min read · Educational guide · Sources reviewed November 6, 2026
Administrative: how security is managed
Administrative safeguards include security management, workforce practices, training, and contingency planning. They establish who makes decisions and how risks are addressed. Workforce training should match staff roles and actual workflows.
Physical: where information systems live
Physical safeguards concern facilities, workstations, and devices that handle ePHI. Review access, equipment movement, disposal, and workstation use. Paper records also need protection, but their HIPAA treatment involves Privacy Rule considerations.
Technical: how systems control and record access
Technical safeguards include access control, audit controls, integrity, authentication, and transmission security. Controls should reflect your environment and risk analysis.
Addressable does not mean optional
Where the current rule identifies an implementation specification as addressable, the organization must assess whether it is reasonable and appropriate. Decisions and appropriate alternatives require documentation. A screening answer of “not applicable” does not settle that analysis.