HIPAA Security Rule — original final security standards
Enacted in force
Fields requiring verification
- enforcement date: Unverified — No distinct enforcement-start date was established. Primary source
- penalty amount: Unverified — Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description. Primary source
In plain English
- For this original-rule record: HIPAA-covered health plans, health care clearinghouses and health care providers that conduct covered electronic transactions, protecting electronic PHI. Primary source
- Small health plans had an additional year. Primary source
- Later direct business-associate duties are not attributed to this 2003 instrument. Primary source
- Implement required administrative, physical and technical safeguards to protect electronic PHI. Primary source
- Perform risk analysis and risk management and apply reasonable and appropriate safeguards, including evaluating addressable implementation specifications. Primary source
- Maintain required security policies, procedures, documentation and business-associate contractual assurances under the original rule. Primary source
Dates and phased obligations
Legal effective date: 2003-04-21. General covered-entity compliance: 2005-04-21; small-health-plan compliance: 2006-04-21. Primary source
Legal effective date April 21, 2003; covered entities other than small health plans had to comply by April 21, 2005; small plans by April 21, 2006. This distinct foundational instrument is not an assertion that later amendments and direct business-associate liability are fully summarized here. Source and qualifications
Questions from this record
Who does 45 CFR 164 subpart C; 68 FR 8334 cover?
For this original-rule record: HIPAA-covered health plans, health care clearinghouses and health care providers that conduct covered electronic transactions, protecting electronic PHI. Small health plans had an additional year. Later direct business-associate duties are not attributed to this 2003 instrument. Primary source
What is the law’s status?
Enacted / in force Primary source
What date does this record track?
Legal effective date: 2003-04-21. General covered-entity compliance: 2005-04-21; small-health-plan compliance: 2006-04-21. Primary source
Has this record been verified?
This record’s accepted facts were last reviewed on 2026-11-13; unsupported comparison fields remain Unverified. Primary source
- HHS original final rule, 68 FR 8334DATES; 45 CFR 164.302–164.318; original scope and business-associate provisions
Not legal advice. This page restates the linked record and does not determine whether a particular business is covered. Methodology and verification limits.