HIPAA Security Rule control library
Every control CMDash tracks for HIPAA Security Rule, in the order the standard itself uses. Each one is a row in the product with an owner, a status, evidence and its own history — this page is the public index of what those rows are.
53 controls3 families45 mapped to other frameworks53 with authoritative text
Families
Administrative Safeguards · 29
| 164.308(a)(1)(i) | Security management process Maps to HITRUST CSF v11 |
| 164.308(a)(1)(ii)(A) | Risk analysis (R) Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy) |
| 164.308(a)(1)(ii)(B) | Risk management (R) Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy) |
| 164.308(a)(1)(ii)(C) | Sanction policy (R) Maps to HITRUST CSF v11 |
| 164.308(a)(1)(ii)(D) | Information system activity review (R) Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy) |
| 164.308(a)(2) | Assigned security responsibility (R) Maps to HITRUST CSF v11 |
| 164.308(a)(3)(i) | Workforce security |
| 164.308(a)(3)(ii)(A) | Authorization and/or supervision (A) Maps to HITRUST CSF v11 |
| 164.308(a)(3)(ii)(B) | Workforce clearance procedure (A) Maps to HITRUST CSF v11 |
| 164.308(a)(3)(ii)(C) | Termination procedures (A) Maps to HITRUST CSF v11 |
| 164.308(a)(4)(i) | Information access management Maps to HITRUST CSF v11 |
| 164.308(a)(4)(ii)(A) | Isolating healthcare clearinghouse functions (R) |
| 164.308(a)(4)(ii)(B) | Access authorization (A) Maps to HITRUST CSF v11 |
| 164.308(a)(4)(ii)(C) | Access establishment and modification (A) Maps to HITRUST CSF v11 |
| 164.308(a)(5)(i) | Security awareness and training Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy) |
| 164.308(a)(5)(ii)(A) | Security reminders (A) |
| 164.308(a)(5)(ii)(B) | Protection from malicious software (A) Maps to HITRUST CSF v11 |
| 164.308(a)(5)(ii)(C) | Log-in monitoring (A) Maps to HITRUST CSF v11 |
| 164.308(a)(5)(ii)(D) | Password management (A) Maps to HITRUST CSF v11 |
| 164.308(a)(6)(i) | Security incident procedures Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy) |
| 164.308(a)(6)(ii) | Response and reporting (R) Maps to HITRUST CSF v11 |
| 164.308(a)(7)(i) | Contingency plan Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy) |
| 164.308(a)(7)(ii)(A) | Data backup plan (R) Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy) |
| 164.308(a)(7)(ii)(B) | Disaster recovery plan (R) Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy) |
| 164.308(a)(7)(ii)(C) | Emergency mode operation plan (R) Maps to HITRUST CSF v11 |
| 164.308(a)(7)(ii)(D) | Testing and revision procedures (A) Maps to HITRUST CSF v11 |
| 164.308(a)(7)(ii)(E) | Applications and data criticality analysis (A) Maps to HITRUST CSF v11 |
| 164.308(a)(8) | Evaluation (R) Maps to HITRUST CSF v11 |
| 164.308(b)(1) | Business associate contracts Maps to HITRUST CSF v11 |
Physical Safeguards · 12
| 164.310(a)(1) | Facility access controls Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy) |
| 164.310(a)(2)(i) | Contingency operations (A) |
| 164.310(a)(2)(ii) | Facility security plan (A) Maps to HITRUST CSF v11 |
| 164.310(a)(2)(iii) | Access control and validation (A) Maps to HITRUST CSF v11 |
| 164.310(a)(2)(iv) | Maintenance records (A) Maps to HITRUST CSF v11 |
| 164.310(b) | Workstation use (R) |
| 164.310(c) | Workstation security (R) Maps to HITRUST CSF v11 |
| 164.310(d)(1) | Device and media controls Maps to HITRUST CSF v11 |
| 164.310(d)(2)(i) | Disposal (R) Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy) |
| 164.310(d)(2)(ii) | Media re-use (R) Maps to HITRUST CSF v11 |
| 164.310(d)(2)(iii) | Accountability (A) Maps to HITRUST CSF v11 |
| 164.310(d)(2)(iv) | Data backup and storage (A) Maps to HITRUST CSF v11 |
Technical Safeguards · 12
| 164.312(a)(1) | Access control Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy) |
| 164.312(a)(2)(i) | Unique user identification (R) Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy) |
| 164.312(a)(2)(ii) | Emergency access procedure (R) |
| 164.312(a)(2)(iii) | Automatic logoff (A) Maps to HITRUST CSF v11 |
| 164.312(a)(2)(iv) | Encryption and decryption (A) Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy) |
| 164.312(b) | Audit controls (R) Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy) |
| 164.312(c)(1) | Integrity Maps to HITRUST CSF v11 |
| 164.312(c)(2) | Mechanism to authenticate ePHI (A) Maps to HITRUST CSF v11 |
| 164.312(d) | Person or entity authentication (R) Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy) |
| 164.312(e)(1) | Transmission security |
| 164.312(e)(2)(i) | Integrity controls (A) |
| 164.312(e)(2)(ii) | Encryption (A) Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy) |
Where this comes from
Control identifiers, families and titles are the rows CMDash’s own seed data writes for HIPAA Security Rule 2013, published from a build-time export rather than read from any customer’s workspace. Control text is quoted verbatim from 45 CFR Part 164 (eCFR, as in force 2026-01-01), which is in the public domain. Cross-framework mappings are CMDash’s own, and each one is shown on both frameworks it connects.
Track these controls in CMDash
Every control on this page becomes a row with an owner, a status, evidence and an audit trail — with the crosswalks already wired, so evidence mapped once counts in more than one framework.