Only the HIPAA Security Rule applies exclusively to protected health information (PHI). The Privacy Rule covers PHI but also reaches paper records, oral communications, and employment records; the Security Rule's scope is limited to electronic PHI (ePHI). That single distinction—electronic only—is why the Security Rule is the rule that applies exclusively to PHI in its electronic form, while the Privacy Rule applies to PHI in any medium. Understanding this requires looking at how the two rules were built, what each one regulates, and where their boundaries actually sit.
The two-rule architecture inside Title II
Title II of HIPAA, the Administrative Simplification provisions, directed the Department of Health and Human Services (HHS) to regulate how health information moves through the system. HHS implemented that mandate through two separate rulemakings. The Privacy Rule, issued in 2000 and effective 2003, governs uses and disclosures of PHI regardless of format. The Security Rule, issued in 2003, governs safeguards for ePHI only.
The rules answer different questions. Privacy asks: who may see or receive PHI, and under what conditions? Security asks: how must ePHI be protected technically, physically, and administratively? A covered entity can comply with privacy by refusing a disclosure and still violate security by leaving an unencrypted laptop in a car. The two obligations travel together but never merge.
The mechanism matters because the Security Rule was written around a specific object: electronic data. Its standards assume databases, networks, access controls, audit logs, and transmission channels. That object limitation is what makes exclusivity possible. The Privacy Rule could not be limited that way because Congress and HHS intended it to cover the paper chart, the fax, and the hallway conversation.
Why the Security Rule is the exclusive one
The Privacy Rule applies to PHI in any form—electronic, paper, or oral. HHS states this directly: the Privacy Rule covers "protected health information" without regard to medium. The Security Rule, by contrast, defines its jurisdiction as "electronic protected health information," meaning PHI that is transmitted by or maintained in electronic media.
That word "electronic" is the whole answer to the keyword question. Exclusivity runs in one direction: every Security Rule violation is also an ePHI event, but not every Privacy Rule violation involves ePHI. A misplaced paper file triggers Privacy Rule analysis and breach-notification analysis, but it does not trigger Security Rule safeguards because no electronic medium is involved.
There is a second, subtler exclusivity. The Security Rule is the only HIPAA rule that imposes a formal, mandatory risk analysis tied to electronic systems. The Privacy Rule requires safeguards too, but its safeguard language is general and not structured as the Security Rule's three-part administrative, physical, and technical framework.
Plain-language version: the Privacy Rule covers the information; the Security Rule covers the electronic version of the information and the systems holding it.
The three safeguard categories, quantified
The Security Rule organizes its requirements into administrative, physical, and technical safeguards, plus organizational requirements and policies and procedures. Administrative safeguards include the risk analysis, workforce training, and contingency planning. Physical safeguards cover facility access, workstation use, and device and media controls. Technical safeguards cover access control, audit controls, integrity, person or entity authentication, and transmission security.
Each standard is either "required" or "addressable." Addressable does not mean optional; it means the entity must assess whether the specification is reasonable and appropriate, implement it, or document why an equivalent alternative achieves the same protection. HHS has been explicit that addressable specifications are not a loophole.
Numbers help here. The Security Rule contains 22 standards and implementation specifications across its three safeguard categories. The risk analysis alone is cited in a large share of enforcement actions; HHS's enforcement results repeatedly list failure to conduct an accurate and thorough risk analysis as a top violation. Encryption is addressable, not required, but HHS treats encryption as the primary method of rendering ePHI unusable, and the breach notification rule provides a safe harbor when ePHI is encrypted to the HHS-specified standard.
Where the two rules diverge: a comparison
| Dimension | Privacy Rule | Security Rule |
|---|---|---|
| Scope of information | PHI in any form (electronic, paper, oral) | ePHI only |
| Core question | Who may use or disclose PHI | How ePHI must be protected |
| Framework | Permitted uses and disclosures, minimum necessary, patient rights | Administrative, physical, technical safeguards |
| Risk analysis | Not structured as a standalone mandate | Required, tied to ePHI systems |
| Breach relevance | Defines breach of unsecured PHI | Encryption supports safe harbor |
| Enforcement exposure | Civil money penalties, corrective action | Civil money penalties, corrective action |
The table makes the exclusivity visible. Only the right column is medium-limited, and only the right column contains the formal risk-analysis obligation.
The time course of a security incident
A single ePHI incident moves through predictable stages, and each stage maps to a Security Rule obligation. The timeline below is generic and does not represent any specific organization's incident.
| Stage | Typical timing | Security Rule anchor |
|---|---|---|
| Discovery of suspicious access | Hour 0 | Audit controls, monitoring |
| Containment of compromised accounts or devices | Hours 0–24 | Access control, contingency plan |
| Forensic scope determination | Days 1–14 | Risk analysis, integrity controls |
| Breach risk assessment | Within 60 days of discovery | Breach notification rule analysis |
| Individual notification | Without unreasonable delay, no later than 60 days | Breach notification |
| HHS notification | 60 days; sooner for 500+ individuals | Breach notification |
| Remediation and control updates | Weeks to months | Risk management |
The 60-day threshold appears twice for a reason. The Security Rule does not itself set the notification clock; the breach notification rule does, and it applies to unsecured PHI. Encrypted ePHI falls outside "unsecured," which is how the Security Rule's encryption guidance feeds directly into breach obligations.
Edge cases that break the clean split
A few scenarios blur the line. An oral conversation recorded to a digital voice file becomes ePHI once stored electronically, so the Security Rule attaches at the moment of digitization, not at the moment of conversation. A paper record scanned into an EHR is ePHI from the scan forward; the original paper remains subject to the Privacy Rule only.
Business associates complicate scope. The Security Rule applies directly to business associates for the ePHI they create, receive, maintain, or transmit on behalf of a covered entity. A business associate handling only paper records for a covered entity is outside the Security Rule but still bound by contract and Privacy Rule flow-down terms.
The counterintuitive detail: a covered entity can be fully compliant with the Security Rule and still commit a Privacy Rule violation with the same dataset. Strong encryption, audit logs, and access controls do not authorize a disclosure that the Privacy Rule prohibits. Security compliance is not a defense to a privacy breach.
A professional caveat: the Security Rule does not require a specific technology. It requires reasonable and appropriate safeguards given the entity's size, complexity, and risk. Two organizations with identical ePHI can implement different controls and both comply.
Misconceptions worth correcting
The most common error is treating "HIPAA" as one rule. Title II contains the Administrative Simplification provisions, and HHS implemented them through multiple rules, including Privacy, Security, Transaction, and Identifier rules. The keyword's premise—two rules—reflects the Privacy and Security pair that most practitioners encounter first.
A second error holds that the Privacy Rule applies only to electronic records. It does not. Paper and oral PHI fall within its scope, which is exactly why the Security Rule, not the Privacy Rule, is the exclusive one.
A third error assumes the Security Rule applies to all PHI a covered entity holds. It applies to ePHI. If a small practice keeps only paper records and never transmits or stores PHI electronically, the Security Rule has little to attach to. That scenario is increasingly rare but legally coherent.
Red flags that signal a scope error in compliance programs:
A risk analysis that covers only the EHR and ignores email, mobile devices, and cloud storage. Policies that describe encryption as optional without a documented addressable-specification determination. Incident response plans that treat paper-loss and ePHI-breach pathways as identical. Business associate agreements that omit Security Rule flow-down obligations. Training that teaches the Privacy Rule only and never addresses technical safeguards.
Practical actions and thresholds
Start with the risk analysis, because it is both required and the foundation for every other Security Rule decision. Scope it to every system that creates, receives, maintains, or transmits ePHI, including email, messaging, backup media, and vendor platforms. Document the threats and vulnerabilities you identify.
Then reconcile your safeguards against the required and addressable specifications. For each addressable specification, record either the implementation or the documented rationale for an equivalent alternative. That documentation is the difference between a defensible posture and a citation.
Set concrete thresholds for your own program. Review access rights at least quarterly. Test contingency and backup restoration at least annually. Confirm encryption in transit and at rest for every ePHI channel. Train workforce members at onboarding and at least annually thereafter. Track breach-notification deadlines against the 60-day outer limit from discovery.
Finally, separate your privacy and security workstreams even though they share a compliance officer. Privacy governs permitted uses and disclosures. Security governs safeguards for ePHI. Running them as one program hides the exclusivity and produces gaps in both.
Limits of what can be concluded
This explainer describes stable rule architecture, not current enforcement priorities, penalty amounts, or pending regulatory changes. Those elements shift with each HHS rulemaking cycle and enforcement discretion, and no dated figures are asserted here. The scope distinction between the Privacy Rule and Security Rule is long settled, but specific compliance obligations depend on an organization's size, systems, and facts. Nothing here substitutes for a fact-specific review of your own ePHI environment and applicable state law, which can impose requirements stricter than HIPAA.
This article is general educational information about HIPAA rule structure, not a legal opinion or a compliance determination for any organization. It does not promise any enforcement or audit outcome. Consult a qualified health-care attorney or compliance professional for advice specific to your entity and jurisdiction.