Privacy Rule
45 CFR Part 164, Subpart ECovers protected health information (PHI) in any form: paper, spoken or electronic. It says who may use and disclose it, and gives patients rights over it.
HIPAA Security Rule · 45 CFR Part 164, Subpart C
HIPAA says record and examine activity in systems that touch ePHI. Quox is that record, for your agents.
HIPAA is US law, not a certificate. Quox is not HIPAA certified: it is the evidence layer for the safeguards an agent platform touches.
What it isUS federal lawCertificatenone existsQuoxevidence layerStart here
A law with three rules, and this page is about one
HIPAA is enforced by the HHS Office for Civil Rights. OCR investigates and fines. It does not hand out a certificate, so there is nothing to buy that makes you HIPAA compliant. What you do have is a rule that tells you what to protect, and how.
Security Rule
45 CFR 164.302 to 164.318Covers electronic PHI (ePHI) only. It says how to protect it, through administrative, physical and technical safeguards you choose by risk. This page is about this rule.
This pageBreach Notification Rule
45 CFR 164.400 to 164.414Covers what you must do, and who you must tell, when unsecured PHI is breached. It sits beside the other two and is outside this page.
Who has to comply, and the contract that links them.
Covered entity
A health care provider that transmits health information electronically, a health plan or a clearinghouse.
Business associate
A vendor that creates, receives, maintains or transmits ePHI on a covered entity’s behalf.
Subcontractor
Anyone the business associate hands ePHI to in turn. It is a business associate too.
A signed business associate agreement (BAA) is required before a business associate handles ePHI. Quox is self-hosted: the software runs on your servers, so ePHI stays with you and Quox the company does not receive it. Whether any vendor counts as a business associate is a question for your privacy officer or counsel, not this page.
The safeguard triad
Three layers around one thing: your patients’ electronic data
The Security Rule protects ePHI with three kinds of safeguard. The outer ring is management, the middle ring is premises, and the inner ring is technology, opened out here into its five standards. Select any part to see what it asks and where Quox fits.
- Quox evidences it
- A slice is Quox
- Yours
Technical, 164.312
164.312(b)Quox evidences it
Audit controls
The standard asks for a mechanism that records what happened in the systems that hold ePHI, and a way to examine it. It has no separate implementation specifications: the standard itself is the requirement.
“Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.”
45 CFR 164.312(b)
- RequiredThe standard, 164.312(b)
Where Quox fitsThe witnessed, hash-chained record of governed agent actions is a mechanism that records activity, and an auditor can examine it offline with no Quox account. Blocks, denials and approvals sit in the same chain as the actions.
Where it stopsIt records governed agent actions. Activity in your EHR, databases, network and endpoints needs its own audit logging, and somebody still has to review the records regularly.
Read the colours honestly. Of the seven parts of the triad, Quox is the strongest fit on one (audit controls) and evidences a slice of three more (access control, integrity, authentication) plus the administrative layer. Physical safeguards and transmission security are yours, and that is the normal shape of a HIPAA programme.
Section 164.316 sits across all three layers: you must keep written policies and procedures, and document the actions, activities and assessments the rule requires. Keeping that documentation is covered in the retention note below.
Required and Addressable
Addressable does not mean optional
Every implementation specification is tagged Required or Addressable. Required means do it. Addressable is the most misread word in HIPAA: it means you must make a documented decision, based on your risk analysis.
Required 2 of 7
Unique user identification
164.312(a)(2)(i)Emergency access procedure
164.312(a)(2)(ii)Do these. Unique user identification is the one that makes every action traceable to someone.
Addressable 5 of 7
Automatic logoff
164.312(a)(2)(iii)Encryption and decryption
164.312(a)(2)(iv)Mechanism to authenticate ePHI
164.312(c)(2)Integrity controls (transmission)
164.312(e)(2)(i)Encryption (transmission)
164.312(e)(2)(ii)Assess these, then choose one of the three outcomes on the right.
Implement it
If it is reasonable and appropriate for your setting, put the specification in place as written.
Use an alternative
If the specification is not reasonable but its purpose still matters, put an equivalent measure in place instead.
Document why neither
If neither is reasonable, write down why, based on your risk analysis. The written reasoning is the control.
Audit controls, 164.312(b), and person or entity authentication, 164.312(d), have no separate specifications. The standard itself is the requirement.
“Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.”
Everything else leans on this. It decides which Addressable specifications you implement, and it is the document an investigator asks for first. Quox cannot do it for you. The compliance suite’s HIPAA risk analysis worksheet helps you structure it, and the conclusions stay yours.
The honest map
Four questions an investigator asks, and where the answer stops
HIPAA’s audit-controls standard says record and examine activity in systems that touch ePHI. That is what a witnessed audit trail does, and an auditor can verify it offline. Each card below says what the record shows and, just as plainly, where it stops.
164.312(b)Audit controlsStrongest fit
Show me the mechanism that records what happened, and let me examine it.
The record showsA witnessed, hash-chained record of every governed agent action, with blocks, denials and approvals in the same chain. The auditor can verify it offline, with no Quox account.
Where it stopsIt records governed agent actions. Your EHR, databases, network devices and endpoints are separate evidence you produce, and the review of the records is a task for a person.
164.312(a) and (d)Access control and authentication
Who acted, with what authority, and were they who they claimed to be?
The record showsAn identity on every governed action, a scoped capability token rather than a shared credential, and governed SSH through Bastion for privileged work.
Where it stopsYour identity provider, multi-factor sign-in, emergency access and automatic logoff on the systems that hold ePHI are yours.
164.312(c)Integrity
Could someone have changed the record afterwards?
The record showsHash-chaining makes alteration or removal of an entry detectable, and an auditor can recompute the chain themselves.
Where it stopsThis is integrity of the evidence, not of the ePHI in your database. Protecting that is your database and backup controls.
164.308Administrative safeguards
Did your administrative controls actually fire?
The record showsThe policy gate is enforced at execution, risky actions can need human approval, and policy changes keep an append-only history, so you can show what the rules were on a given date.
Where it stopsThe risk analysis, risk management, training, sanctions, incident response, contingency planning and business associate contracts are yours.
Self-hosted, so the data stays home
Quox runs on your own servers. The record of what your agents did, and the ePHI around it, never has to leave your estate to be governed. That is an architectural plus, and it is not a safeguard in its own right: encryption, backups and physical protection of those servers remain yours.
Keep the documentation for six years
Section 164.316(b)(2)(i) requires you to retain the documentation the Security Rule calls for, such as policies, procedures and records of actions and assessments, for six years from the date it was created or last in effect, whichever is later.
Whether your raw audit logs fall under that is a judgement for your risk analysis, and many organisations keep them at least as long. Either way, the record has to survive. Our guide walks through how to choose.
The auditor page shows what the other side of the table can verify without a Quox account, and the compliance suite covers report exports. Related frameworks: SOC 2, ISO 27001, ISO 42001, NIST AI RMF and the EU AI Act.
Honest maturity
What ships today, what does not, and what is yours
Quox is one layer. The risk analysis, the contracts and most of the policy are human work. Here is the line, drawn plainly.
Ships today
- Witnessed, hash-chained, tamper-evident record of every governed agent action (WARD and VOLT, the evidence protocols), timestamped and ordered as the work happens.
- Policy gate enforced at execution, with blocks and denials recorded in the same chain.
- Scoped capability tokens, an identity on every governed action and governed SSH through Bastion.
- Human approval for risky actions and two-person approval for audit-required policy changes, with an append-only history.
- Self-hosted deployment, so the record and the ePHI around it stay on your own servers.
- Exportable evidence bundles an auditor verifies offline, and a guided HIPAA risk analysis worksheet in the compliance suite that helps you structure your own assessment.
Not shipped
- A policy simulator, so you can test a policy before it goes live. Planned, not shipped.
- A published control-level crosswalk across every standard and specification in Subpart C. Not published; this page maps the ones an agent platform genuinely bears on.
Still your job
- The risk analysis and risk management plan, 164.308(a)(1)(ii)(A) and (B). Quox cannot assess your risk for you, and the worksheet only structures it.
- Business associate agreements. Quox does not sign or fulfil them for you, and who needs one is a question for your privacy officer or counsel.
- The physical safeguards in full, and encryption of ePHI at rest and in transit across your own systems.
- Most administrative policy: workforce training, sanctions, incident response, contingency planning and the Addressable decisions you document.
- Reviewing the records regularly, and keeping your documentation for six years.
The path
Your first HIPAA Security Rule programme, in six moves
Timelines vary with size and how much you already run. The order is the useful part.
Find your ePHI
Map where electronic patient data is created, received, stored and sent, including any place an AI agent could reach it. You cannot protect what you have not found.
Run the risk analysis
The Security Rule’s first Required step, 164.308(a)(1)(ii)(A). It is yours, and every Addressable decision later leans on it.
Choose safeguards across all three layers
Administrative, physical and technical. For each Addressable specification, implement it, use an alternative or write down why neither is reasonable.
Sign business associate agreements
Before any vendor handles your ePHI, including their subcontractors. A self-hosted tool you run yourself keeps the data with you.
Turn on the record, then review it
Audit controls only help if someone looks. Schedule the review of activity records that 164.308(a)(1)(ii)(D) requires.
Document it and keep it
Write down policies, decisions and assessments under 164.316, update them when things change, and retain the documentation for six years.
Questions people actually ask
HIPAA Security Rule: the FAQ
What is HIPAA?
The Health Insurance Portability and Accountability Act of 1996 is US federal law. Its Privacy Rule, Security Rule and Breach Notification Rule sit in 45 CFR Part 164 and are enforced by the HHS Office for Civil Rights (OCR). It applies to covered entities and their business associates.
Is there a HIPAA certification?
No. HIPAA is a law, not a certifiable standard. There is no official HIPAA certification, and OCR does not issue a certificate to any organisation or product. A vendor that says it is HIPAA certified is describing its own attestation or a training course. Quox is not HIPAA certified, and no tool can be.
What is the Security Rule, and how is it different from the Privacy Rule?
The Privacy Rule (45 CFR Part 164, Subpart E) covers protected health information in any form and governs how it is used and disclosed. The Security Rule (Subpart C, sections 164.302 to 164.318) covers electronic PHI only and governs how it is protected, through administrative, physical and technical safeguards.
What are the three safeguards?
Administrative safeguards (45 CFR 164.308) are the management layer: risk analysis, access management, training and contracts. Physical safeguards (164.310) cover facilities, workstations and media. Technical safeguards (164.312) cover access control, audit controls, integrity, authentication and transmission security. Section 164.316 adds the policies, procedures and documentation requirements.
What is the difference between Required and Addressable, and is Addressable optional?
Required specifications must be implemented. Addressable specifications are not optional: you must assess them against your risk analysis and then implement the specification, implement a reasonable alternative, or document why neither is reasonable. Skipping one without written reasoning is a finding waiting to happen.
What is the HIPAA risk analysis?
A Required specification at 164.308(a)(1)(ii)(A): conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of the ePHI you hold. It is your job. A tool can help you structure it, but cannot do it for you.
What is a business associate agreement?
A contract that a covered entity must have in place before a business associate creates, receives, maintains or transmits ePHI on its behalf. Business associates need the same kind of agreement with their own subcontractors. Whether a given vendor is a business associate is a question for your privacy officer or counsel.
Is Quox HIPAA certified, and does it make me compliant?
No to both. There is no HIPAA certification to hold, and no tool delivers compliance. Quox is not an EHR, does not encrypt your database, does not sign a business associate agreement for you and does not do your risk analysis. It is the evidence layer for the parts an agent platform touches, above all audit controls.
What does the audit controls standard require, and how does Quox help?
Section 164.312(b) requires hardware, software and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI. Quox’s witnessed, hash-chained record of governed agent actions is such a mechanism, and an auditor can verify it offline. It covers governed agent actions only. Your other systems need their own audit logging.
Is the 2025 proposed update to the Security Rule in force?
No. HHS published a notice of proposed rulemaking in the Federal Register on 6 January 2025 and comments closed in March 2025. As of October 2026 it is still a proposal, not a final rule. The current Security Rule remains the law. Proposed changes, such as removing the Required and Addressable distinction and requiring encryption and multi-factor authentication, are not requirements today.
How long must I keep HIPAA documentation and AI agent logs?
Section 164.316(b)(2)(i) requires you to retain the Security Rule’s required documentation (policies, procedures, records of actions and assessments) for six years from creation or from when it was last in effect, whichever is later. Whether raw audit logs fall under that is a judgement for your risk analysis. Our guide to AI agent log retention walks through how to choose. How long to keep AI agent logs.
Does a SOC 2 report or ISO 27001 certificate satisfy HIPAA?
No. Neither is a HIPAA certification or a substitute for your risk analysis, and neither is mapped one to one to the Security Rule. They can supply useful evidence for several safeguards, and the work overlaps heavily. Read the SOC 2 page.
Sources
- HHS Office for Civil Rights, The HIPAA Security Rule (the primary source)
- 45 CFR 164.308, Administrative safeguards (Cornell LII)
- 45 CFR 164.310, Physical safeguards (Cornell LII)
- 45 CFR 164.312, Technical safeguards (Cornell LII)
- 45 CFR 164.316, Policies and procedures and documentation requirements (Cornell LII)
Related frameworks
Self-hosted · free · governed
Have the record running before the investigator asks
The Security Rule expects audit controls on systems that touch ePHI. Keep a record of what your agents did that an investigator can verify offline, on your own servers.