HIPAA Security Rule through the NIST CSF 2.0 lens

The HIPAA Security Rule is short and deliberately flexible: administrative, physical and technical safeguards for electronic protected health information, with standards and implementation specifications marked required or addressable. NIST CSF 2.0 is broader. Healthcare security teams increasingly use CSF to run their programme and report to boards, then show HIPAA compliance from it. How well does that work?

The headline number

Of the 69 HIPAA standards and specifications, 38 (55%) map to something in NIST CSF 2.0, 29 are only loosely related and 2 have no mapping in our data. Open the gap report →

Almost every Security Rule requirement maps to a CSF 2.0 outcome. Many of these links come from NIST's own HIPAA Security Rule to SP 800-53 crosswalk, which ControlMapping follows through to CSF.

By safeguard

HIPAA section	Mapped	Loosely related	No mapping
§164.308 Administrative safeguards	19 of 30	11	0
§164.310 Physical safeguards	9 of 12	2	1
§164.312 Technical safeguards	7 of 12	5	0
§164.314 Organizational requirements	1 of 10	8	1
§164.316 Policies and documentation	2 of 5	3	0

Have NIST CSF 2.0, need HIPAA. Requirement by requirement: open the gap report →

The two that don't map

The requirements without a mapping in our data are narrow ones: the specification on re-use of media (removing ePHI before electronic media are re-used) and a specification on business associate contracts. Both have obvious homes in a mature programme (data destruction procedures and supplier contracts), but no CSF outcome names them directly, and we haven't added editorial links for them. They are worth an explicit line in your HIPAA control set.

What CSF adds beyond HIPAA

Of the 106 NIST CSF 2.0 subcategories, 63 (59%) map to something in HIPAA, 27 are only loosely related and 16 have no mapping in our data. Open the gap report →

The reverse direction shows what a HIPAA-only programme misses. The CSF outcomes with no HIPAA mapping are concentrated in the Govern function, which CSF 2.0 added in 2024: organisational context, risk strategy and appetite, supply-chain risk management as a programme, and oversight. The Security Rule asks for risk analysis and risk management but says little about how the organisation sets its risk strategy or manages third-party risk systematically. Adopting CSF fills those gaps.

Key takeaways

• A NIST CSF 2.0 programme maps to almost every HIPAA Security Rule standard and implementation specification.
• The exceptions are narrow (media re-use and a business associate contract specification) and easy to add.
• CSF adds governance HIPAA lacks, especially risk strategy and supply-chain risk management.
• Keep the HIPAA risk analysis as its own documented deliverable, whatever framework you run.

Using CSF to run a HIPAA programme

1. Build your Current and Target Profiles in CSF 2.0, and note against each subcategory which Security Rule standard it supports.
2. Keep the HIPAA risk analysis (§164.308(a)(1)(ii)(A)) as its own documented deliverable. It is the cornerstone of the Security Rule and the first thing HHS investigators ask for.
3. Record required versus addressable decisions for each implementation specification, with your reasoning, until the proposed rule changes are settled.
4. Report to leadership in CSF terms, and to auditors and investigators in HIPAA terms, from the same control set.

The CSF 2.0 → HIPAA gap report lists every standard and specification with its CSF outcomes, and the NIST CSF vs HIPAA comparison covers both directions. The Security Rule text shown on this site comes from NIST SP 800-66r2.

Questions

Does NIST CSF compliance satisfy HIPAA?

No framework 'satisfies' HIPAA on its own: HHS enforces the Security Rule itself. But a CSF 2.0 programme addresses nearly every Security Rule requirement, and HHS points to NIST guidance (SP 800-66) for implementing it.

Is the HIPAA Security Rule changing?

HHS proposed significant changes in January 2025, including removing the distinction between required and addressable specifications. Check the current status before relying on that distinction.

Does HHS recognise NIST CSF for HIPAA?

HHS publishes NIST SP 800-66 as guidance for implementing the Security Rule and has pointed to recognised security practices, such as the NIST Cybersecurity Framework, as relevant when it considers enforcement. Using CSF doesn't replace the Security Rule's own requirements, including the documented risk analysis.