Comparison
HIPAA vs CPS 234
HIPAA Security Rule · APRA CPS 234 Information Security · data 2026-10-27
Requirement-level comparison of HIPAA Security Rule and APRA CPS 234 Information Security, in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 24 APRA CPS 234 Information Security requirements, 23 map to something in HIPAA, 0 are only loosely related, and 1 have no mapping in our data.
CPS 234 is principles-based: it requires controls commensurate with threats without naming them, so most technical topics show no link. APRA's guide CPG 234 names specific practices but is not binding and not mapped. All links are editorial.
Likely new work: CPS 234 requirements with no mapping to HIPAA (1)
| CPS 234 | Requirement | Match | HIPAA | Evidence |
|---|---|---|---|---|
| Testing control effectiveness · 1 | ||||
| Para 29 | Escalate deficiencies that can't be fixed quickly | No mapping in our data | — | No mapping to HIPAA in our data. |
Mapped (23)
| CPS 234 | Requirement | Match | HIPAA | Evidence |
|---|---|---|---|---|
| Roles and responsibilities · 2 | ||||
| Para 13 | Board ultimately responsible for information security | Editorial | §164.308(a)(1)(ii)(B)§164.308(a)(2) | Same topic: Risk Management, Roles & Responsibilities (editorial pick) |
| Para 14 | Define information security roles and responsibilities | Editorial | §164.308(a)(2) | Same topic: Roles & Responsibilities (editorial pick) |
| Information security capability · 3 | ||||
| Para 15 | Maintain a capability commensurate with threats | Editorial | §164.308(a)(1)(ii)(B) | Same topic: Risk Management (editorial pick) |
| Para 16 | Assess third parties' information security capability | Editorial | §164.308(b)(1)§164.314(a) | Same topic: Vendor Risk Mgmt (editorial pick) |
| Para 17 | Keep capability current as threats and vulnerabilities change | Editorial | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8) | Same topic: Risk Assessment, Vulnerability Mgmt (editorial pick) |
| Policy framework · 2 | ||||
| Para 18 | Maintain an information security policy framework | Editorial | §164.316(a)§164.316(b)(2)(iii) | Same topic: Governance Policy (editorial pick) |
| Para 19 | Policies direct everyone with security obligations | Editorial | §164.316(a)§164.316(b)(2)(iii) | Same topic: Governance Policy (editorial pick) |
| Information asset identification and classification · 1 | ||||
| Para 20 | Classify information assets by criticality and sensitivity | Editorial | §164.310(d)§164.310(d)(2)(iii) | Same topic: Asset Management (editorial pick) |
| Implementation of controls · 2 | ||||
| Para 21 | Timely controls commensurate with risk and asset life-cycle | Editorial | §164.308(a)(1)(ii)(A)§164.310(d)(2)(i)§164.312(c) | Same topic: Risk Assessment, Data Protection (editorial pick) |
| Para 22 | Evaluate the design of third parties' controls | Editorial | §164.308(b)(1)§164.314(a) | Same topic: Vendor Risk Mgmt (editorial pick) |
| Incident management · 4 | ||||
| Para 23 | Detect and respond to incidents in a timely manner | Editorial | §164.308(a)(6)§164.308(a)(6)(ii) | Same topic: Incident Response (editorial pick) |
| Para 24 | Maintain information security response plans | Editorial | §164.308(a)(6)§164.308(a)(6)(ii) | Same topic: Incident Response (editorial pick) |
| Para 25 | Response plans cover all stages and escalation | Editorial | §164.308(a)(6)§164.308(a)(6)(ii) | Same topic: Incident Response (editorial pick) |
| Para 26 | Review and test response plans annually | Editorial | §164.308(a)(6)§164.308(a)(6)(ii) | Same topic: Incident Response (editorial pick) |
| Testing control effectiveness · 4 | ||||
| Para 27 | Systematic testing programme for control effectiveness | Editorial | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8) | Same topic: Vulnerability Mgmt, Risk Management (editorial pick) |
| Para 28 | Check third parties' control testing is adequate | Editorial | §164.308(b)(1)§164.314(a) | Same topic: Vendor Risk Mgmt (editorial pick) |
| Para 30 | Testing by skilled, functionally independent specialists | Editorial | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8) | Same topic: Vulnerability Mgmt (editorial pick) |
| Para 31 | Review the testing programme at least annually | Editorial | §164.308(a)(1)(ii)(B) | Same topic: Risk Management (editorial pick) |
| Internal audit · 3 | ||||
| Para 32 | Internal audit reviews control design and effectiveness | Editorial | §164.308(a)(8) | Same topic: Compliance (editorial pick) |
| Para 33 | Assurance provided by appropriately skilled personnel | Editorial | §164.308(a)(8) | Same topic: Compliance (editorial pick) |
| Para 34 | Internal audit assesses third-party assurance relied on | Editorial | §164.308(a)(8)§164.308(b)(1)§164.314(a) | Same topic: Compliance, Vendor Risk Mgmt (editorial pick) |
| APRA notification · 2 | ||||
| Para 35 | Notify APRA of material incidents within 72 hours | Editorial | §164.308(a)(6)(ii) | Same topic: Reporting (editorial pick) |
| Para 36 | Notify APRA of material control weaknesses within 10 business days | Editorial | §164.308(a)(6)(ii) | Same topic: Reporting (editorial pick) |
Of 69 HIPAA Security Rule requirements, 14 map to something in CPS 234, 43 are only loosely related, and 12 have no mapping in our data.
Covers the HIPAA Security Rule only (not the Privacy or Breach Notification Rules).
Likely new work: HIPAA requirements with no mapping to CPS 234 (12)
| HIPAA | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| §164.308 Administrative safeguards · 6 | ||||
| §164.308(a)(1)(ii)(C) | Required Sanction Policy | No mapping in our data | — | No mapping to CPS 234 in our data. |
| §164.308(a)(5)(ii)(A) | Addressable Security Reminders | No mapping in our data | — | No mapping to CPS 234 in our data. |
| §164.308(a)(5)(ii)(B) | Addressable Protection from Malicious Software | No mapping in our data | — | No mapping to CPS 234 in our data. |
| §164.308(a)(5)(ii)(D) | Addressable Password Management | No mapping in our data | — | No mapping to CPS 234 in our data. |
| §164.308(a)(7)(ii)(C) | Required Emergency Mode Operation Plan | No mapping in our data | — | No mapping to CPS 234 in our data. |
| §164.308(a)(7)(ii)(D) | Addressable Testing and Revision Procedure | No mapping in our data | — | No mapping to CPS 234 in our data. |
| §164.310 Physical safeguards · 3 | ||||
| §164.310(a)(2)(i) | Addressable Contingency Operations | No mapping in our data | — | No mapping to CPS 234 in our data. |
| §164.310(c) | Workstation Security | No mapping in our data | — | No mapping to CPS 234 in our data. |
| §164.310(d)(2)(ii) | Required Media Re-use | No mapping in our data | — | No mapping to CPS 234 in our data. |
| §164.312 Technical safeguards · 2 | ||||
| §164.312(a)(2)(iii) | Addressable Automatic Logoff | No mapping in our data | — | No mapping to CPS 234 in our data. |
| §164.312(d) | Person or Entity Authentication | No mapping in our data | — | No mapping to CPS 234 in our data. |
| §164.314 Organizational requirements · 1 | ||||
| §164.314(a)(3)(i) | Required Business Associate Contracts | No mapping in our data | — | No mapping to CPS 234 in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (43)
| HIPAA | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| §164.308 Administrative safeguards · 17 | ||||
| §164.308(a)(1) | Security Management Process | Para 18Para 19Para 16+4 | Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping | |
| §164.308(a)(1)(ii)(D) | Required Information System Activity Review | Para 23Para 25Para 24+5 | Only shares CSF DE.AE-02, DE.CM-01, RS.MA-01, RS.MA-02…: related, not a mapping | |
| §164.308(a)(3) | Workforce Security | Para 18Para 19Para 16+5 | Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping | |
| §164.308(a)(3)(ii)(A) | Addressable Authorization and/or Supervision | Para 16Para 18Para 19+5 | Only shares CSF DE.CM-06, GV.SC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| §164.308(a)(3)(ii)(B) | Addressable Workforce Clearance Procedure | Para 16Para 18Para 19+5 | Only shares CSF DE.CM-06, GV.SC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| §164.308(a)(3)(ii)(C) | Addressable Termination Procedures | Para 18Para 19Para 16+4 | Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping | |
| §164.308(a)(4) | Information Access Management | Para 18Para 19Para 16+5 | Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping | |
| §164.308(a)(4)(ii)(A) | Required Isolating Health care Clearinghouse Function | Para 21 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| §164.308(a)(4)(ii)(B) | Addressable Access Authorization | Para 16Para 18Para 19+5 | Only shares CSF DE.CM-06, GV.SC-03, GV.PO-01, GV.PO-02: related, not a mapping | |
| §164.308(a)(4)(ii)(C) | Addressable Access Establishment and Modification | Para 18Para 19Para 16+5 | Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping | |
| §164.308(a)(5) | Security Awareness and Training | Para 18Para 19Para 16+4 | Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping | |
| §164.308(a)(5)(ii)(C) | Addressable Log-in Monitoring | Para 23 | Only shares CSF DE.AE-02: related, not a mapping | |
| §164.308(a)(7) | Contingency Plan | Para 18Para 19Para 16+4 | Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping | |
| §164.308(a)(7)(ii)(A) | Required Data Backup Plan | Para 21 | Only shares CSF PR.DS-01, PR.DS-10: related, not a mapping | |
| §164.308(a)(7)(ii)(B) | Required Disaster Recovery Plan | Para 21 | Only shares CSF PR.DS-01, PR.DS-10: related, not a mapping | |
| §164.308(a)(7)(ii)(E) | Addressable Applications and Data Criticality Analysis | Para 17Para 21Para 20 | Only shares CSF ID.RA-04, ID.RA-05, ID.AM-05: related, not a mapping | |
| §164.308(b)(4) | Required Written Contract or Other Arrangement | Para 16Para 22Para 28+3 | Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping | |
| §164.310 Physical safeguards · 6 | ||||
| §164.310(a) | Facility Access Controls | Para 18Para 19Para 16+4 | Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping | |
| §164.310(a)(2)(ii) | Addressable Facility Security Plan | Para 18Para 19Para 16+5 | Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping | |
| §164.310(a)(2)(iii) | Addressable Access Control and Validation Procedures | Para 18Para 19Para 16+4 | Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping | |
| §164.310(a)(2)(iv) | Addressable Maintenance Records | Para 18Para 19Para 16+5 | Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping | |
| §164.310(b) | Workstation Use | Para 21 | Only shares CSF PR.DS-10: related, not a mapping | |
| §164.310(d)(2)(iv) | Addressable Data Backup and Storage | Para 21 | Only shares CSF PR.DS-01, PR.DS-10: related, not a mapping | |
| §164.312 Technical safeguards · 9 | ||||
| §164.312(a) | Access Control | Para 18Para 19Para 16+5 | Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping | |
| §164.312(a)(2)(i) | Required Unique User Identification | Para 21Para 23 | Only shares CSF PR.DS-10, DE.CM-01: related, not a mapping | |
| §164.312(a)(2)(ii) | Required Emergency Access Procedure | Para 23Para 21 | Only shares CSF DE.CM-01, ID.IM-04, PR.DS-10: related, not a mapping | |
| §164.312(a)(2)(iv) | Addressable Encryption and Decryption | Para 21 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| §164.312(b) | Audit Controls | Para 18Para 19Para 16+5 | Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping | |
| §164.312(c)(2) | Addressable Mechanism to Authenticate Electronic Protected Health Information | Para 21Para 16Para 22 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, ID.RA-09: related, not a mapping | |
| §164.312(e)(1) | Transmission Security | Para 21 | Only shares CSF PR.DS-02: related, not a mapping | |
| §164.312(e)(2)(i) | Addressable Integrity Controls | Para 21Para 16Para 22 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, ID.RA-09: related, not a mapping | |
| §164.312(e)(2)(ii) | Addressable Encryption | Para 21 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| §164.314 Organizational requirements · 8 | ||||
| §164.314(a)(2)(i) | Required Business Associate Contracts | Para 16Para 22Para 25+5 | Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping | |
| §164.314(a)(2)(ii) | Required Other Arrangements | Para 16Para 22Para 28+3 | Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping | |
| §164.314(a)(2)(iii) | Required Business associate contracts with subcontractors | Para 16Para 22Para 25+5 | Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping | |
| §164.314(b) | Requirements for Group Health Plans | Para 20 | Only shares CSF ID.AM-08: related, not a mapping | |
| §164.314(b)(2)(i) | Required Group Health Plan Implementation Specification | Para 20 | Only shares CSF ID.AM-08: related, not a mapping | |
| §164.314(b)(2)(ii) | Required Group Health Plan Implementation Specification | Para 20 | Only shares CSF ID.AM-08: related, not a mapping | |
| §164.314(b)(2)(iii) | Required Group Health Plan Implementation Specification | Para 16Para 22Para 28+2 | Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping | |
| §164.314(b)(2)(iv) | Required Group Health Plan Implementation Specification | Para 25Para 23Para 24+3 | Only shares CSF RS.CO-03, RS.MA-01, RS.MA-02, RS.MA-03…: related, not a mapping | |
| §164.316 Policies and documentation · 3 | ||||
| §164.316(b) | Documentation | Para 17Para 20Para 27+1 | Only shares CSF ID.RA-01, ID.AM-08: related, not a mapping | |
| §164.316(b)(2)(i) | Required Time Limit | Para 20 | Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping | |
| §164.316(b)(2)(ii) | Required Availability | Para 18Para 19Para 16+4 | Only shares CSF GV.PO-01, GV.PO-02, GV.SC-03: related, not a mapping | |
Mapped (14)
| HIPAA | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| §164.308 Administrative safeguards · 7 | ||||
| §164.308(a)(1)(ii)(A) | Required Risk Analysis | Editorial | Para 17Para 21Para 27+1 | Same topic: Risk Assessment, Vulnerability Mgmt (editorial pick) |
| §164.308(a)(1)(ii)(B) | Required Risk Management | Editorial | Para 13Para 15Para 17+3 | Same topic: Risk Management, Vulnerability Mgmt (editorial pick) |
| §164.308(a)(2) | Assigned Security Responsibility | Editorial | Para 13Para 14 | Same topic: Roles & Responsibilities (editorial pick) |
| §164.308(a)(6) | Security Incident Procedures | Editorial | Para 23Para 24Para 25+1 | Same topic: Incident Response (editorial pick) |
| §164.308(a)(6)(ii) | Required Response and Reporting | Editorial | Para 23Para 24Para 25+3 | Same topic: Incident Response (editorial pick) |
| §164.308(a)(8) | Evaluation | Editorial | Para 17Para 27Para 30+3 | Same topic: Vulnerability Mgmt (editorial pick) |
| §164.308(b)(1) | Business Associate Contracts and Other Arrangements | Editorial | Para 16Para 22Para 28+1 | Same topic: Vendor Risk Mgmt (editorial pick) |
| §164.310 Physical safeguards · 3 | ||||
| §164.310(d) | Device and Media Controls | Editorial | Para 20 | Same topic: Asset Management (editorial pick) |
| §164.310(d)(2)(i) | Required Disposal | Editorial | Para 21 | Same topic: Data Protection (editorial pick) |
| §164.310(d)(2)(iii) | Addressable Accountability | Editorial | Para 20 | Same topic: Asset Management (editorial pick) |
| §164.312 Technical safeguards · 1 | ||||
| §164.312(c) | Integrity | Editorial | Para 21 | Same topic: Data Protection (editorial pick) |
| §164.314 Organizational requirements · 1 | ||||
| §164.314(a) | Business Associate Contracts or Other Arrangements | Editorial | Para 16Para 22Para 28+1 | Same topic: Vendor Risk Mgmt (editorial pick) |
| §164.316 Policies and documentation · 2 | ||||
| §164.316(a) | Policies and Procedures | Editorial | Para 18Para 19 | Same topic: Governance Policy (editorial pick) |
| §164.316(b)(2)(iii) | Required Updates | Editorial | Para 18Para 19 | Same topic: Governance Policy (editorial pick) |
By topic
Both cover (11):
Governance PolicyRisk ManagementRoles & ResponsibilitiesComplianceAsset ManagementRisk AssessmentVulnerability MgmtData ProtectionIncident ResponseReportingVendor Risk Mgmt
Only HIPAA (16):
Awareness & TrainingAccess ControlEncryptionBackup & RecoveryEndpoint ProtectionMobile SecurityCloud SecurityCont. MonitoringLogging & AuditSIEM / SOCMitigationRecovery PlanningBusiness ContinuityDisaster RecoveryInsider ThreatPhysical Security
Only CPS 234 (6):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.