框架
HIPAA Security Rule
概述
美国安全规则（45 CFR Part 164, Subpart C）：针对电子受保护健康信息的管理、物理和技术保障措施，其标准和实施规范标注为必要（Required）或可寻址（Addressable）。HHS已于2025年1月提出重大修订；依赖“可寻址”区分之前，请先核实其现行状态。
适用人群
受规管实体（健康计划、医疗保健清算所，以及以电子方式进行交易的医疗服务提供者）及其业务伙伴。
评估方式
无认证制度。HHS民权办公室（Office for Civil Rights）通过投诉、违规调查和审计进行执法。书面化的风险分析是核心基础；第三方鉴证报告是常见的证据形式，但并非官方要求。
69
标准与规范
68
映射到其他框架
54%
已覆盖主题（27/50）
仅涵盖 HIPAA 安全规则（不包括隐私规则或违规通知规则）。
对比分析
要求
要求编号和标题均按各框架官方发布的英文原文显示。
| ID | 要求 | 主题 | 映射于 |
|---|---|---|---|
| §164.308 Administrative safeguards · 30 | |||
| §164.308(a)(1) | Security Management Process | — | 1 / 13 |
| §164.308(a)(1)(ii)(A) | Risk Analysis | 风险评估, 漏洞管理 | 13 / 13 |
| §164.308(a)(1)(ii)(B) | Risk Management | 风险管理, 漏洞管理 | 13 / 13 |
| §164.308(a)(1)(ii)(C) | Sanction Policy | 内部威胁 | 8 / 13 |
| §164.308(a)(1)(ii)(D) | Information System Activity Review | 持续监控, SIEM / SOC | 10 / 13 |
| §164.308(a)(2) | Assigned Security Responsibility | 角色与职责 | 9 / 13 |
| §164.308(a)(3) | Workforce Security | — | 1 / 13 |
| §164.308(a)(3)(ii)(A) | Authorization and/or Supervision | — | 1 / 13 |
| §164.308(a)(3)(ii)(B) | Workforce Clearance Procedure | 内部威胁 | 8 / 13 |
| §164.308(a)(3)(ii)(C) | Termination Procedures | — | 1 / 13 |
| §164.308(a)(4) | Information Access Management | 访问控制 | 11 / 13 |
| §164.308(a)(4)(ii)(A) | Isolating Health care Clearinghouse Function | — | 1 / 13 |
| §164.308(a)(4)(ii)(B) | Access Authorization | — | 1 / 13 |
| §164.308(a)(4)(ii)(C) | Access Establishment and Modification | — | 1 / 13 |
| §164.308(a)(5) | Security Awareness and Training | 意识与培训 | 10 / 13 |
| §164.308(a)(5)(ii)(A) | Security Reminders | 意识与培训 | 10 / 13 |
| §164.308(a)(5)(ii)(B) | Protection from Malicious Software | 终端防护 | 10 / 13 |
| §164.308(a)(5)(ii)(C) | Log-in Monitoring | — | 1 / 13 |
| §164.308(a)(5)(ii)(D) | Password Management | — | 1 / 13 |
| §164.308(a)(6) | Security Incident Procedures | 事件响应 | 12 / 13 |
| §164.308(a)(6)(ii) | Response and Reporting | 事件响应, 缓解, 报告 | 12 / 13 |
| §164.308(a)(7) | Contingency Plan | 恢复规划 | 9 / 13 |
| §164.308(a)(7)(ii)(A) | Data Backup Plan | 备份与恢复 | 11 / 13 |
| §164.308(a)(7)(ii)(B) | Disaster Recovery Plan | 恢复规划, 灾难恢复 | 10 / 13 |
| §164.308(a)(7)(ii)(C) | Emergency Mode Operation Plan | 业务连续性 | 8 / 13 |
| §164.308(a)(7)(ii)(D) | Testing and Revision Procedure | 灾难恢复 | 10 / 13 |
| §164.308(a)(7)(ii)(E) | Applications and Data Criticality Analysis | — | 1 / 13 |
| §164.308(a)(8) | Evaluation | 合规, 漏洞管理 | 13 / 13 |
| §164.308(b)(1) | Business Associate Contracts and Other Arrangements | 云安全, 供应商风险管理 | 12 / 13 |
| §164.308(b)(4) | Written Contract or Other Arrangement | — | 1 / 13 |
| §164.310 Physical safeguards · 12 | |||
| §164.310(a) | Facility Access Controls | 物理安全 | 8 / 13 |
| §164.310(a)(2)(i) | Contingency Operations | — | 1 / 13 |
| §164.310(a)(2)(ii) | Facility Security Plan | 物理安全 | 8 / 13 |
| §164.310(a)(2)(iii) | Access Control and Validation Procedures | 物理安全 | 8 / 13 |
| §164.310(a)(2)(iv) | Maintenance Records | — | 1 / 13 |
| §164.310(b) | Workstation Use | 物理安全 | 8 / 13 |
| §164.310(c) | Workstation Security | 物理安全 | 8 / 13 |
| §164.310(d) | Device and Media Controls | 资产管理, 移动安全 | 13 / 13 |
| §164.310(d)(2)(i) | Disposal | 数据保护 | 11 / 13 |
| §164.310(d)(2)(ii) | Media Re-use | — | 1 / 13 |
| §164.310(d)(2)(iii) | Accountability | 资产管理 | 13 / 13 |
| §164.310(d)(2)(iv) | Data Backup and Storage | 备份与恢复 | 11 / 13 |
| §164.312 Technical safeguards · 12 | |||
| §164.312(a) | Access Control | 访问控制 | 11 / 13 |
| §164.312(a)(2)(i) | Unique User Identification | 访问控制 | 11 / 13 |
| §164.312(a)(2)(ii) | Emergency Access Procedure | — | 1 / 13 |
| §164.312(a)(2)(iii) | Automatic Logoff | — | 1 / 13 |
| §164.312(a)(2)(iv) | Encryption and Decryption | 加密 | 10 / 13 |
| §164.312(b) | Audit Controls | 日志与审计 | 10 / 13 |
| §164.312(c) | Integrity | 数据保护 | 11 / 13 |
| §164.312(c)(2) | Mechanism to Authenticate Electronic Protected Health Information | — | 1 / 13 |
| §164.312(d) | Person or Entity Authentication | 访问控制 | 11 / 13 |
| §164.312(e)(1) | Transmission Security | — | 1 / 13 |
| §164.312(e)(2)(i) | Integrity Controls | — | 1 / 13 |
| §164.312(e)(2)(ii) | Encryption | 加密 | 10 / 13 |
| §164.314 Organizational requirements · 10 | |||
| §164.314(a) | Business Associate Contracts or Other Arrangements | 供应商风险管理 | 10 / 13 |
| §164.314(a)(2)(i) | Business Associate Contracts | — | 1 / 13 |
| §164.314(a)(2)(ii) | Other Arrangements | — | 1 / 13 |
| §164.314(a)(2)(iii) | Business associate contracts with subcontractors | — | 1 / 13 |
| §164.314(a)(3)(i) | Business Associate Contracts | — | 无 |
| §164.314(b) | Requirements for Group Health Plans | — | 1 / 13 |
| §164.314(b)(2)(i) | Group Health Plan Implementation Specification | — | 1 / 13 |
| §164.314(b)(2)(ii) | Group Health Plan Implementation Specification | — | 1 / 13 |
| §164.314(b)(2)(iii) | Group Health Plan Implementation Specification | — | 1 / 13 |
| §164.314(b)(2)(iv) | Group Health Plan Implementation Specification | — | 1 / 13 |
| §164.316 Policies and documentation · 5 | |||
| §164.316(a) | Policies and Procedures | 治理政策 | 9 / 13 |
| §164.316(b) | Documentation | — | 1 / 13 |
| §164.316(b)(2)(i) | Time Limit | — | 1 / 13 |
| §164.316(b)(2)(ii) | Availability | — | 1 / 13 |
| §164.316(b)(2)(iii) | Updates | 治理政策 | 9 / 13 |
主题覆盖情况
已映射 HIPAA 要求的主题（27）：
治理政策意识与培训风险管理角色与职责合规资产管理风险评估漏洞管理访问控制加密数据保护备份与恢复终端防护移动安全云安全持续监控日志与审计SIEM / SOC事件响应缓解报告恢复规划业务连续性灾难恢复内部威胁供应商风险管理物理安全
本站数据中无映射 无 HIPAA 要求（23）：