Which HIPAA rule requires safeguards for electronic PHI?

• A. Breach Notification Rule
• B. Security Rule
• C. Enforcement Rule
• D. Privacy Rule

Answer: (B)

Protecting electronic PHI through formal safeguards is the focus here. The Security Rule is the HIPAA standard that directly requires implementing safeguards for electronic PHI, covering administrative, physical, and technical controls to protect confidentiality, integrity, and availability. It requires practices like risk assessments, access controls and unique user IDs, encryption where appropriate, audit controls, user authentication, incident response procedures, and contingency planning. This rule specifically targets electronic data, whereas the Breach Notification Rule deals with reporting after a breach, the Privacy Rule covers patient rights and permissible uses/disclosures (not the technical safeguards for ePHI), and the Enforcement Rule addresses penalties and enforcement. So, for safeguarding electronic PHI, the Security Rule is the standard that applies.