5.3 Infrastructure Privacy and Security
Key Takeaways
- The Security Rule requires confidentiality, integrity, and availability of ePHI through administrative, physical, and technical safeguards; addressable means a documented risk-based decision, not a skip.
- Network controls that support CIA include segmentation, default-deny firewalls, encryption in transit, NAC, and no exposed remote desktop on the internet.
- Identity controls include unique user IDs, role-based least privilege, MFA, joiner-mover-leaver provisioning, and audited break-the-glass.
- Encryption at rest on portables, SAN or cloud stores, and backups is the operational default; unencrypted backups lose breach-notification safe harbor.
- Logs must be collected, retained, protected from tampering, and reviewed—a 24-hour writable local buffer is not an audit control.
5.3 Infrastructure Privacy and Security
Quick Answer: Infrastructure is how the HIPAA Security Rule’s confidentiality, integrity, and availability become real. CPHIMS B.2 items test network, identity, and endpoint controls, encryption in transit and at rest, and logging—not slogan-level “we are HIPAA compliant.”
Why infrastructure security is a B.2 topic
Chapter 3 covered who is regulated and which rule applies. This section is the control plane: VLANs, TLS, endpoint detection, MFA, and the SIEM. The Security Rule at 45 CFR 164.306 requires covered entities and business associates to protect ePHI’s confidentiality, integrity, and availability (CIA) with administrative, physical, and technical safeguards. Addressable specifications still require a documented, risk-based decision.
CIA as an infrastructure design brief
| CIA goal | What it means for ePHI | Infrastructure expression |
|---|---|---|
| Confidentiality | Only authorized people and systems see it | Segmentation, least privilege, encryption, DLP, screen privacy |
| Integrity | It is not improperly altered | Hashes, signed images, change control, immutable backups, audit trails |
| Availability | It is usable when care needs it | Redundant power and network, patch windows that do not kill the ED, tested restores |
Confidentiality without availability is a closed hospital. Turning off wireless “for security” and leaving infusion pumps unmanaged is not a pass. Availability without confidentiality is an open share of the entire chart. Exam stems that offer “block everything” are usually wrong unless the stem says the control plane itself is owned.
The Security Rule is flexible and scalable. A 40-provider clinic and a 12-hospital system both owe CIA; they do not owe the same appliance list. What they both owe is a current risk analysis, implemented safeguards, and evidence. “We bought a firewall” is not a risk analysis.
Network controls
Network design from section 5.1 is also a technical safeguard:
- Segmentation and default-deny firewalls between clinical, biomedical, guest, and management zones.
- Encryption in transit — TLS for applications and FHIR APIs; IPsec or equivalent for site-to-site and many vendor tunnels. Unencrypted HL7 over the open internet is a finding, not a shortcut.
- Network access control (NAC) — unknown devices land in quarantine, not the EHR VLAN.
- Egress filtering — pumps and workstations should not freely reach the whole internet.
- Wireless security — WPA2-Enterprise or WPA3-Enterprise for staff; guest isolated; no shared pre-shared key on clinical SSIDs.
- Remote access — VPN or zero-trust with MFA; no exposed RDP to the internet.
These are technical safeguards (access control, transmission security) supported by administrative risk analysis and physical facility controls (data-center cages, locked clinic closets, camera coverage of IDF rooms). A perfectly encrypted tunnel that terminates in an unlocked wiring closet is still a physical-safeguard miss.
Identity controls
Identity is the Security Rule’s unique user identification, emergency access, automatic logoff, and encryption/decryption access-control family, plus audit.
- Unique IDs — no shared “nurse” or “radiology” logins on production EHR.
- Least privilege / RBAC — role plus context (unit, service) beats a global “clinical” flag.
- MFA for remote, privileged, and increasingly all workforce access to ePHI.
- Provisioning and deprovisioning tied to HR events; orphaned accounts are a classic OCR theme.
- Break-the-glass with extra audit, not a standing God mode.
- Service accounts inventoried, owned, and not used by humans.
SSO is covered in section 5.4 as an architecture; here the exam point is that identity is a technical safeguard, not a convenience feature. Automatic logoff on a shared workstation in the ED is an availability-versus-confidentiality trade that you design with clinicians, not a setting you leave at 24 hours because someone complained.
Endpoint controls
Endpoints are laptops, workstations, thin clients, smartphones, and unmanaged medical devices. Controls:
- Full-disk encryption at rest on portable devices (addressable, but the operational default after years of lost-laptop breaches).
- EDR / anti-malware, configuration baselines, and timely patching.
- USB and print restrictions where risk analysis supports them.
- Mobile device management for phones that hold ePHI or mail.
- Medical devices — often cannot run agents; compensate with VLAN isolation, allow-lists, and vendor access procedures (section 5.4).
Encryption at rest also applies to SAN volumes, backups, cloud object stores, and tape. The Breach Notification Rule’s safe harbor applies to PHI that is encrypted so that it is unusable to an unauthorized person. Unencrypted backups are how a misplaced tape becomes a 60-day media notice. Hashing passwords is not backup encryption. TLS on a guest SSID is not laptop-disk encryption.
Logging and monitoring
The Security Rule requires audit controls and information-system activity review. Infrastructure must produce:
- Authentication success and failure, privilege use, and admin actions.
- EHR break-the-glass and sensitive-chart access.
- Firewall denies that indicate scanning or exfiltration.
- Interface-engine queue failures (availability and integrity).
- Cloud control-plane changes (who opened a storage bucket).
Logs that nobody reviews are not a control. Feed them to a SIEM or equivalent, retain them long enough for investigation and legal holds, and protect them from the attacker who would erase the trail. Time sync (NTP) across devices is how you reconstruct an incident. A 24-hour local log that domain admins can overwrite is evidence of intent, not a safeguard.
Workforce audit of who opened a chart is a required technical safeguard. It is not a pretext for managers to snoop without a purpose, and it is not itself a Privacy Rule violation. Distinguish audit (control) from surveillance without a job need (sanctionable).
Scenarios and traps
- Trap: “Addressable means optional.” Addressable means document why you implemented an equivalent or why the specification does not reasonably apply.
- Trap: “Encryption in transit is enough.” Lost unencrypted laptops and open cloud buckets are at-rest failures.
- Trap: “HIPAA requires a specific product.” It requires reasonable and appropriate CIA controls, not a named firewall brand.
- Trap: “Guest Wi-Fi encryption replaces clinical segmentation.” Different problem.
- Trap: “Logging is a privacy violation.” Audit of workforce access is a required technical safeguard.
If a stem offers shutting the entire WLAN during a ransomware event versus isolating the infected VLAN and preserving ED wireless for downtime viewers, prefer the targeted availability-preserving action unless the stem says the wireless controller itself is owned. CIA is a three-part test, not a confidentiality-only test.
A covered entity is implementing transmission security for ePHI leaving the campus. Which pair correctly applies encryption in transit versus encryption at rest?
The Security Rule lists encryption as an addressable implementation specification. A clinic wants to skip laptop encryption because “addressable means optional” and staff dislike passphrases. What is the correct application?
After a suspected EHR account compromise, security finds that firewall and EHR audit logs are retained for 24 hours and are writable by domain admins. Which change best supports Security Rule audit controls and integrity?