Which of the Two Rules Within Title II of HIPAA Applies Exclusively to PHI: The Security Rule, Explained

Only the HIPAA Security Rule applies exclusively to protected health information. Title II of HIPAA contains two rules: the Privacy Rule and the Security Rule. The Privacy Rule covers PHI in any form, including paper and verbal exchanges. The Security Rule governs only electronic PHI, which the regulation calls e-PHI. So when someone asks which rule is "exclusive" to PHI in its narrowest, electronic sense, the answer is the Security Rule. It doesn't apply to paper records, and it doesn't cover workforce conversations, which is where the distinction matters most in practice.

The Two Rules Under Title II and What Each One Governs

Title II of HIPAA, passed in 1996, directed the Department of Health and Human Services to write rules protecting health information. Two administrative simplification rules emerged from that mandate: the Privacy Rule, finalized in 2000 and effective April 14, 2003, and the Security Rule, finalized in 2003 with a compliance date of April 20, 2005. Both sit in the Code of Federal Regulations under 45 CFR Parts 160 and 164. They share a definition of PHI but diverge on the medium they regulate.

The Privacy Rule sets the national standard for how covered entities and business associates may use and disclose PHI. It applies to every format you can imagine: a paper chart in a filing cabinet, a fax confirmation sheet, a receptionist's phone conversation in a semi-private hallway, and an electronic record. Its core machinery includes the minimum necessary standard, patient rights to access and amend records, and the requirement to distribute a Notice of Privacy Practices. That reach across media is why privacy compliance officers talk about "the front desk" as much as "the server room."

The Security Rule takes a narrower target. It addresses only electronic protected health information—the same health data, but held or transmitted in electronic media. The rule's own text at 45 CFR 164.306 makes that scope explicit: it applies to e-PHI a covered entity or business associate creates, receives, maintains, or transmits. If a record never touches a computer, network, or electronic storage device, the Security Rule has nothing to say about it.

That split creates a practical mapping question every compliance team faces. A verbal handoff between two nurses is a Privacy Rule event. A stolen laptop holding the same patient's lab results is both a Privacy Rule event and a Security Rule event, because the electronic medium triggers the second rule on top of the first. The sections below walk through where the boundary sits, how it plays out in breach scenarios, and what it costs to get it wrong.

Why the Security Rule Is the Exclusive e-PHI Rule

The exclusive trigger for the Security Rule is the word "electronic." Every standard inside it—administrative safeguards, physical safeguards, technical safeguards, organizational requirements, and policies and procedures—presumes a digital asset. The rule's three safeguard categories map to who touches the system, where the hardware sits, and how access is controlled at the software layer. None of that translates to a paper chart, because a locked file room is a Privacy Rule safeguard, not a Security Rule one.

Consider a concrete case. A hospital maintains a paper log at a nursing station listing patient room assignments. That log is PHI. The Privacy Rule requires reasonable safeguards to limit incidental disclosure, so a compliance officer would flag an open log viewable by visitors. The Security Rule imposes no encryption standard, no access control standard, and no audit log requirement on that paper, because paper is outside its scope. If that same room-assignment list moves to an electronic bed board, every Security Rule safeguard becomes mandatory or addressable depending on the implementation specification.

A subtle point trips up many compliance staff: the Security Rule doesn't apply to all electronic data in a covered entity. It applies to electronic PHI. An email thread about cafeteria vendor pricing is electronic but not PHI, so the Security Rule doesn't reach it. A patient's billing statement stored in a financial system is PHI if it links to a health condition, and the Security Rule follows it there. The exclusion runs on the nature of the data, not the technology alone.

So the exclusivity claim holds in this precise sense: among Title II's two rules, only the Security Rule is defined by the electronic medium. The Privacy Rule is conditionally exclusive to PHI legally but not exclusively electronic. That asymmetry is the answer most compliance exams are probing for, and it's the distinction that determines which audit checklist your team pulls out.

Privacy Rule Reach Beyond PHI: Where the Overlap Breaks Down

The Privacy Rule's coverage is wider than PHI in one direction: it also regulates "individually identifiable health information" in some contexts and imposes requirements on covered entities that extend beyond protected health information itself. Its administrative requirements—designating a privacy official, training the workforce, establishing a complaint process, applying sanctions—apply to the covered entity as an organization, not to a specific data element. A covered entity must have a privacy officer even if it processes zero PHI on a given day.

Then there's the marketing and fundraising machinery. The Privacy Rule governs how a covered entity may use PHI for marketing communications and fundraising appeals, including authorization requirements and opt-out rights. A hospital sending a fundraising letter to former patients is a Privacy Rule scenario with no Security Rule counterpart, because the letter is paper and the data use is a disclosure question rather than a digital safeguard question. The Privacy Rule also sets the rules for research uses, public health reporting, and law enforcement disclosures, none of which are defined by medium.

The overlap zone is where both rules attach simultaneously. Electronic PHI in a covered entity's system is governed by the Privacy Rule for use-and-disclosure decisions and by the Security Rule for safeguard decisions. An unauthorized access to an EHR is a potential Privacy Rule violation if it involved a use or disclosure, and a potential Security Rule violation if access controls were deficient. Enforcement statistics reflect that dual track: the HHS Office for Civil Rights resolves most large settlements under both rules at once, and its breach portal reports incidents that typically implicate Security Rule safeguards alongside Privacy Rule notification duties.

The practical takeaway is a two-question test. Ask first: is this PHI in any form? If yes, the Privacy Rule applies. Ask second: is it electronic? If yes, add the Security Rule. The first question is broader, the second is the exclusive one, and neither can be skipped if you want a clean compliance posture.

How a Single Incident Splits Across Both Rules

Walk through a lost unencrypted laptop holding 4,000 patient records and the split becomes visible in the response timeline. The Privacy Rule drives the breach notification analysis under 45 CFR 164.400–414 and its companion provisions, including whether a risk assessment supports a low-probability-of-compromise conclusion. The Security Rule drives the root-cause review: were device and media controls in place under 164.310(d), was encryption implemented or documented as not reasonable and appropriate under 164.312(a)(2)(iv), and was the risk analysis current under 164.308(a)(1)(ii)(A). Two different teams, two different checklists, one incident.

Now swap the medium. A paper sign-in sheet at a specialist's office is left on the counter overnight, and a cleaning crew photographs it. That's a Privacy Rule incident. The covered entity assesses whether the disclosure was impermissible, whether notification is required under the breach rule's paper-record provisions, and whether reasonable safeguards were in place. The Security Rule never enters the room, because no electronic medium is involved. The same data, a different medium, and half the regulatory surface disappears.

A third scenario sharpens the boundary: a fax sent to the wrong number. Faxes are electronic transmission in common usage, but HHS has treated fax as outside the Security Rule's electronic media definition in guidance, and the Privacy Rule's minimum necessary and verification requirements govern the send. Compliance teams that reflexively open a Security Rule investigation on every misdirected fax waste resources. The medium question is the gate.

Breach cost data shows why the split matters financially. IBM's annual Cost of a Data Breach report, in its 2024 edition produced with Ponemon Institute, put the global average healthcare breach cost at $9.77 million, the highest of any industry surveyed for the fourteenth consecutive year. That figure reflects incidents that almost always carry a Security Rule dimension because they involve electronic systems. A pure paper incident rarely reaches that scale, and the enforcement path is correspondingly different.

Safeguard Mapping: Which Security Rule Standards Have No Privacy Rule Twin

The Security Rule's three safeguard families contain implementation specifications that exist nowhere in the Privacy Rule. Administrative safeguards under 164.308 include the risk analysis, sanction policy, and contingency planning requirements. Physical safeguards under 164.310 cover facility access controls, workstation use, and device and media controls. Technical safeguards under 164.312 cover access control, audit controls, integrity, person or entity authentication, and transmission security. The Privacy Rule has no counterpart to encryption at rest, no audit log requirement, and no contingency plan standard.

Some specifications are "required" and others "addressable," a distinction the Security Rule makes explicitly. Addressable does not mean optional: a covered entity must implement the specification or document why it's not reasonable and appropriate and implement an equivalent alternative. Encryption is addressable, which is why unencrypted laptops remain a recurring enforcement theme. The 2018 HHS settlement with a large academic medical center over unencrypted devices, and the agency's subsequent right-of-access and risk-analysis settlements, show OCR treating missing risk analysis as an aggravating factor in nearly every Security Rule case.

The Privacy Rule's safeguards provision, by contrast, is a single reasonable-safeguards requirement at 164.530(c) that applies to PHI generally. It doesn't prescribe access control architecture or audit logging. It asks whether the covered entity took reasonable steps to limit incidental uses and disclosures. That flexibility is broader but shallower: fewer specific mandates, more judgment about context.

Map the two side by side and the exclusive territory is obvious:

The bottom row is the tell. The Privacy Rule's safeguard requirement is the only one built for any medium, and it's deliberately general. Everything above it is Security Rule machinery aimed at systems.

Enforcement Patterns That Reveal the Exclusive Scope

HHS Office for Civil Rights enforcement resolves cases under the rule that fits the facts. Its Security Rule cases cluster around hacking and IT incidents, unencrypted devices, and missing risk analyses. Its Privacy Rule cases cluster around impermissible disclosures, right-of-access failures, and inadequate notices. A review of OCR's resolution agreement archive shows Security Rule settlements regularly exceeding $1 million, with the largest reaching into the tens of millions in cases involving prolonged, undetected intrusions.

The 2023 settlement with a large dental benefits provider over a 2019 ransomware attack, reported by OCR at $1.3 million, is a clean Security Rule case: the agency cited failure to conduct an accurate risk analysis and failure to implement sufficient procedures to reduce risks. No paper record was implicated. The 2024 settlement with a national health system over a 2020 phishing breach, announced at roughly $950,000, similarly tracked Security Rule risk-analysis and monitoring failures rather than Privacy Rule disclosure questions.

Privacy Rule settlements follow a different signature. OCR's right-of-access initiative, launched in 2019, produced a string of five-figure settlements with small practices that failed to provide records within 30 days. Those cases involve PHI in any form but hinge on the Privacy Rule's access provision at 164.524, which has no electronic-only limitation. A practice that hands over paper copies late is as exposed as one that withholds an EHR export.

Budget your compliance spend by this pattern. If the organization holds electronic PHI, the Security Rule is where the seven-figure exposure lives because that's where OCR's largest recoveries concentrate. If the organization's risk sits in front-desk disclosures and records requests, the Privacy Rule is the enforcement channel. Most covered entities need both, but the dollar-weighted priority usually points at the digital side.

Common Misreadings That Cost Compliance Teams Time

The most frequent error is treating the Security Rule as the general HIPAA security rule for all PHI. It isn't. It's the e-PHI rule. Teams that build a single "HIPAA security" policy covering paper and digital without distinguishing the two create gaps: paper safeguards get no Security Rule review because none is required, while digital safeguards get reviewed under a Privacy Rule lens that lacks the specificity to catch missing audit controls.

The second error runs the opposite way. Some staff assume the Privacy Rule applies only to paper because the Security Rule "handles the computers." That's backwards. The Privacy Rule applies to electronic PHI too, and an unauthorized EHR access is a Privacy Rule disclosure question before it's a Security Rule safeguard question. The dual-track analysis is mandatory, not optional.

The third error is the "addressable equals optional" misreading, which surfaces constantly in Security Rule audits. Addressable specifications require a documented decision. An organization that skips encryption without a written rationale is out of compliance even if it never suffers a breach, because the rule requires the analysis and the documentation. OCR has cited this in multiple settlements.

The fourth error concerns business associates. The Security Rule's organizational requirements at 164.314 impose contract terms on business associate agreements covering e-PHI safeguards. A BAA that omits the Security Rule provisions is deficient even if it's thorough on Privacy Rule terms. Covered entities signing vendor agreements should check both halves, and the electronic scope of the vendor's access determines which half carries the weight.

A One-Page Test for Assigning Any Requirement to the Right Rule

Build the assignment test around three questions and run every requirement through them before assigning an owner. First, is the data PHI? If no, neither rule applies, though state law may. Second, is the data electronic? If no, the Privacy Rule governs. Third, if electronic, which rule family does the requirement belong to, use-and-disclosure or safeguard? Use-and-disclosure questions—authorization, minimum necessary, patient rights, breach notification analysis—belong to the Privacy Rule even when the data is electronic. Safeguard questions belong to the Security Rule.

Apply the test to a real workflow. A telehealth visit involves an audiovisual platform transmitting patient data. The consent, notice, and minimum-necessary questions are Privacy Rule. The transmission security requirement at 164.312(e) is Security Rule, and the platform's BAA must cover it. Two owners, one visit. Running the test prevents the common failure of assigning the whole telehealth program to a privacy officer who then misses the encryption and audit-log specifications.

Use the test to structure your policy library too. Tag every policy with the rule that drives it. Policies tagged Privacy Rule apply enterprise-wide. Policies tagged Security Rule apply to systems holding e-PHI, and their scope statement should say so explicitly. When an auditor or OCR asks why a paper-only clinic lacks an audit-log policy, the tagged scope answers the question in one line.

Document the test output in your risk analysis. HHS guidance treats the risk analysis as the foundation of Security Rule compliance, and its scope should be defined by the systems that hold e-PHI. An analysis that includes paper records isn't wrong, but it blurs the exclusive boundary and makes it harder to demonstrate that the required electronic scope was covered. Keep the paper assessment separate and label it as a Privacy Rule safeguard review.

What the Exclusivity Question Means for Covered Entities and Business Associates

A covered entity's obligations under the Security Rule attach when it creates, receives, maintains, or transmits e-PHI. A business associate's obligations attach the same way, and the 2013 Omnibus Rule extended direct liability to business associates for Security Rule compliance. That means a billing vendor handling e-PHI must have its own risk analysis, access controls, and incident procedures, not just contractual promises. The Privacy Rule's business associate provisions set the contract requirements; the Security Rule sets the safeguards the vendor must actually operate.

Small practices often ask whether they can rely on their EHR vendor's certification to satisfy the Security Rule. They can't, fully. The vendor's certification may cover the product's technical safeguards, but the covered entity still owns its risk analysis, workforce training, facility access, and device controls. The 2023 HHS cybersecurity strategy and OCR's enforcement record both push responsibility back to the covered entity for the full safeguard set around the certified product.

The exclusivity question also shapes cyber insurance and vendor due diligence. Insurers underwriting healthcare risks ask for Security Rule evidence—risk analyses, encryption status, incident response plans—because that's where claims originate. A covered entity that can produce only Privacy Rule documentation will struggle in underwriting. Build the Security Rule evidence file as a standing deliverable, updated annually, and keep the Privacy Rule file alongside it.

Finally, remember that the two rules share definitions and enforcement but not scope. The answer to the opening question—the Security Rule is the exclusive e-PHI rule—is a map, not a shortcut. You still need the Privacy Rule for the paper, verbal, and disclosure dimensions of every workflow. The organizations that get this right treat the two rules as concentric circles: Privacy Rule on the outside covering all PHI, Security Rule on the inside covering the electronic layer, with both applying where they overlap.

FAQ

Does the Privacy Rule apply to paper records?

Yes. The Privacy Rule applies to PHI in any form, including paper charts, faxes, and verbal exchanges, under 45 CFR 164.500 and related provisions. A practice that keeps only paper records is still a covered entity with full Privacy Rule obligations, including notice, access, and minimum necessary requirements. What it may lack is Security Rule exposure, because the Security Rule's scope is limited to electronic media.

Is encryption required under the Security Rule?

Encryption is an addressable implementation specification at 164.312(a)(2)(iv), not a flat requirement. A covered entity must implement it or document why it's not reasonable and appropriate and adopt an equivalent alternative. In practice, OCR has treated missing encryption on portable devices as a recurring enforcement theme, and the 2013 Omnibus Rule tied breach notification safe harbor to encryption. Document the decision either way.

What is the difference between e-PHI and PHI?

PHI is health information that identifies an individual and relates to their physical or mental health, care, or payment for care, in any medium. E-PHI is the subset of PHI that is transmitted or maintained in electronic media. The Privacy Rule governs both; the Security Rule governs only e-PHI. A paper lab result is PHI but not e-PHI, while the same result in an EHR is both.

Can a business associate be liable under the Security Rule?

Yes, since the 2013 Omnibus Rule. Business associates are directly liable for Security Rule compliance for the e-PHI they handle, independent of the covered entity's contract. A vendor must maintain its own risk analysis, access controls, and incident response procedures. Covered entities should verify those safeguards during due diligence, not just sign the BAA.

Does a misdirected fax trigger the Security Rule?

Generally no. Fax transmission has been treated as outside the Security Rule's electronic media definition in HHS guidance, so a wrong-number fax is typically a Privacy Rule incident. The covered entity assesses impermissible disclosure and notification duties under the Privacy Rule. Some state laws and organizational policies impose stricter fax safeguards, so check both before closing the incident.

Which rule covers a lost unencrypted laptop?

Both rules can apply. The Privacy Rule drives the breach notification analysis and the use-and-disclosure assessment, while the Security Rule drives the root-cause review of device and media controls and encryption decisions under 164.310(d) and 164.312. The incident response should run both checklists in parallel rather than choosing one.

How much can a Security Rule violation cost?

Civil monetary penalties under HIPAA's tiered structure can reach $1.5 million per violation category per calendar year, adjusted annually for inflation, and OCR settlements in Security Rule cases have ranged from tens of thousands to tens of millions. The 2024 IBM/Ponemon healthcare breach average of $9.77 million captures the broader incident cost, not just the penalty. Actual exposure depends on the violation tier and cooperation.

Do small practices have to comply with the Security Rule?

Yes. There's no small-practice exemption from the Security Rule, though HHS offers scaled guidance and the rule's addressable specifications allow flexibility in how compliance is achieved. A solo practice with an EHR must conduct a risk analysis, implement access controls, and have contingency procedures. The scale of the controls can match the size of the operation, but the obligation to assess and document does not disappear.

This article provides general educational information about HIPAA's administrative simplification rules and is not legal advice or a compliance determination for any specific organization. Covered entities and business associates should consult a qualified healthcare attorney or compliance professional in their jurisdiction and confirm current requirements directly with the HHS Office for Civil Rights, since enforcement priorities and penalty amounts change over time. If you are responding to an active breach or a patient safety emergency, contact your organization's incident response lead and, where immediate danger exists, local emergency services.