HIPAA Security Rule to ISO 27001:2022 crosswalk

24 control objectives in HIPAA Security Rule and Breach Notification Rule are mapped here to ISO/IEC 27001 (Annex A controls and management clauses). Every one has a requirement on the other side. Each row is one shared objective, with the requirement ids on both sides.

Control objective	HIPAA Security Rule	ISO 27001:2022
Security governance and policies	`164.308(a)(1)(i)`Security management process `164.316(a)`Policies and procedures	`A.5.1`Policies for information security `A.5.36`Compliance with policies, rules and standards for information security
Security roles and accountability	`164.308(a)(2)`Assigned security responsibility	`A.5.2`Information security roles and responsibilities `A.5.3`Segregation of duties
Risk assessment and treatment	`164.308(a)(1)(ii)(A)`Risk analysis `164.308(a)(1)(ii)(B)`Risk management	`Clause 6.1.2`Information security risk assessment `Clause 6.1.3`Information security risk treatment
Asset and system inventory	`164.310(d)(2)(iii)`Accountability (record of hardware and media movements)	`A.5.9`Inventory of information and other associated assets
Data classification and handling	`164.308(a)(1)(ii)(A)`Risk analysis (requires identifying where ePHI lives)	`A.5.12`Classification of information `A.5.13`Labelling of information
Access provisioning, review and removal	`164.308(a)(3)`Workforce security (authorization, supervision, termination) `164.308(a)(4)`Information access management	`A.5.15`Access control `A.5.16`Identity management `A.5.18`Access rights
Least privilege and privileged access	`164.312(a)(1)`Access control `164.308(a)(4)`Information access management	`A.8.2`Privileged access rights `A.8.3`Information access restriction
Authentication, unique IDs and multi-factor authentication	`164.312(d)`Person or entity authentication `164.312(a)(2)(i)`Unique user identification	`A.5.17`Authentication information `A.8.5`Secure authentication
Encryption at rest and key management	`164.312(a)(2)(iv)`Encryption and decryption (addressable)	`A.8.24`Use of cryptography
Encryption in transit	`164.312(e)(1)`Transmission security	`A.5.14`Information transfer `A.8.24`Use of cryptography
Vulnerability scanning and patching	`164.308(a)(8)`Evaluation (periodic technical evaluation)	`A.8.8`Management of technical vulnerabilities
Penetration testing and independent assessment	`164.308(a)(8)`Evaluation	`A.8.29`Security testing in development and acceptance `A.5.35`Independent review of information security
Logging, log review and monitoring	`164.312(b)`Audit controls `164.308(a)(1)(ii)(D)`Information system activity review	`A.8.15`Logging `A.8.16`Monitoring activities `A.8.17`Clock synchronization
Intrusion detection and integrity monitoring	`164.312(c)(1)`Integrity	`A.8.16`Monitoring activities
Malware protection	`164.308(a)(5)(ii)(B)`Protection from malicious software	`A.8.7`Protection against malware
Incident response and breach notification	`164.308(a)(6)`Security incident procedures `164.404`Notification to individuals (Breach Notification Rule)	`A.5.24`Information security incident management planning and preparation `A.5.25`Assessment and decision on information security events `A.5.26`Response to information security incidents `A.5.27`Learning from information security incidents
Third-party and vendor risk management	`164.308(b)(1)`Business associate contracts and other arrangements `164.314(a)`Business associate contracts or other arrangements	`A.5.19`Information security in supplier relationships `A.5.20`Addressing information security within supplier agreements `A.5.21`Managing information security in the ICT supply chain `A.5.22`Monitoring, review and change management of supplier services `A.5.23`Information security for use of cloud services
Business continuity and disaster recovery	`164.308(a)(7)`Contingency plan	`A.5.29`Information security during disruption `A.5.30`ICT readiness for business continuity
Backup and redundancy	`164.308(a)(7)(ii)(A)`Data backup plan `164.308(a)(7)(ii)(B)`Disaster recovery plan	`A.8.13`Information backup `A.8.14`Redundancy of information processing facilities
Security awareness and training	`164.308(a)(5)`Security awareness and training	`A.6.3`Information security awareness, education and training
Personnel screening, terms and sanctions	`164.308(a)(3)(ii)(B)`Workforce clearance procedure `164.308(a)(3)(ii)(C)`Termination procedures `164.308(a)(1)(ii)(C)`Sanction policy	`A.6.1`Screening `A.6.2`Terms and conditions of employment `A.6.4`Disciplinary process `A.6.5`Responsibilities after termination or change of employment
Physical access and facility security	`164.310(a)`Facility access controls	`A.7.1`Physical security perimeters `A.7.2`Physical entry `A.7.4`Physical security monitoring
Data retention, media handling and secure disposal	`164.310(d)(2)(i)`Disposal `164.310(d)(2)(ii)`Media re-use	`A.7.10`Storage media `A.7.14`Secure disposal or re-use of equipment `A.8.10`Information deletion
Ongoing control monitoring and internal audit	`164.308(a)(8)`Evaluation	`Clause 9.2`Internal audit `Clause 9.3`Management review

Open a control objective for the evidence checklist.ISO 27001:2022 to HIPAA Security Rule →

Scope: Citations are to 45 CFR 164. 'Addressable' vs 'required' implementation specifications are not distinguished here. Several themes have no direct HIPAA citation. Annex A controls are prefixed 'A.'; management-system clauses are prefixed 'Clause'. A mapping means the requirements address the same objective. It does not mean satisfying one satisfies the other, because scope, frequency and evidence rules differ.

More from HIPAA Security Rule

HIPAA Security Rule to SOC 2 HIPAA Security Rule to PCI DSS 4.0 HIPAA Security Rule to NIST CSF 2.0 HIPAA Security Rule to NIST 800-53 r5