HIPAA Security Rule to NIST 800-53 r5 crosswalk

24 control objectives in HIPAA Security Rule and Breach Notification Rule are mapped here to NIST SP 800-53 Security and Privacy Controls. Every one has a requirement on the other side. Each row is one shared objective, with the requirement ids on both sides.

Control objective	HIPAA Security Rule	NIST 800-53 r5
Security governance and policies	`164.308(a)(1)(i)`Security management process `164.316(a)`Policies and procedures	`PM-1`Information security program plan `PL-1`Policy and procedures (planning)
Security roles and accountability	`164.308(a)(2)`Assigned security responsibility	`PM-2`Information security program leadership role `AC-5`Separation of duties
Risk assessment and treatment	`164.308(a)(1)(ii)(A)`Risk analysis `164.308(a)(1)(ii)(B)`Risk management	`RA-3`Risk assessment `PM-9`Risk management strategy
Asset and system inventory	`164.310(d)(2)(iii)`Accountability (record of hardware and media movements)	`CM-8`System component inventory
Data classification and handling	`164.308(a)(1)(ii)(A)`Risk analysis (requires identifying where ePHI lives)	`RA-2`Security categorization
Access provisioning, review and removal	`164.308(a)(3)`Workforce security (authorization, supervision, termination) `164.308(a)(4)`Information access management	`AC-2`Account management `AC-3`Access enforcement `PS-4`Personnel termination `PS-5`Personnel transfer
Least privilege and privileged access	`164.312(a)(1)`Access control `164.308(a)(4)`Information access management	`AC-6`Least privilege `AC-5`Separation of duties
Authentication, unique IDs and multi-factor authentication	`164.312(d)`Person or entity authentication `164.312(a)(2)(i)`Unique user identification	`IA-2`Identification and authentication (organizational users) `IA-5`Authenticator management
Encryption at rest and key management	`164.312(a)(2)(iv)`Encryption and decryption (addressable)	`SC-28`Protection of information at rest `SC-12`Cryptographic key establishment and management `SC-13`Cryptographic protection
Encryption in transit	`164.312(e)(1)`Transmission security	`SC-8`Transmission confidentiality and integrity `SC-13`Cryptographic protection
Vulnerability scanning and patching	`164.308(a)(8)`Evaluation (periodic technical evaluation)	`RA-5`Vulnerability monitoring and scanning `SI-2`Flaw remediation
Penetration testing and independent assessment	`164.308(a)(8)`Evaluation	`CA-8`Penetration testing `CA-2`Control assessments
Logging, log review and monitoring	`164.312(b)`Audit controls `164.308(a)(1)(ii)(D)`Information system activity review	`AU-2`Event logging `AU-6`Audit record review, analysis and reporting `AU-11`Audit record retention `SI-4`System monitoring
Intrusion detection and integrity monitoring	`164.312(c)(1)`Integrity	`SI-4`System monitoring `SI-7`Software, firmware and information integrity
Malware protection	`164.308(a)(5)(ii)(B)`Protection from malicious software	`SI-3`Malicious code protection
Incident response and breach notification	`164.308(a)(6)`Security incident procedures `164.404`Notification to individuals (Breach Notification Rule)	`IR-4`Incident handling `IR-8`Incident response plan `IR-6`Incident reporting `IR-3`Incident response testing
Third-party and vendor risk management	`164.308(b)(1)`Business associate contracts and other arrangements `164.314(a)`Business associate contracts or other arrangements	`SR-3`Supply chain controls and processes `SR-6`Supplier assessments and reviews `SA-9`External system services
Business continuity and disaster recovery	`164.308(a)(7)`Contingency plan	`CP-2`Contingency plan `CP-4`Contingency plan testing `CP-10`System recovery and reconstitution
Backup and redundancy	`164.308(a)(7)(ii)(A)`Data backup plan `164.308(a)(7)(ii)(B)`Disaster recovery plan	`CP-9`System backup
Security awareness and training	`164.308(a)(5)`Security awareness and training	`AT-2`Literacy training and awareness `AT-3`Role-based training
Personnel screening, terms and sanctions	`164.308(a)(3)(ii)(B)`Workforce clearance procedure `164.308(a)(3)(ii)(C)`Termination procedures `164.308(a)(1)(ii)(C)`Sanction policy	`PS-3`Personnel screening `PS-4`Personnel termination `PS-8`Personnel sanctions
Physical access and facility security	`164.310(a)`Facility access controls	`PE-2`Physical access authorizations `PE-3`Physical access control `PE-6`Monitoring physical access
Data retention, media handling and secure disposal	`164.310(d)(2)(i)`Disposal `164.310(d)(2)(ii)`Media re-use	`MP-6`Media sanitization `SI-12`Information management and retention
Ongoing control monitoring and internal audit	`164.308(a)(8)`Evaluation	`CA-2`Control assessments `CA-7`Continuous monitoring

Open a control objective for the evidence checklist.NIST 800-53 r5 to HIPAA Security Rule →

Scope: Citations are to 45 CFR 164. 'Addressable' vs 'required' implementation specifications are not distinguished here. Several themes have no direct HIPAA citation. Base controls only (no enhancements). FedRAMP, TX-RAMP and StateRAMP baselines are built on 800-53, but baseline membership and parameters are not included here. A mapping means the requirements address the same objective. It does not mean satisfying one satisfies the other, because scope, frequency and evidence rules differ.

More from HIPAA Security Rule

HIPAA Security Rule to SOC 2 HIPAA Security Rule to PCI DSS 4.0 HIPAA Security Rule to NIST CSF 2.0 HIPAA Security Rule to ISO 27001:2022