ISO 27001:2022 to HIPAA Security Rule crosswalk

29 control objectives in ISO/IEC 27001 (Annex A controls and management clauses) are mapped here to HIPAA Security Rule and Breach Notification Rule. 5 of them have no direct HIPAA Security Rule requirement, which is marked in the table. Each row is one shared objective, with the requirement ids on both sides.

Control objective	ISO 27001:2022	HIPAA Security Rule
Security governance and policies	`A.5.1`Policies for information security `A.5.36`Compliance with policies, rules and standards for information security	`164.308(a)(1)(i)`Security management process `164.316(a)`Policies and procedures
Security roles and accountability	`A.5.2`Information security roles and responsibilities `A.5.3`Segregation of duties	`164.308(a)(2)`Assigned security responsibility
Risk assessment and treatment	`Clause 6.1.2`Information security risk assessment `Clause 6.1.3`Information security risk treatment	`164.308(a)(1)(ii)(A)`Risk analysis `164.308(a)(1)(ii)(B)`Risk management
Asset and system inventory	`A.5.9`Inventory of information and other associated assets	`164.310(d)(2)(iii)`Accountability (record of hardware and media movements)
Data classification and handling	`A.5.12`Classification of information `A.5.13`Labelling of information	`164.308(a)(1)(ii)(A)`Risk analysis (requires identifying where ePHI lives)
Access provisioning, review and removal	`A.5.15`Access control `A.5.16`Identity management `A.5.18`Access rights	`164.308(a)(3)`Workforce security (authorization, supervision, termination) `164.308(a)(4)`Information access management
Least privilege and privileged access	`A.8.2`Privileged access rights `A.8.3`Information access restriction	`164.312(a)(1)`Access control `164.308(a)(4)`Information access management
Authentication, unique IDs and multi-factor authentication	`A.5.17`Authentication information `A.8.5`Secure authentication	`164.312(d)`Person or entity authentication `164.312(a)(2)(i)`Unique user identification
Encryption at rest and key management	`A.8.24`Use of cryptography	`164.312(a)(2)(iv)`Encryption and decryption (addressable)
Encryption in transit	`A.5.14`Information transfer `A.8.24`Use of cryptography	`164.312(e)(1)`Transmission security
Network security and segmentation	`A.8.20`Networks security `A.8.21`Security of network services `A.8.22`Segregation of networks	no direct requirement
Secure configuration and hardening	`A.8.9`Configuration management	no direct requirement
Vulnerability scanning and patching	`A.8.8`Management of technical vulnerabilities	`164.308(a)(8)`Evaluation (periodic technical evaluation)
Penetration testing and independent assessment	`A.8.29`Security testing in development and acceptance `A.5.35`Independent review of information security	`164.308(a)(8)`Evaluation
Logging, log review and monitoring	`A.8.15`Logging `A.8.16`Monitoring activities `A.8.17`Clock synchronization	`164.312(b)`Audit controls `164.308(a)(1)(ii)(D)`Information system activity review
Intrusion detection and integrity monitoring	`A.8.16`Monitoring activities	`164.312(c)(1)`Integrity
Malware protection	`A.8.7`Protection against malware	`164.308(a)(5)(ii)(B)`Protection from malicious software
Incident response and breach notification	`A.5.24`Information security incident management planning and preparation `A.5.25`Assessment and decision on information security events `A.5.26`Response to information security incidents `A.5.27`Learning from information security incidents	`164.308(a)(6)`Security incident procedures `164.404`Notification to individuals (Breach Notification Rule)
Change management	`A.8.32`Change management	no direct requirement
Secure software development	`A.8.25`Secure development life cycle `A.8.26`Application security requirements `A.8.28`Secure coding `A.8.29`Security testing in development and acceptance `A.8.31`Separation of development, test and production environments	no direct requirement
Third-party and vendor risk management	`A.5.19`Information security in supplier relationships `A.5.20`Addressing information security within supplier agreements `A.5.21`Managing information security in the ICT supply chain `A.5.22`Monitoring, review and change management of supplier services `A.5.23`Information security for use of cloud services	`164.308(b)(1)`Business associate contracts and other arrangements `164.314(a)`Business associate contracts or other arrangements
Business continuity and disaster recovery	`A.5.29`Information security during disruption `A.5.30`ICT readiness for business continuity	`164.308(a)(7)`Contingency plan
Backup and redundancy	`A.8.13`Information backup `A.8.14`Redundancy of information processing facilities	`164.308(a)(7)(ii)(A)`Data backup plan `164.308(a)(7)(ii)(B)`Disaster recovery plan
Capacity and availability management	`A.8.6`Capacity management	no direct requirement
Security awareness and training	`A.6.3`Information security awareness, education and training	`164.308(a)(5)`Security awareness and training
Personnel screening, terms and sanctions	`A.6.1`Screening `A.6.2`Terms and conditions of employment `A.6.4`Disciplinary process `A.6.5`Responsibilities after termination or change of employment	`164.308(a)(3)(ii)(B)`Workforce clearance procedure `164.308(a)(3)(ii)(C)`Termination procedures `164.308(a)(1)(ii)(C)`Sanction policy
Physical access and facility security	`A.7.1`Physical security perimeters `A.7.2`Physical entry `A.7.4`Physical security monitoring	`164.310(a)`Facility access controls
Data retention, media handling and secure disposal	`A.7.10`Storage media `A.7.14`Secure disposal or re-use of equipment `A.8.10`Information deletion	`164.310(d)(2)(i)`Disposal `164.310(d)(2)(ii)`Media re-use
Ongoing control monitoring and internal audit	`Clause 9.2`Internal audit `Clause 9.3`Management review	`164.308(a)(8)`Evaluation

Open a control objective for the evidence checklist.HIPAA Security Rule to ISO 27001:2022 →

Scope: Annex A controls are prefixed 'A.'; management-system clauses are prefixed 'Clause'. Citations are to 45 CFR 164. 'Addressable' vs 'required' implementation specifications are not distinguished here. Several themes have no direct HIPAA citation. A mapping means the requirements address the same objective. It does not mean satisfying one satisfies the other, because scope, frequency and evidence rules differ.

More from ISO 27001:2022

ISO 27001:2022 to SOC 2 ISO 27001:2022 to PCI DSS 4.0 ISO 27001:2022 to NIST CSF 2.0 ISO 27001:2022 to NIST 800-53 r5