Here's a link to the dry text of the HIPAA regulations: https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/combined/hipaa-simplification-

Here's a link to the dry text of the HIPAA regulations: https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/combined/hipaa-simplification-201303.pdf https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/ad... Part 164 subsection C covers the entirety of the security rule, and is less than 10 pages. Ultimately, these are the fundamental ones that you need to pay attention to when developing or deploying software that deal with ePHI: Keep anything that stores (e)PHI physically (and electronically) secure Limit access to (e)PHI to only those who need it Keep records of access to (e)PHI by users (no shared accounts, each individual must be uniquely identifiable) Encrypt (e)PHI _where possible_; this is an addressable requirement which means it is not mandatory, but should be followed where technically and administratively feasible All of this is literally common sense to most developers when dealing with PHI. There are more obnoxious security frameworks some healthcare companies opt to follow like Hitrust (the personal hell I live in), but it's not like CMS or any other government agency mandates anything beyond the HIPAA regulations.