[Verse 1] When patient data needs protection strong HIPAA Security Rule comes along Three categories guard the way Administrative, Physical, Technical today Some standards are required by the law Others addressable, but still must draw A plan to implement or justify Why alternatives will satisfy [Chorus] A-P-T, remember these three Administrative, Physical, Technical security Required means you must comply Addressable means implement or justify Document your choices in the risk assessment file Forty-five CFR one-sixty-four style [Verse 2] Administrative controls set the tone Policies and procedures, workforce shown Who can access what and when they may Training and sanctions guide the way Security officer leads the charge Information access management large Assigned security responsibility Workforce training and activity [Chorus] A-P-T, remember these three Administrative, Physical, Technical security Required means you must comply Addressable means implement or justify Document your choices in the risk assessment file Forty-five CFR one-sixty-four style [Verse 3] Physical safeguards guard the space Workstations, media in their place Facility access controls the door Device and media controls and more Technical safeguards use technology Access control and activity Audit controls track every move Integrity and transmission prove [Bridge] One-sixty-four point three-hundred sections tell Which standards are required, which addressable Risk assessment documents your reasoning For every choice that you are seasoning Implementation specifications guide How compliance will be verified [Chorus] A-P-T, remember these three Administrative, Physical, Technical security Required means you must comply Addressable means implement or justify Document your choices in the risk assessment file Forty-five CFR one-sixty-four style [Outro] Three pillars standing strong and true HIPAA Security protecting you Administrative, Physical, Technical way Keeping patient data safe each day
← 2 CMMC (Cybersecurity Maturity Model Certification) | 5 NIST SP 800-53 →