The main HIPAA security requirements fall into three categories: Physical – Includes the physical safeguards in place to secure access to physical equipment including computers, internet routers, data storage and other data devices. Administrative  – Includes the policies and procedures that impact ePHI as well as risk management, system architecture and maintenance related to these security measures. This also includes other administrative aspects like HR and employee training. Technical  – Includes the cybersecurity of the computers, mobile devices, encryption, network security, device security and anything related to the actual technology of storing and communicating ePHI.