Question: who must comply with the security rule?
Answer: All HIPAA-covered entities and business associates of covered entities must comply with the Security Rule requirements. Find out if you are a covered entity. What does the Security Rule encompass? The Security Rule applies only to electronic protected health information (ePHI).