HIPAA
HIPAA Security Rule, 45 CFR Part 164 Subpart C
S3M supports six HIPAA Security Rule safeguards at the network layer. ConnGuard NAC and CityGate let only authorized users and devices, including medical IoT, reach systems that hold patient data, EndGuard ties each device to its user, and SAMI keeps audit-ready records for activity reviews. Encryption and application audit trails need other tools.
How S3M supports HIPAA
Applies to: US health plans, healthcare clearinghouses and providers, and their business associates that handle electronic protected health information. Read the official text
| Article / control | What it asks | How S3M supports it | Products |
|---|---|---|---|
| §164.308(a)(1)(ii)(D) | Review records of system activity regularly, such as audit logs and access reports. | SAMI answers questions about network access and device activity from telemetry, with the source shown, which provides evidence for these reviews. | |
| §164.308(a)(3)(i) | Make sure staff have only the access to electronic patient data their role needs. | ConnGuard NAC gives each user and device network access by role and keeps others off the segments that hold patient data. | |
| §164.308(a)(4)(i) | Have policies for authorizing access to electronic patient data. | ConnGuard NAC and CityGate enforce the access policies you set, at every connection. | |
| §164.312(a)(1) | Allow technical access to electronic patient data only to authorized people and software. | ConnGuard NAC admits users and devices, including medical IoT, by identity and posture, and EndGuard isolates an endpoint that turns compromised. | |
| §164.312(b) | Record and examine activity in systems that hold electronic patient data. | SAMI keeps audit-ready records of network sessions. Activity inside clinical applications stays with those applications. | |
| §164.312(d) | Verify that a person or entity seeking access is who they claim to be. | EndGuard fingerprints each device and binds it to its user, and ConnGuard NAC authenticates with 802.1X and RADIUS. S3M does not provide multi-factor authentication. |
S3M supports these requirements with technical controls. This is not legal advice or a certification; confirm legal questions with your counsel.
Checked against the official text on .
Related
Frequently asked questions
Which HIPAA safeguards does S3M support?
Technical and administrative safeguards in sections 164.308 and 164.312 that concern network access, authentication and activity records, as the table shows. Encryption in transit, section 164.312(e), needs other tools.
Does S3M see medical IoT devices?
Yes. ConnGuard NAC sees managed, IoT and BYOD devices on the network and grants each one access by identity and policy.
Is the 2025 HIPAA Security Rule proposal covered?
The table follows the rule in force. HHS proposed changes in January 2025 that are not final; we will review the table if they take effect.
Last updated