The HIPAA Security Rule's technical safeguard requirements are written in 45 CFR Part 164.312. The rule has not been substantially updated since 2006. But the systems covered entities and business associates use to process ePHI look completely different today — AI pipelines, multi-tenant SaaS platforms, event-driven architectures, LLM-based clinical assistants.
The underlying requirements have not changed. What has changed is what implementing them actually requires.
§164.312(a)(1) — Access Control
The regulation requires "unique user identification, emergency access procedure, automatic logoff, and encryption and decryption." The modern implementation challenge is that ePHI no longer lives only in a database — it lives in LLM context windows, in webhook payloads, in message queues, in vector embeddings.
Access control in 2026 means: RBAC at the API layer (not just the database), scoped API keys that limit which ePHI fields are accessible, MFA for all access paths (not just the web UI), and automatic session expiration enforced server-side.
§164.312(b) — Audit Controls
"Hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information." Every read, write, and export of ePHI must be logged. The logs must be tamper-evident — a mutable database table does not satisfy this requirement. Hash-chained logs do.
HIPAA requires 6-year log retention. G8KEPR retains audit logs for 7 years by default. If your logging infrastructure does not have a retention policy configured, you may have a compliance gap regardless of what you are logging.
§164.312(e)(1) — Transmission Security
TLS 1.3 is the standard. TLS 1.2 is considered weak by most compliance frameworks and most security assessors. If your API accepts TLS 1.2 connections, you have a finding waiting to happen. Certificate pinning for internal service-to-service calls involving ePHI is not required but is a reasonable additional control.
The AI-Specific Gap
None of the 2006 safeguard requirements contemplate AI systems. There is no CFR citation that covers "what happens when ePHI is included in an LLM prompt." The practical interpretation is that ePHI in a model context window is ePHI in transit and in processing — access control, transmission security, and audit requirements all apply.
This means: your AI API calls involving ePHI need to go through TLS 1.3 (obvious), the model provider needs to be a signed business associate (less obvious), and you need audit logs of which ePHI was included in which model call (non-obvious for most teams).