What Are HIPAA Technical Safeguards?

The Five Technical Safeguard Categories — and What They Require

As part of overall HIPAA compliance, the HIPAA Security Rule defines five categories of technical safeguards:

• Access Controls – restricting PHI access to authorized users 
• Audit Controls – recording system activity involving PHI 
• Integrity Controls – preventing unauthorized alteration of data 
• Person or Entity Authentication – verifying that users are who they claim to be
• Transmission Security – protecting PHI as it moves across networks

Each category has direct implications for chat and video systems.

In the healthcare deployments we support, the safeguard that tends to cause the most implementation friction isn’t encryption — teams expect that. It’s audit controls. Specifically, the requirement to produce session-level and message-level logs that are tamper-evident, retained appropriately, and exportable on demand. Many platforms offer logging in some form, but the logs don’t always capture what a compliance review actually needs to see.

Access Controls

Access controls restrict who can view, modify, or transmit PHI within the system.

HIPAA requires:

• Unique user identification (no shared logins)
• Emergency access procedures

It also lists two addressable specifications, which you implement when reasonable and appropriate or document an equivalent alternative:

• Automatic logoff after inactivity
• Encryption and decryption of stored ePHI

In practice, this means every clinician, staff member, and administrator has their own credential, permissions are assigned based on role, and access can be revoked immediately when employment ends.

For chat and video platforms, per-user identity must be enforced at the API and infrastructure level — not left to front-end configuration alone.

Audit Controls

Audit controls require the system to record activity involving PHI.

For chat and video platforms, this typically includes logging:

• Message send and receive events
• File uploads and downloads
• Video session initiation and participant join/leave events
• Permission changes
• Administrative configuration changes

HIPAA doesn’t specify a log format, but compliance reviews typically expect logs to be tamper-evident, retained, and exportable. A platform that cannot produce session-level audit logs will struggle to show this safeguard is met.

Integrity Controls

Integrity controls ensure PHI is not improperly altered or destroyed.

In a chat context:

• Messages cannot be silently edited after delivery
• Any deletion or modification must be logged

In a video context:

• Recordings must be stored in a way that prevents unauthorized modification
• Access to recordings must be controlled and logged

Integrity safeguards apply both at the application layer and the storage infrastructure layer. For what HIPAA requires at the hosting layer, see What Is HIPAA-Compliant Hosting?

Transmission Security

Transmission security requires safeguards against unauthorized access to PHI sent over a network. Encryption is an addressable specification, but in practice it’s the expected answer.

Common standards:

• TLS 1.2 or higher for API calls and messaging
• Encrypted WebRTC sessions for video calls
• No unencrypted fallback path

Sending PHI via standard SMS or unsecured email puts this safeguard at risk. Consumer messaging tools frequently fail here — and on audit logging and role-based access — even when they advertise TLS encryption. For how these safeguards apply to chat specifically, see What Is a HIPAA-Compliant Chat API?

Common Misconceptions About HIPAA Technical Safeguards

Technical safeguards are often misunderstood at the implementation level, particularly in communication systems where multiple services interact.

“We have TLS encryption, so transmission security is covered.” TLS encrypts data in transit, which satisfies one element of transmission security. But if there’s an unencrypted fallback path anywhere in the system — a legacy API endpoint, an SMS notification containing PHI, a video session that can downgrade — the safeguard is not fully met. Encryption has to be enforced consistently, not just available by default.

“Our platform logs activity, so audit controls are satisfied.” Logging and HIPAA-compliant audit controls are not the same thing. Audit logs must capture specific event types at the session and message level, be tamper-evident, retained according to your documented retention policy, and exportable for review. A platform that logs application errors but not user access events doesn’t satisfy this requirement.

“Access controls are an admin configuration — not an infrastructure requirement.” Role-based access and unique user identification need to be enforced at the infrastructure layer, not left to front-end configuration that can be bypassed or misconfigured. If the API layer doesn’t enforce per-user identity, front-end controls alone are insufficient.

“These safeguards only apply to our EHR — not our messaging or video tools.” Technical safeguards apply to every system that stores, processes, or transmits ePHI — including chat APIs, video platforms, AI tools, and any analytics service with access to patient data. The scope is the data, not the system type.

Understanding the five technical safeguard categories is the straightforward part. The harder part is implementing them consistently across a stack where PHI moves through multiple components — and where each component was potentially built, configured, or procured at a different time by a different team.

What we see in practice is that safeguard coverage tends to be uneven. The video layer is usually well-configured. The messaging API sometimes lacks the session-level audit logging that a compliance review would require. The AI processing component — added later, after the initial compliance review — occasionally has no BAA in place at all. The safeguards framework is only as strong as its weakest component.

QuickBlox builds access controls, authentication, audit logging, integrity protections, and transmission security into its HIPAA-compliant telehealth infrastructure for chat, video and AI messaging, and into its HIPAA-compliant hosting. If you’re auditing your current stack against the five safeguard categories and want a second set of eyes, we’re happy to take a look — most of those conversations start with audit logging.