I have a degree in Medical Record Administration and one of my past positions was Manager of Medical Records and Privacy Officer for a hospital. The Office of Civil Rights enforces the HIPAA Privacy and Security Rules. You can check out their HIPAA website at http://www.hhs.gov/ocr/privacy/ You can also review the Security Rule which sets forth guidelines for protecting electronic data. This can be found on http://www.hhs.gov/ocr/privacy/hipaa/administrative/security... - click on "Security Rule Standards - Final Rule" under Security Rule History. It's a pain to read because it's written by the government, but it may have the info you need.