Published:

2025-08-06

Updated:

2026-11-11

NIST CSF and HIPAA: Crosswalk Explained

How the NIST CSF maps to the HIPAA Security Rule: the HHS crosswalk, sample rows with citations, the 2025 rule proposal, and Censinet benchmark data on where coverage is lowest.

What is the NIST CSF and HIPAA crosswalk, and what is it used for?

A crosswalk is a mapping that lines up the NIST Cybersecurity Framework (CSF) with the HIPAA Security Rule so a team can see which framework activity supports which HIPAA requirement. The two do different jobs. The CSF is a voluntary framework of cybersecurity outcomes, and the Security Rule is the federal regulation that requires safeguards for electronic protected health information (ePHI). The Office for Civil Rights built the best-known crosswalk with NIST and the Office of the National Coordinator for Health IT, and it exists to help organizations that follow one framework find gaps against the other. The crosswalk is an informative reference and does not guarantee compliance, and the Security Rule does not require anyone to adopt the CSF. A team that treats it as a map between two documents, and not as a substitute for the regulation, gets the value without taking on false assurance about its HIPAA status.

How current is the HHS crosswalk, and how does it fit with CSF 2.0?

The HHS crosswalk is from February 2016, and it uses the numbering of the first CSF versions, such as ID.AM-1. “The crosswalk is also dated.” NIST released CSF 2.0 on February 26, 2024 with six functions, adding Govern alongside Identify, Protect, Detect, Respond, and Recover, and it moved governance activities that used to sit inside Identify into that new function. NIST says it removed nothing from version 1.1. For newer mappings, the 2024 NIST resource guide for the Security Rule points to mappings from Security Rule standards to CSF subcategories in NIST’s reference tool. A team should read the HHS crosswalk as a reliable guide to which HIPAA citations relate to which outcomes, then check the current CSF 2.0 identifiers before putting any row into a report or a control library, and label which numbering each row uses so the table stays readable for the next reviewer.

How does a healthcare organization use the crosswalk to find gaps?

“A crosswalk is most useful as a gap tool.” The method starts with a Current Profile, which records where the organization stands against the CSF outcomes, and a Target Profile, which records where it wants to be. The team then reads across each CSF row to the HIPAA citation beside it and asks whether the evidence it holds satisfies that requirement and whether the requirement stops short of what the Target Profile expects. The first answer exposes compliance gaps and the second exposes security gaps that the regulation does not demand. Because HHS says covered entities and business associates cannot rely entirely on the crosswalk for compliance, the Security Rule text stays the final reference for every row. Record the evidence beside each row, since the evidence is what an auditor or a board will ask to see.

Which HIPAA Security Rule requirements show up most often when a team maps to the CSF?

Two requirements appear in nearly every review: the accurate and thorough risk analysis and the assigned security official. Both map to the front of the framework. The risk analysis ties to the inventory and data flow rows in Identify, and security responsibility ties to the governance rows, which CSF 2.0 now places in Govern. Vendors enter through the external systems row, which leads to the business associate provisions. HIPAA Journal counted 118 of the 741 breaches of 500 or more records reported to OCR in 2024 as filed by business associates, which is a reason to include the vendor rows in the first pass and not the last. A first pass that covers these three clusters leaves the physical and technical safeguard rows for the second pass, when the inventory exists and the team knows which systems hold ePHI.

What would the proposed 2025 HIPAA Security Rule changes mean for a crosswalk?

HHS published a notice of proposed rulemaking in January 2025 to modify the Security Rule, and Compliancy Group’s tracker, updated September 20, 2026, still lists it as proposed and not final. “Until HHS finalizes a rule, the current Security Rule is the requirement, and the proposal is a signal of the direction.” The proposal’s own text says resources such as the CSF were helpful but not sufficiently instructive for regulated entities, so it does not adopt the CSF as a standard, and a crosswalk stays an informative tool either way. Teams can use the proposal as a planning input: its inventory and encryption items match outcomes in the Identify and Protect functions, so a Current Profile built now shortens the work if a final rule arrives. Confirm the status on HHS or Federal Register pages before relying on any of it.

What do Censinet benchmark data add to crosswalk work?

Censinet and KLAS Research benchmark data give crosswalk work a coverage baseline. In the 2025 study, average coverage across the six CSF 2.0 functions was 72% across 69 organizations, and Govern and Identify tied for lowest at 64%. Those are the two functions behind the risk analysis and security responsibility rows of the crosswalk. The scores are self-reported averages, so they show where coverage is thinner and do not test Security Rule compliance. The study measures one framework, and a team still has to supply the HIPAA evidence for each row. “A spreadsheet can hold a crosswalk, but it cannot keep the evidence behind each row current.” Tools earn their place where evidence changes often, such as the vendor inventory and the findings tied to each vendor, and a person should still decide what counts as satisfying a row.

The NIST Cybersecurity Framework (CSF) and the HIPAA Security Rule fit together because they answer different questions. The CSF is a voluntary framework of cybersecurity outcomes, and the Security Rule is the federal regulation that requires safeguards for electronic protected health information (ePHI). A crosswalk lines the two up, so a team can see which CSF activity supports which HIPAA requirement and where evidence is missing. HHS's Office for Civil Rights (OCR) published the main one in February 2016 [1][2], and NIST released CSF 2.0 in February 2024 with six functions, including the new Govern function [3]. Using the CSF does not guarantee HIPAA compliance, and HHS says covered entities and business associates cannot rely entirely on the crosswalk for compliance [1][2].

The table below compares the two frameworks. The sections after it explain how the crosswalk is built, show sample rows with their HIPAA citations, cover the January 2025 proposal to change the Security Rule, and add Censinet benchmark data on where coverage is lowest.

NIST CSF 2.0 and the HIPAA Security Rule compared
Feature	NIST CSF 2.0	HIPAA Security Rule
What it is	A framework of cybersecurity outcomes, released February 26, 2024 [3]	A federal regulation on safeguards for ePHI [5]
Use	Adopted voluntarily; written for organizations of any size and sector [3][4]	Required of covered entities and business associates [5]
Structure	Six functions: Govern, Identify, Protect, Detect, Respond, Recover [3]	Administrative, physical, and technical safeguards, with required and addressable specifications [5]
Scope	Cybersecurity risk management for any organization [3]	Electronic protected health information only [5]
Flexibility	Flexible; organizations tailor it with Current and Target Profiles [3]	Scalable and technology neutral; entities weigh size, cost, and risk [5]
Effect on compliance	Using it does not guarantee HIPAA compliance [1][2]	The Security Rule governs; the 2025 proposal to change it was still not final in the latest tracker reviewed [5][8]

How NIST CSF Maps to HIPAA Requirements

What the HHS Crosswalk Is

OCR developed the crosswalk with NIST and the Office of the National Coordinator for Health IT (ONC). It maps the NIST Cybersecurity Framework to the HIPAA Security Rule, and the mappings help organizations that already follow one framework find gaps against the other [1]. It is a multi-page table with four columns, Function, Category, Subcategory, and Relevant Control Mappings, where the HIPAA citations sit beside references to other frameworks [2]. It is an informative reference and does not imply or guarantee compliance with any law or regulation [2]. The Security Rule does not require covered entities to adopt the CSF [1][2].

The crosswalk is also dated. It is from February 2016 and uses the CSF 1.x numbering, such as ID.AM-1 [2]. CSF 2.0 moved governance activities, which sat inside Identify, into the new Govern function, its subcategory identifiers have intentional gaps, and NIST says nothing was removed from version 1.1 [4]. NIST's 2024 resource guide for the Security Rule, SP 800-66 Rev 2, points to a newer set of mappings from Security Rule standards to CSF subcategories in NIST's Cybersecurity and Privacy Reference Tool [6].

NIST CSF Functions and HIPAA Safeguards Alignment

The Security Rule groups its standards into administrative, physical, and technical safeguards [5]. The table below pairs each CSF 2.0 function with the Security Rule standards that HHS lists for the same job. It is a reading aid built from the CSF function descriptions and the HHS Security Rule summary. The HHS crosswalk itself maps one subcategory at a time, as the next table shows.

CSF 2.0 functions beside related Security Rule standards
Function	What CSF 2.0 says the function does [3]	Related Security Rule standards listed by HHS [5]
Govern	Cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored	Assigned security responsibility (164.308(a)(2)); evaluation (164.308(a)(8))
Identify	Current cybersecurity risks are understood	Security management process, including risk analysis (164.308(a)(1)(ii)(A))
Protect	Safeguards to manage cybersecurity risks are used	Access control, authentication, and transmission security; facility access and device and media controls
Detect	Attacks and compromises are found and analyzed	Audit controls; regular review of activity records (164.308(a)(1)(ii)(D))
Respond	Actions are taken on a detected incident	Security incident procedures
Recover	Affected assets and operations are restored	Contingency planning

Sample Crosswalk Rows

The rows below come from the Identify function of the HHS crosswalk, with the HIPAA citations as printed there [2]. Citation 164.308(a)(1)(ii)(A) is the risk analysis requirement, 164.308(a)(2) is assigned security responsibility, and 164.308(b) covers business associates [5].

Gap Analysis and Compliance Enhancement

A crosswalk is most useful as a gap tool. CSF 2.0 describes Organizational Profiles, a Current Profile for where an organization stands and a Target Profile for where it wants to be, and Tiers as an optional way to describe the rigor of governance and risk management practices [3]. A team can build a Current Profile, then read across each CSF row to the HIPAA citation beside it and ask two questions. Does the evidence we hold satisfy the HIPAA requirement? Does the HIPAA requirement stop short of what our CSF Target Profile expects? The first question finds compliance gaps, and the second finds security gaps that the regulation does not demand. Because HHS says the crosswalk cannot be the sole basis for compliance, keep the Security Rule text itself as the final reference [1][2].

1. NIST Cybersecurity Framework (CSF)

Structure and Components

CSF 2.0 has six functions. Govern establishes, communicates, and monitors cybersecurity risk management strategy, expectations, and policy. Identify builds an understanding of current cybersecurity risks. Protect uses safeguards to manage them. Detect finds and analyzes attacks and compromises. Respond takes action on a detected incident. Recover restores affected assets and operations [3]. NIST describes the framework as flexible and written for organizations of any size, and it can be adopted voluntarily [3].

Compliance Support

The CSF does not replace HIPAA compliance. Its value for HIPAA work is structure: the Current Profile and Target Profile give a team a way to describe where it stands and what comes next, and the informative references let it trace each outcome to the standards that cover it [3]. NIST publishes these references in an online catalog, and a CSF 1.1 to 2.0 crosswalk is itself an informative reference [4].

Implementation Challenges

The CSF leaves choices to the organization, which is its strength and its cost for smaller providers: someone has to decide which outcomes matter and how to evidence them. Censinet benchmark data show where that work is thinnest, covered in the benchmark section below.

2. HIPAA Security Rule

Structure and Components

The Security Rule applies to covered entities, which are health plans, health care clearinghouses, and providers that transmit health information electronically in standard transactions, and to their business associates. It covers ePHI only [5]. Administrative safeguards include the security management process (risk analysis and risk management), assigned security responsibility, workforce security, security incident procedures, and contingency planning. Physical safeguards cover facility access, workstation use, and device and media controls. Technical safeguards cover access control, audit controls, integrity, authentication, and transmission security [5].

Every standard must be met, but some implementation specifications are required and some are addressable. Addressable does not mean optional: the entity decides whether the specification is reasonable and appropriate, and if it is not, documents why and adopts an alternative that serves the same purpose [5]. The rule is scalable and technology neutral, so entities weigh size, complexity, cost, and the probability and criticality of risks [5].

Compliance Support

Two Security Rule requirements show up in nearly every crosswalk exercise. The first is the accurate and thorough risk analysis in 164.308(a)(1)(ii)(A), followed by risk management that reduces risks to a reasonable and appropriate level [5]. The second is assigned security responsibility: a named security official responsible for developing and implementing the required policies and procedures [5]. In the CSF these correspond to the Identify and Govern functions, and in CSF 2.0 the roles, responsibilities, and authorities for cybersecurity sit in Govern [3][4].

What the 2025 Proposal Would Change

In January 2025, HHS published a notice of proposed rulemaking, "HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information," with comments due March 7, 2025 [7]. It proposes encryption of ePHI with limited exceptions in place of the current case-by-case assessment, a technology asset inventory and a map of how ePHI moves through systems as part of the risk analysis, and a compliance date 180 days after the final rule takes effect [7]. Compliancy Group's tracker lists further proposals, including removing the addressable category, multi-factor authentication, network segmentation, vulnerability scans at least every six months, and penetration testing at least every 12 months [8]. As of that tracker's September 20, 2026 update, the rule was still proposed and not final [8]. Until HHS finalizes a rule, the current Security Rule is the requirement, and the proposal is a signal of the direction. The proposal's own text says resources such as the NIST Cybersecurity Framework were helpful but not sufficiently instructive for regulated entities, so the proposal does not adopt the CSF as a standard [7].

Implementation Challenges

Business associates are where the Security Rule's reach gets hard to manage. A covered entity can let a business associate handle ePHI only after obtaining satisfactory assurances, documented in a business associate agreement, and the HITECH Act made business associates directly subject to Security Rule penalties [5]. HIPAA Journal counted 118 of the 741 breaches of 500 or more records reported to OCR in 2024 as filed by business associates [10].

What the Benchmark Data Show About Coverage

Censinet and KLAS Research measure how healthcare organizations cover the CSF. In the 2025 Healthcare Cybersecurity Benchmarking Study, average coverage across the six CSF 2.0 functions was 72% across 69 organizations. Respond scored highest at 85%, followed by Recover at 78%, Detect at 74%, and Protect at 69%, while Govern and Identify tied for lowest [9].

CSF 2.0 function coverage, 2025 benchmarking study
CSF 2.0 function	Average coverage (n=69)
Govern	64%
Identify	64%
Protect	69%
Detect	74%
Respond	85%
Recover	78%
Average across functions	72%

The two lowest functions line up with the crosswalk rows above. Govern holds the roles and policy rows that lead to assigned security responsibility, and Identify holds the inventory and data flow rows that lead to the risk analysis. Within the study, Supply Chain Risk Management scored 52% and Asset Management scored 53%, the two lowest-covered categories [9]. These are the categories that the external systems and asset rows in the HHS crosswalk depend on. The scores are self-reported averages, so they show where coverage is thinner and do not test compliance with the Security Rule.

Using Technology for Crosswalk Implementation

A spreadsheet can hold a crosswalk, but it cannot keep the evidence behind each row current. Where the crosswalk touches vendors, Censinet's third-party risk capability keeps a centralized vendor and product inventory, adds automated rapid inherent risk scoring, sends breach and ransomware notifications focused on the vendors in your inventory, and routes events through an incident review workflow into a Risk Register and a remediation workflow, with people making every final risk decision [11]. Its workflow also automates corrective action plans, tracks remediation progress, and keeps an audit-ready history [11]. For the crosswalk, that supports the external systems and business associate rows: the inventory answers which vendors handle ePHI, and the Risk Register and remediation history give a team evidence to point to.

Conclusion

Key points

The CSF is a voluntary framework and the HIPAA Security Rule is the regulation, and the HHS crosswalk lets a team trace each CSF outcome to the HIPAA citations it supports. The crosswalk is a 2016 informative reference that cannot be the sole basis for compliance. The January 2025 Security Rule proposal was still not final in the latest tracker reviewed. Censinet benchmark data show the Govern and Identify functions with the lowest coverage, which are the functions behind the risk analysis and security responsibility rows.

Next steps

Build a Current Profile for one system that holds ePHI, read each row across to its HIPAA citation, and record the evidence you hold. Then list the vendors that handle that system's ePHI and confirm each has a business associate agreement.

References

U.S. Department of Health and Human Services, Office for Civil Rights. Addressing Gaps in Cybersecurity: OCR Releases Crosswalk Between HIPAA Security Rule and NIST Cybersecurity Framework (published February 24, 2016). https://www.hhs.gov/hipaa/for-professionals/security/nist-security-hipaa-crosswalk/index.html
U.S. Department of Health and Human Services, Office for Civil Rights. HIPAA Security Rule Crosswalk to NIST Cybersecurity Framework (February 2016). https://www.nist.gov/document/hipaa-security-rule-crosswalk
National Institute of Standards and Technology. The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 26, 2024). https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
National Institute of Standards and Technology. Cybersecurity Framework Frequently Asked Questions (updated August 13, 2026). https://www.nist.gov/cyberframework/faqs
U.S. Department of Health and Human Services. Summary of the HIPAA Security Rule (content last reviewed August 7, 2026). https://www.hhs.gov/ocr/privacy/hipaa/understanding/srsummary.html
National Institute of Standards and Technology. Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide, NIST SP 800-66 Rev. 2 (February 14, 2024). https://csrc.nist.gov/pubs/sp/800/66/r2/final
U.S. Department of Health and Human Services. HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, notice of proposed rulemaking, RIN 0945-AA22, Federal Register (January 6, 2025). https://govinfo.gov/content/pkg/FR-2025-01-06/pdf/2024-30983.pdf
Compliancy Group. The Proposed HIPAA Security Rule Update (page updated September 20, 2026). https://compliancy-group.com/proposed-hipaa-security-rule-update-2026/
KLAS Research and Censinet, with the American Hospital Association. Healthcare Cybersecurity Benchmarking Study 2025, Executive Summary (April 2025). https://censinet.com/2025-healthcare-cybersecurity-benchmarking-study-executive-summary
HIPAA Journal. Healthcare Data Breach Statistics, updated for 2026 (statistics updated October 15, 2026, from OCR data obtained October 10, 2026). https://www.hipaajournal.com/healthcare-data-breach-statistics/
Censinet. Third-Party Risk. https://censinet.com/capabilities/third-party-risk

What does each of the six CSF 2.0 functions do?

Govern: Cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored.
Identify: The organization’s current cybersecurity risks are understood.
Protect: Safeguards to manage cybersecurity risks are put in use.
Detect: Attacks and compromises are found and analyzed.
Respond: Actions are taken when a cybersecurity incident is detected.
Recover: Assets and operations affected by an incident are restored.

Which standards and specifications does the HIPAA Security Rule include under its three safeguard categories?

Administrative safeguards: Security management process, assigned security responsibility, workforce security, information access management, awareness and training, security incident procedures, contingency planning, evaluation, and business associate contracts.
Physical safeguards: Facility access and control, workstation use and security, and device and media controls.
Technical safeguards: Access control, audit controls, protection against improper alteration or destruction, authentication, and transmission security.
Required specifications: An entity must implement them.
Addressable specifications: The entity decides whether each is reasonable and appropriate, and if not, it documents why and adopts an alternative that serves the same purpose.
Scope: The rule covers ePHI only, not paper or spoken information.

Which HIPAA citations does the HHS crosswalk list for the asset and data flow rows ID.AM-1, ID.AM-3, and ID.AM-4?

ID.AM-1 devices and systems inventoried: 164.308(a)(1)(ii)(A), 164.310(a)(2)(ii), and 164.310(d).
ID.AM-3 communication and data flows mapped: 164.308(a)(1)(ii)(A), 164.308(a)(3)(ii)(A), 164.308(a)(8), and 164.310(d).
ID.AM-4 external systems catalogued, administrative citations: 164.308(a)(4)(ii)(A) and 164.308(b).
ID.AM-4 other citations: 164.314(a)(1), 164.314(a)(2)(i)(B), 164.314(a)(2)(ii), and 164.316(b)(2).
Shared citation: The risk analysis citation, 164.308(a)(1)(ii)(A), shows up in both ID.AM-1 and ID.AM-3.
Column layout: The crosswalk table uses columns for Function, Category, Subcategory, and Relevant Control Mappings.

Which HIPAA citations does the HHS crosswalk list for the governance rows ID.GV-1 and ID.GV-2?

ID.GV-1 wording: Organizational information security policy is established.
ID.GV-1 citations: 164.308(a)(1)(i) and 164.316.
ID.GV-2 wording: Information security roles and responsibilities are coordinated and aligned with internal roles and external partners.
ID.GV-2 workforce citations: 164.308(a)(1)(i), 164.308(a)(2), 164.308(a)(3), and 164.308(a)(4).
ID.GV-2 partner citations: 164.308(b) and 164.314.
Security official: Citation 164.308(a)(2) requires a named security official responsible for developing and implementing the required policies and procedures.

What do the 2025 benchmarking study scores show for the remaining CSF 2.0 functions and the two lowest categories?

Protect: Average coverage was 69% (n=69).
Detect: Average coverage was 74%.
Respond: Average coverage was 85%, the highest of the six functions.
Recover: Average coverage was 78%.
Asset Management: This category averaged 53%.
Supply Chain Risk Management: This category averaged 52%, the lowest-covered category.

What does the January 2025 HIPAA Security Rule proposal contain, and when did comments close?

Publication: The notice appeared in the Federal Register on January 6, 2025, under RIN 0945-AA22.
Comment deadline: Comments closed on March 7, 2025.
Encryption: The proposal would require encryption of ePHI with limited exceptions, replacing the case-by-case assessment.
Inventory: It would add a technology asset inventory and a map of how ePHI moves through systems to the risk analysis.
Timing: Compliance would be due 180 days after the effective date of a final rule.
Testing: Compliancy Group lists vulnerability scans at least every six months and penetration testing at least every 12 months.