45 CFR, the sections practices actually look up
Each page quotes the regulation verbatim, then answers the question the regulation does not: which document this section obliges you to have on file. eCFR is authoritative for the text and linked from every page.
Researched and written by Larry Osakwe · Last verified August 4, 2026
Not a lawyer, not a certified compliance professional, and not affiliated with HHS.
45 CFR § 160.103
Definitions
The definitions section. It decides whether HIPAA applies to you at all.
2 obligations mapped to documents
45 CFR § 164.504(e)
Uses and disclosures: Organizational requirements
The section that says what a Business Associate Agreement must actually contain.
2 obligations mapped to documents
45 CFR § 164.520
Notice of privacy practices for protected health information
The Notice of Privacy Practices rule, including the exact header it must carry.
3 obligations mapped to documents
45 CFR § 164.308
Administrative safeguards
The Security Rule section that requires a risk analysis, and the most-cited deficiency in OCR enforcement.
3 obligations mapped to documents
45 CFR § 164.508
Uses and disclosures for which an authorization is required
When you need written authorization, and the separate rule for psychotherapy notes.
2 obligations mapped to documents
Why these pages exist
If you searched a section number and landed here, you probably wanted the text. eCFR has that, it is free, and it is authoritative, so every page here links straight to it.
What eCFR cannot tell you is which document the section obliges you to hold, because that is not the regulation’s job. 164.308 requires an accurate and thorough risk assessment; it does not say “so you need a written Security Risk Analysis naming every system that touches ePHI.” That translation is what these pages add, and it is the part practices get wrong.
We build the documents, so treat the mapping as informed but interested. The regulation controls, and where our reading and the text differ, the text wins.
Get every document, done for you
Preview the binder free. Your binder is built to order and delivered within 30 days, with a full refund anytime before then.
See the binder and pricing