Skip to main content
govconCyber — Federal Cybersecurity Law Reference
Browse requirements
X-CUI-HEALTH Informational

Protect Health Information CUI

Official citation: HIPAA (45 CFR 160 & 164)

Class: informational · Severity: medium

Requirement text

HIPAA (45 CFR 160 & 164)

What it means

Health information held in connection with federal work is CUI and is also governed by HIPAA when it is protected health information. 45 CFR Parts 160 and 164 impose privacy and security rules, including breach notification. Where both apply, satisfy HIPAA and the CUI baseline.

Required by

  • — HIPAA (45 CFR 160 & 164)
  • — HIPAA (45 CFR 160 & 164)

Educational reference only — not legal advice. Consult a qualified assessor or attorney for binding compliance determinations.