Administrative safeguards are the people-and-process half of the HIPAA Security Rule, set out at 45 CFR §164.308. Where technical safeguards govern technology, these govern the human organization around it: conducting the security risk analysis and a corresponding risk-management plan, designating a security official who is responsible for the program, authorizing and supervising workforce access to electronic protected health information (ePHI), training staff on security, managing access as people join and leave, establishing procedures to detect and respond to security incidents, and maintaining contingency plans such as data backup and disaster recovery.
They matter disproportionately because audits and breach investigations fail here more often than in the cryptography. The recurring findings are mundane and organizational: no documented workforce training, no sanction policy for violations, access reviews that have gone stale so former employees or unneeded permissions linger, and no real incident-response runbook. These are failures of process discipline rather than of engineering sophistication, which is precisely why they are so common — they require sustained attention rather than a one-time technical build.
For an early-stage telemedicine company the encouraging news is that administrative safeguards are largely a checklist you can complete early and cheaply, before you have a large team or complex systems. Appoint the security official, write the policies, run and record the training, set a cadence for access reviews, and document an incident procedure. The common mistake is deferring all of this as 'paperwork' until a customer's security questionnaire or an investigation forces it — at which point you are reconstructing months of missing records under pressure instead of accumulating them as you go.
The handbook · 7 volumes
Fora Soft Video Engineering Handbook
Administrative safeguards only work when the risk analysis reflects how the video system really handles PHI. Our seven-volume handbook covers the whole video stack, and for teams writing administrative safeguards Volume 7 is the place to start: production AI pipelines, serving, cost and compliance. Volume 3 covers WebRTC calls and DRM, and Volume 1 the encoding of what gets recorded. Written by Nikolay Sapunov, CEO at Fora Soft.
Need a HIPAA risk analysis that reflects how your video platform really works?
We will walk through your video architecture and give you the technical input for administrative safeguards: data flow map, risk list and remediation plan. 250+ video products shipped since 2005.
