Skip to main content
HIPAA Path
Category: Regulatory Framework

Confidentiality, Integrity, and Availability (CIA)

Also known as: CIA, CIA Triad, CIA Model, Security Triad
Simply put

The CIA triad describes the three core goals of information security: confidentiality (keeping information from unauthorized access), integrity (keeping data accurate, complete, and unaltered), and availability (ensuring information and systems are accessible when needed). It is a foundational model used to guide security policies and protect data. In a HIPAA context, these three goals are commonly used as a framework for thinking about how to protect health information.

Formal definition

The CIA triad is a foundational information security model composed of three pillars: confidentiality, the protection of information from unauthorized access or disclosure; integrity, the assurance that data are trustworthy, complete, and have not been improperly altered; and availability, the assurance that information and systems are accessible and usable when needed. The model forms a basis for developing and evaluating security policies, controls, and safeguards. Note that the CIA triad is a general information security concept rather than a HIPAA-defined term; the HIPAA Security Rule separately requires covered entities and business associates to ensure the confidentiality, integrity, and availability of electronic protected health information (ePHI), but readers should consult the current regulatory text for HIPAA's specific obligations, and be aware the Security Rule addresses only ePHI while other information may fall outside its scope.

Why it matters

The CIA triad gives security and compliance professionals a shared vocabulary for reasoning about what they are actually protecting. Rather than treating security as a vague goal, the triad breaks it into three distinct objectives, confidentiality (preventing unauthorized access), integrity (keeping data accurate and unaltered), and availability (ensuring systems and information are usable when needed). This framing helps teams recognize that a strong control in one area does not necessarily satisfy the others; a system that keeps data perfectly confidential but becomes unavailable during an outage, or one that stays online but allows records to be silently altered, has failed a core security goal.

In a HIPAA context, these three concepts are especially useful because the HIPAA Security Rule itself requires covered entities and business associates to ensure the confidentiality, integrity, and availability of electronic protected health information (ePHI). The triad therefore serves as a practical mental model for organizing safeguards and risk analysis around health data. It is important to keep the distinction clear, however: the CIA triad is a general information security concept, not a HIPAA-defined term. Applying the triad does not by itself establish HIPAA compliance, and readers should consult the current regulatory text for the Security Rule's specific obligations.

The triad also helps surface scope limitations that matter for compliance. The HIPAA Security Rule addresses only ePHI, so information outside that definition, as well as PHI in oral or paper form governed by the Privacy Rule, may fall outside the Security Rule's reach even though the same CIA principles could still apply as good practice. Using the triad as an analytical lens can help organizations avoid gaps, but it should be paired with a clear understanding of which regulatory rule and which information categories are in play.

Who it's relevant to

Security Officers
HIPAA Security Officers can use the CIA triad to organize safeguards and risk analysis around the three goals the Security Rule requires for ePHI. It helps ensure that controls address confidentiality, integrity, and availability together rather than emphasizing one at the expense of the others, though it does not replace the specific obligations in the current regulatory text.
Privacy Officers
Privacy Officers benefit from the triad as a conceptual model, but should note that the CIA triad and the HIPAA Security Rule address ePHI, whereas the Privacy Rule covers PHI in all forms including oral and paper. The confidentiality principle overlaps with privacy concerns, but the triad is not a substitute for Privacy Rule requirements.
IT and Systems Professionals
IT teams implementing and maintaining systems use the triad to evaluate whether technical measures protect data from unauthorized access, preserve its accuracy, and keep systems accessible when needed. It provides a common language for weighing trade-offs among the three goals during system design and incident response.
Auditors and Compliance Professionals
Auditors can use the triad as a framework for reasoning about whether an organization's security posture addresses all three core objectives. Because the triad is a general information security concept and not a HIPAA-defined term, findings should be tied back to the applicable regulatory requirements rather than to the triad alone.
Business Associates and Subcontractors
Business associates and subcontractors that handle ePHI on behalf of covered entities are also subject to Security Rule obligations to protect the confidentiality, integrity, and availability of that data, with obligations flowing through business associate agreements. The triad offers a straightforward way to frame those protective goals across the relationships defined by HIPAA.

Inside CIA

Confidentiality
The principle that ePHI is not made available or disclosed to unauthorized persons or processes. Within the HIPAA Security Rule, confidentiality is one of the three core protection goals applied specifically to electronic protected health information, and it is supported through administrative, physical, and technical safeguards such as access controls, workforce authorization, and encryption where reasonable and appropriate.
Integrity
The principle that ePHI is not altered or destroyed in an unauthorized manner. The Security Rule generally expects covered entities and business associates to protect data from improper modification, which may involve mechanisms to authenticate ePHI and detect unauthorized changes.
Availability
The principle that ePHI is accessible and usable on demand by an authorized person. Availability is typically supported through contingency planning, data backup, disaster recovery, and emergency access measures so that authorized users can reach needed information when required.
Scope within the Security Rule
The CIA triad in the HIPAA context applies to electronic protected health information (ePHI) only, because it is a foundational objective of the Security Rule. The Privacy Rule, by contrast, governs PHI in all forms including oral and paper, so CIA as a Security Rule concept does not cover those non-electronic forms.
Relationship to safeguard categories
Confidentiality, integrity, and availability are advanced through the Security Rule's administrative, physical, and technical safeguards, which contain both required and addressable implementation specifications. Addressable does not mean optional; it generally means an entity must assess whether the specification is reasonable and appropriate and, if not, implement an equivalent alternative or document why none is needed.

Common questions

Answers to the questions practitioners most commonly ask about CIA.

Does the HIPAA Security Rule's focus on confidentiality, integrity, and availability apply to protected health information in all forms?
No. The CIA triad as expressed in the HIPAA Security Rule applies specifically to electronic protected health information (ePHI), not to PHI in all forms. The Security Rule governs only ePHI, requiring covered entities and business associates to protect its confidentiality, integrity, and availability. PHI in oral or paper form is addressed under the HIPAA Privacy Rule rather than the Security Rule's CIA requirements. Readers should verify the applicable scope against the current regulatory text.
Is the 'availability' element of CIA just about backups, meaning integrity and confidentiality are the only parts that really matter for security?
That is a common misconception. Availability is a distinct and equally weighted component of the triad, generally referring to ePHI being accessible and usable on demand by authorized persons. It is not merely a backup consideration; it encompasses measures that keep ePHI accessible when needed, alongside confidentiality (limiting access to authorized parties) and integrity (protecting ePHI from improper alteration or destruction). Treating any one element as secondary can leave gaps relative to the Security Rule's expectations.
How do the CIA principles map to the Security Rule's safeguard categories?
The confidentiality, integrity, and availability of ePHI are generally supported through a combination of administrative, physical, and technical safeguards rather than by any single category. For example, technical controls may support all three, while administrative and physical safeguards reinforce them through policies, workforce practices, and facility protections. Because implementation specifications may be labeled required or addressable, organizations typically address CIA through several safeguards working together. Consult the current regulatory text to confirm which specifications apply.
Does 'addressable' mean an organization can skip a safeguard that supports CIA?
No. Addressable does not mean optional. For addressable implementation specifications, a covered entity or business associate generally must assess whether the specification is reasonable and appropriate in its environment, and then either implement it, implement an equivalent alternative measure, or document why it is not reasonable and appropriate. This applies to safeguards supporting confidentiality, integrity, and availability. Readers should verify the specific treatment against current guidance.
How does an organization typically identify risks to the CIA of ePHI?
Risks to confidentiality, integrity, and availability are generally identified through a risk analysis that evaluates potential threats and vulnerabilities to ePHI across an organization's systems. This process typically informs which safeguards are reasonable and appropriate to implement. Because environments differ, the specific measures chosen vary by organization. Organizations should confirm expectations against the current Security Rule requirements and applicable HHS OCR guidance.
Does achieving HITRUST CSF certification demonstrate that an organization has met the CIA requirements of the HIPAA Security Rule?
Not by itself. HITRUST is a private organization and the HITRUST CSF is a certifiable control framework that may help an organization structure controls supporting confidentiality, integrity, and availability. However, HITRUST certification is not a legal requirement and does not by itself establish HIPAA compliance. Organizations remain responsible for meeting the Security Rule's obligations as enforced by HHS OCR. Any mapping between the CSF and Security Rule expectations should be verified against the current HITRUST CSF version and current regulatory guidance.

Common misconceptions

The CIA triad under HIPAA applies to all protected health information regardless of form.
As a Security Rule objective, CIA applies specifically to ePHI. Protections for PHI in oral or paper form fall under the Privacy Rule rather than the Security Rule's confidentiality, integrity, and availability requirements.
Achieving confidentiality, integrity, and availability guarantees HIPAA compliance or prevents all breaches.
The CIA triad describes protection goals, not a compliance guarantee. No single measure or framework ensures compliance or prevents every breach; entities must still perform risk analysis, apply reasonable and appropriate safeguards, and meet the broader obligations of the applicable rules.
Meeting CIA objectives through a framework like the HITRUST CSF establishes HIPAA compliance.
HITRUST is a private organization and its CSF is a certifiable control framework, not a legal requirement. Certification may help demonstrate that CIA-related controls are in place, but it does not by itself establish HIPAA compliance, which is enforced by HHS OCR.

Best practices

Conduct and maintain a risk analysis that evaluates threats to the confidentiality, integrity, and availability of ePHI, and use it to drive reasonable and appropriate safeguard decisions.
Apply access controls and workforce authorization to support confidentiality, ensuring ePHI is available only to those with a legitimate need.
Implement mechanisms to protect ePHI from unauthorized alteration or destruction, and to detect improper modification where reasonable and appropriate.
Establish contingency planning, data backup, and emergency access procedures to preserve availability of ePHI when needed by authorized users.
Treat addressable implementation specifications as requiring assessment rather than being optional; document decisions and any equivalent alternative measures adopted.
Verify specific requirements, penalty details, and any framework version references against the current regulatory text and the current HITRUST CSF version, and account for additional obligations that state law or HITECH may impose.