hipaa-compliance

HIPAA compliance review involves mapping your system against the Security Rule's administrative, physical, and technical safeguards in 45 CFR §164.308-312. Key checks include unique user IDs, audit logging, encryption at rest and in transit, risk analysis documentation, and signed BAAs with all vendors handling ePHI.

Covered entities must maintain a Notice of Privacy Practices, written privacy policies, workforce training records, and Business Associate Agreements with any vendor handling PHI. Security Rule documentation including risk analyses must be retained for six years.

Encryption is classified as addressable, not required, meaning you must implement it or document why an equivalent alternative is reasonable. In practice, AES-256 at rest and TLS 1.2+ in transit are the industry standard, and encrypted PHI qualifies for breach notification safe harbor.

Breaches affecting 500 or more individuals must be reported to HHS within 60 days of discovery, along with individual and media notification. Breaches affecting fewer than 500 individuals are logged and reported annually within 60 days after the calendar year ends.

No. Cloud providers offer HIPAA-eligible services and will sign a BAA, but compliance responsibility remains with you. You must configure access controls, encryption, audit logging, and network security correctly, and conduct your own risk analysis.