HIPAA, with the risk analysis everything else hangs off
The Security Rule's administrative, physical and technical safeguards, adopted as a program with owners and dated evidence. The risk analysis is a living document rather than a PDF from three years ago, because it is the first thing the Office for Civil Rights asks to see.
- A risk analysis that stays current, with a date on it
- Administrative, physical and technical safeguards in one place
- Addressable specifications decided, not quietly skipped
- A signed BAA tracked against every vendor that holds PHI
HIPAA
Organization-wide · 1996 (updated) · 66 controls
HIPAA coverage
- Enforced by
- HHS Office for Civil Rights
- Structure
- Privacy, Security, Breach Notification
- Validated by
- Self-assessment; OCR on investigation
- Breach clock
- 60 days to notify individuals
01
Adopt it, don't rebuild it
The safeguards arrive mapped to common controls, so the access review and the encryption standard you already run for another framework answer here too. What is HIPAA-specific (the risk analysis, the BAAs, the workforce sanctions) is what is left to do.
02
Evidence with a date on it
An addressable specification you decided against is a documented decision with a date, not an absence. Training, reviews and restores expire on their own schedule, so what you can show OCR is current rather than historical.
03
What the assessor leaves with
An assessor, an acquirer's diligence team or your own counsel gets scoped read-only access to the program and its dates. Safeguard status and the evidence behind it export together.
What you adopt
HIPAA, in its own numbering
- §164.308Administrative safeguards
- §164.310Physical safeguards
- §164.312Technical safeguards
- §164.314Organizational requirements
- §164.316Policies and documentation
- PrivacyUse and disclosure of PHI
- BreachNotification rule
Each standard's implementation specifications are required or addressable — and an addressable one you decided against is a dated decision, not an absence.
What you show
What an assessor will ask to see
The risk analysis
164.308(a)(1)(ii)(A). Accurate, thorough, current, and the single most common finding when it is not.
Workforce access, granted and removed
164.308(a)(3) and (a)(4). Authorization on the way in, and termination procedures that actually ran on the way out.
Audit controls
164.312(b). Activity in systems holding ePHI recorded, and somebody reviewing what is recorded.
Encryption decisions
164.312(a)(2)(iv) and (e)(2). Addressable, so either implemented or documented as unreasonable with the alternative you chose.
Business associate agreements
164.308(b) and 164.504(e). A signed BAA with every vendor that touches PHI, and with their subcontractors downstream.
Contingency plan
164.308(a)(7). Backups, disaster recovery, emergency mode operation, and a restore you have actually performed.
How it runs
Step 1
Adopt HIPAA
Your organization gets its own copy of every control in HIPAA, already mapped to the common controls you may satisfy for something else.
Step 2
Scope it
Organization-wide, or against a product, region or business line. Controls you scope out carry the reason you scoped them out.
Step 3
Collect the evidence
Connect a system or upload a document. Each piece is read, matched to the control it proves, dated, and given an expiry.
Step 4
Prove it
Invite your assessor to these frameworks and these dates, and nothing else. They leave with safeguard status, the risk analysis, and the evidence behind both.
The standard
What HIPAA asks for
HIPAA reaches covered entities (health plans, clearinghouses and most providers) and the business associates that handle protected health information on their behalf. Three rules do the work: the Privacy Rule governs use and disclosure, the Security Rule governs electronic PHI, and the Breach Notification Rule governs what happens when it gets out.
The Security Rule's safeguards are administrative, physical and technical, and each standard's implementation specifications are either required or addressable. Addressable is the part that gets misread: it does not mean optional. It means implement it, or document why it is not reasonable and appropriate in your environment and what you did instead.
There is no HIPAA certificate and no auditor's opinion to hold up. What you have when OCR arrives (usually behind a complaint or a breach) is your risk analysis, the safeguards you put in place because of it, the training records, and the business associate agreements you signed. All of them with dates.
Questions
- Is there such a thing as HIPAA certification?
- No. HHS does not certify anyone and no third party can certify on its behalf, whatever a badge on a website implies. What exists is a demonstrable program: a current risk analysis, implemented safeguards, training, BAAs, and the records that show all of it was real.
- What does addressable actually require?
- A decision, documented. Assess whether the specification is reasonable and appropriate for your environment; implement it if it is; if it is not, write down why and implement an equivalent alternative where one exists. Doing nothing and recording nothing is the failure mode.
- Do we need BAAs from our vendors' vendors?
- Your business associates do, and you should know they have them. A business associate must have a written agreement with each subcontractor that creates, receives, maintains or transmits PHI on its behalf, which is why the vendor register and the BAA tracking sit in the same place here.
Provable today, not at audit time.
Run it yourself or have Bindsec run it for you. Either way, the evidence is current and the posture is one place.