Pulse

Framework template

HIPAA

The US federal law that protects patient health information. HIPAA sets national standards for the privacy and security of protected health information held by covered entities and their business associates.

Request a walkthroughAll framework templates
Compliance Studio · framework controlsHIPAA · v2024

Bundled template

HIPAA Security Rule

52 controls · 3 categories

ControlCategory
164.308(a)(1)Security Management ProcessAdministrative
164.308(a)(1)(i)Risk AnalysisAdministrative
164.308(a)(1)(ii)(A)Risk ManagementAdministrative
164.308(a)(1)(ii)(B)Sanction PolicyAdministrative
164.308(a)(1)(ii)(C)Information System Activity ReviewAdministrative
164.308(a)(2)Assigned Security ResponsibilityAdministrative
164.308(a)(3)Workforce SecurityAdministrative
164.308(a)(3)(ii)(A)Authorization and/or SupervisionAdministrative
and 44 more
Ships in the catalogue; imports in one step8 of 52 controls

Health Insurance Portability and Accountability Act

In practice

Compliance spans the Privacy Rule, the Security Rule and the Breach Notification Rule. The Security Rule asks for administrative, physical and technical safeguards for electronic protected health information, and for the documentation that shows they are in place.

Requirements

What HIPAA asks of you.

  1. 01

    Administrative safeguards

    Security management, workforce security, information access management, awareness training and contingency planning.

  2. 02

    Physical safeguards

    Facility access, workstation security, and device and media controls for systems holding protected health information.

  3. 03

    Technical safeguards

    Access control, audit controls, integrity controls and transmission security for electronic protected health information.

  4. 04

    Breach notification

    Notification of affected individuals, the regulator and, above a threshold, the media when unsecured protected health information is breached.

How the Desk helps

The HIPAA programme, run on the Compliance Desk.

Each step below is shipped: the template import in Compliance Studio, and workflows that run over the documents you choose, record their sources and hold for approval before export.

The safeguards as controls

Import the HIPAA safeguard set from the template and record the status and owner of each safeguard.

Policies and business associate agreements, reviewed

Run Review controls over your policies and your business associate agreements. The run records every document it read; a control memo names the safeguards with gaps.

Evidence for the compliance file

Evidence sits on each safeguard with its status. Find missing evidence and Prepare audit checklist run over the evidence documents you select, with every source on record.

Other templates

SOC 2ISO 27001GDPRPCI DSSSector regulatorNIS2CIS Controls

Next step

Start from the HIPAA template on your own files.

Bring the policies you have and the last audit's request list. We will import the template, run the workflows with you and hand back the controls, the evidence on file and each run's sources.

Request a 30-minute walkthroughView pricing

Security

GDPR and CCPA compliant, ISO 27001 aligned, SOC 2 Type II in progress. Encrypted at rest and in transit. Your data never trains a model.

Security page