HIPAA compliance
HIPAA applies to US health plans, health care clearinghouses and most health care providers, and to the business associates that handle protected health information for them. European companies meet it when they serve US health customers.
- HIPAA Privacy, Security and Breach Notification Rules
- 45 CFR Parts 160 and 164
- Requirements in the catalogue: 17
- Official text
What it requires
The main obligations in plain words, with the article or clause they come from.
-
§ 164.502–508
Use and disclose protected health information only as permitted, no more than necessary, and with authorization where required.
-
§ 164.504(e)
Sign a business associate agreement with every business associate.
-
§ 164.520–528
A notice of privacy practices, and the rights to access and amend information and to get an accounting of disclosures.
-
§ 164.308–312
Administrative, physical and technical safeguards, starting with a security risk analysis.
-
§ 164.404–410
Notify affected individuals, HHS and, for large breaches, the media; business associates notify the covered entity.
How Atitic covers it
What the product does for this framework, on the same records as every other.
-
The catalogue's requirements, with their 45 CFR Part 164 references, linked to policies and evidence.
-
Business associates in the vendor register with their review dates, and the agreement attached as evidence.
-
The ISO 27001 crosswalk to the Security Rule's safeguards.
What the catalogue holds
The areas of the framework in Atitic and how many requirements each holds. When you adopt it, each requirement becomes a row you own and link to policies, evidence and controls.
- Privacy Rule – uses and disclosures of PHI4
- Privacy Rule – individual rights4
- Security Rule – administrative safeguards3
- Security Rule – physical and technical safeguards3
- Breach Notification Rule3
Common questions
We are a European company. Why HIPAA?
If you handle protected health information for US health plans or providers, you are their business associate: the Security Rule and parts of the Privacy and Breach Notification Rules apply to you directly, the rest through your agreement.
When must a HIPAA breach be reported?
To the people affected without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people also go to HHS and the media within 60 days; smaller ones are reported to HHS once a year.
Does HIPAA replace the GDPR for health data?
No. For people in the EU the GDPR applies, and health data is a special category under it. Each law applies to its own data.
A summary for orientation, not legal advice. The official text is the reference.
Try it on your own data
Adopt HIPAA in a free trial, link the evidence you already have and see what is still missing.
Start a free trial