HIPAA (Privacy, Security and Breach Notification Rules): cited answers and gap reviews

HIPAA protects patient health information in the United States. Compliance Colleague answers Privacy, Security and Breach Notification Rule questions with the section cited, and reviews policies, risk assessments and business associate agreements.

What it covers

• Security Rule administrative, physical and technical safeguards
• Privacy Rule uses and disclosures of PHI
• Breach Notification Rule and the four-factor risk assessment
• Business associate agreements
• Technical safeguards for health software: encryption, access control, audit logs

Questions you can ask

• “Is a cloud provider that stores only encrypted ePHI a business associate?”
• “How quickly must we notify individuals after discovering a breach of unsecured PHI?”
• “What does a Security Rule risk analysis need to cover?”

Every answer cites the HIPAA requirement, article or control it rests on, so you can check it in seconds.

What you can upload for review

• A business associate agreement checked against the required terms
• Your security risk analysis checked for missing safeguards
• An ePHI data-flow diagram checked for unprotected transmissions

Files: PDF, Word, Excel or CSV, Visio (.vsdx), draw.io, or an image such as a screenshot. Choose a full review, a prioritized fix list (each gap with its fix and the evidence an assessor will expect) or a short summary, and download the result as Word or PDF.

Crosswalk HIPAA to other standards

With HIPAA in your plan you can compare it against any standard in the library and see where they align and exactly where they don’t. Common pairings:

• HIPAA to SOC 2
• HIPAA to NIST CSF
• HIPAA to ISO 27001

Example answers

• Is a SaaS vendor that stores encrypted ePHI and never views it a HIPAA business associate?

What it’s built from

Compliance Colleague carries the official text and checks its answers against it: 45 CFR Part 160: General Administrative Requirements (HIPAA) (US Department of Health and Human Services (via eCFR)); 45 CFR Part 164: Security and Privacy (HIPAA Security, Breach Notification and Privacy Rules) (US Department of Health and Human Services (via eCFR)).

Re-checked every month for new versions, deadlines and penalty changes. Full list on the sources page.

More United States standards

NIST CSF · NIST SP 800-53 · NIST AI RMF · FedRAMP · CMMC 2.0 · CCPA / CPRA · ITAR · EAR · TSA Security Directives · Section 508

Research aid, not legal or audit advice, and not an audit opinion or certification. Verify findings against the official text before relying on them.