HIPAA
US law protecting Protected Health Information (PHI) held by covered entities and business associates.
HIPAA's Security Rule requires administrative, physical, and technical safeguards for electronic PHI. The Privacy Rule governs use and disclosure. Business associates handling PHI on behalf of covered entities must sign a Business Associate Agreement (BAA).
There is no HIPAA certification. Compliance is demonstrated through documented safeguards, risk analysis, and evidence — and enforced by HHS OCR.
Determine whether the relationship is in scope
Health-related information alone does not answer whether HIPAA applies. Identify whether the organization is a covered entity or business associate and whether the information is protected health information in that relationship. A vendor contract or business associate agreement helps define responsibilities, but it does not replace operational safeguards.
Build a usable safeguard record
Map where electronic protected health information is stored and shared, who has access, and which providers support the workflow. Document the risk analysis, selected safeguards, staff responsibilities, and how incidents are escalated. Access reviews, training records, and vendor arrangements provide evidence beyond a policy’s existence.
Keep legal conclusions separate from readiness
A software checklist cannot certify HIPAA compliance or determine every breach-notification obligation. Follow current HHS guidance and obtain qualified advice for the specific facts. Use readiness work to find missing controls and evidence, not to declare that a business or product is automatically compliant.
See how Scarlet Risk covers HIPAA.
One platform for compliance, cyber, vendor, and world-watch risk.
Schedule Live Demo