HIPAA Compliance Guide

Two categories: (1) Covered Entities — health plans, health care clearinghouses, and health care providers who transmit any health information electronically in connection with HIPAA-covered transactions; and (2) Business Associates — any vendor or subcontractor that creates, receives, maintains, or transmits Protected Health Information (PHI) on behalf of a covered entity. This includes EHR vendors, billing companies, cloud hosts, MSPs, AI scribe vendors, and even law firms handling PHI.

The Privacy Rule governs the use and disclosure of PHI in any form (paper, oral, electronic). The Security Rule applies specifically to electronic PHI (ePHI) and requires administrative, physical, and technical safeguards. Most cybersecurity work falls under the Security Rule, but the Privacy Rule still drives policies like minimum necessary use, individual rights, and authorization handling.

Three categories with roughly 50 specifications: Administrative Safeguards (security management process, workforce training, access management, contingency planning), Physical Safeguards (facility access, device & media controls, workstation use), and Technical Safeguards (access control, audit controls, integrity, person/entity authentication, transmission security). The 2025 NPRM proposes making many 'addressable' specifications mandatory and requiring MFA, encryption-by-default, network segmentation, and 24-month vulnerability scanning cycles.

HIPAA penalties are tiered by culpability and adjusted annually for inflation. For 2025, per-violation amounts range from approximately $141 (lack of knowledge) to $71,162 (willful neglect, not corrected). The annual cap per violation category is $1,919,173. Real settlements have ranged from tens of thousands to $16 million (Anthem, 2018). Beyond fines, OCR routinely imposes Corrective Action Plans (CAPs) lasting 1–3 years.

For breaches affecting 500 or more individuals: notify HHS, affected individuals, and the media without unreasonable delay and in any case within 60 calendar days of discovery. For breaches affecting fewer than 500 individuals: notify affected individuals within 60 days, and report to HHS in an annual log within 60 days of the end of the calendar year. The 60-day clock starts when the breach is discovered, not when it occurred.

Yes — HIPAA requires a Business Associate Agreement (BAA) with every business associate before that vendor is allowed to receive, store, transmit, or process PHI on your behalf. Major cloud providers (AWS, Azure, Google Cloud), EHRs, communication platforms (some Slack/Zoom/Twilio plans) and security vendors all offer BAAs — but only on specific tiers. Lacking a BAA is one of the most-cited findings in OCR enforcement.

For a small clinic or single-product digital health startup starting from scratch: typically 3–6 months to reach a defensible baseline (risk analysis, policies, technical controls, BAAs, training). For larger covered entities or multi-product business associates: 6–12 months including remediation. After that, HIPAA is continuous — annual risk reassessments, ongoing workforce training, BAA refreshes.

No. HHS/OCR does not certify or endorse any HIPAA certification programme. Third-party attestations (HITRUST CSF, SOC 2 + HIPAA, ISO 27001 + HIPAA mapping) are widely accepted by enterprise buyers and health plans as evidence of compliance, but they do not provide a legal safe harbour. The only thing that matters in an OCR investigation is your evidence.

Telehealth platforms used for diagnosis or treatment are subject to full HIPAA — the OCR enforcement discretion that applied during COVID-19 ended in 2023. AI tools (scribes, summarisers, decision support) that process PHI are business associates and require BAAs. The 2024 HHS guidance also requires risk analyses for AI use cases that touch PHI.

Security Pulse maps directly to the HIPAA Security Rule. RunWay handles the foundational programme: risk analysis, policies aligned to the 2025 NPRM, BAA library, vendor inventory, workforce training. Autopilot then runs continuously: encryption, MFA, identity governance, endpoint protection, audit logging, breach detection, and an evidence vault that produces OCR-ready reports on demand.