HIPAA Audit

HIPAA Security Rule + Privacy Rule applies to "Covered Entities" (healthcare providers, plans, clearinghouses) and their "Business Associates" (vendors processing PHI). Most B2B SaaS becomes a Business Associate by signing a BAA. This skill is the engineering-level audit, focused on the Security Rule's technical safeguards.

When to use

• SaaS company onboarding a US healthcare customer.
• Audit of an existing product's HIPAA posture.
• Mapping engineering controls to BAA obligations.
• Pre-sales — preparing for the customer's HIPAA questionnaire.

When NOT to use

• Not processing Protected Health Information (PHI) — HIPAA doesn't apply.
• Direct medical practice — full HIPAA Privacy Rule applies; this is broader than this skill covers. Get a HIPAA lawyer.
• Outside the US with no US healthcare customers — not relevant.

What is PHI?