HIPAA Compliance

Implement HIPAA Security Rule, Privacy Rule, and Breach Notification Rule requirements for systems that create, receive, maintain, or transmit electronic Protected Health Information (ePHI).

When to Use

• Building or operating systems that handle electronic Protected Health Information
• Configuring cloud infrastructure for HIPAA-eligible workloads
• Establishing Business Associate Agreements with vendors
• Implementing technical safeguards for PHI protection
• Preparing for HIPAA compliance audits or OCR investigations

This is a control-mapping aid, not a compliance determination. Establish covered-entity/business-associate applicability and have qualified privacy/security counsel verify current effective rules. Proposed rules are not effective requirements. AES-256, TLS versions, MFA, 15-minute sessions, CMKs and annual/quarterly schedules below are baseline design choices, not universal statutory prescriptions. Addressable does not mean optional without documented risk assessment. Never send PHI to an unapproved service.

HIPAA Rules and Safeguards