HIPAA compliance guide
The Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for protecting Protected Health Information. Whether you're a covered entity, business associate, or subcontractor, we help you implement Privacy Rule, Security Rule, and Breach Notification requirements with clear processes and audit-ready documentation.
What is HIPAA?
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that established national standards to protect sensitive patient health information from being disclosed without the patient's consent or knowledge.
Enforced by: U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). HIPAA applies to covered entities (healthcare providers, health plans, clearinghouses), business associates, and their subcontractors.
Privacy Rule
Controls PHI use and disclosure
Security Rule
Protects electronic PHI (ePHI)
Complements SOC 2 certification and ISO 27001 for healthcare information security.
Who needs to comply?
Covered entities
Healthcare providers, health plans, healthcare clearinghouses that transmit health information electronically
Business associates
Third parties that create, receive, maintain, or transmit PHI on behalf of covered entities
Subcontractors
Entities that create, receive, maintain, or transmit PHI on behalf of business associates
Healthcare providers
Hospitals, clinics, physicians, dentists, pharmacies, nursing homes, home health agencies
Health plans
Health insurance companies, HMOs, employer health plans, government health programs
Healthcare technology vendors
EHR vendors, cloud storage, data analytics, billing services, IT support, consultants
How VerifyWise supports HIPAA compliance
Concrete capabilities that address Privacy Rule, Security Rule, and Breach Notification requirements
PHI inventory and data mapping
Identify and document all systems that create, receive, maintain, or transmit Protected Health Information. The platform maintains a complete PHI data flow map required for Privacy Rule compliance and breach response planning.
Addresses: Privacy Rule: PHI identification, minimum necessary, data flow documentation
Security safeguards implementation
Track implementation of administrative, physical, and technical safeguards required by the Security Rule. The platform documents security controls, access controls, encryption measures, and audit logging across your PHI infrastructure.
Addresses: Security Rule: Access controls, encryption, audit controls, integrity controls
Risk assessment and analysis
Conduct HIPAA-aligned risk assessments identifying threats and vulnerabilities to PHI confidentiality, integrity, and availability. The platform generates risk documentation and tracks remediation required by the Security Rule.
Addresses: Security Rule: Risk analysis, risk management, security management process
Policy and procedure management
Maintain required HIPAA policies, procedures, and documentation with version control and approval workflows. The platform ensures policies address all Privacy and Security Rule requirements with proper review cycles.
Addresses: Privacy & Security Rules: Policies, procedures, documentation, workforce training
Breach notification and incident response
Manage HIPAA breach investigations with structured workflows meeting the Breach Notification Rule's 60-day timeline. The platform tracks breach discovery, harm assessment, notification obligations, and OCR reporting.
Addresses: Breach Notification Rule: Discovery, assessment, notification, documentation
Business associate management
Track all business associates and subcontractors with BAA status, risk assessments, and ongoing monitoring. The platform maintains the third-party oversight required by the Privacy and Security Rules.
Addresses: Privacy & Security Rules: BAA tracking, vendor risk, subcontractor management
All PHI-related activities are tracked with timestamps, assigned owners, and approval workflows. This audit trail demonstrates systematic compliance and supports OCR investigations or audits.
Complete HIPAA requirements coverage
VerifyWise provides dedicated tooling for all HIPAA rule requirements
HIPAA requirements
Requirements with dedicated tooling
Coverage across all rules
PHI use, disclosure, rights, minimum necessary
Administrative, physical, technical safeguards
Discovery, notification, documentation, mitigation
Investigations, penalties, compliance, audits
Built for healthcare compliance from the ground up
OCR audit readiness
Evidence packages for OCR investigations and compliance reviews
60-day breach tracking
Automated breach notification workflows meeting OCR timelines
BAA management
Track business associates and subcontractors with BAA status
AI in healthcare
Combine HIPAA with AI governance frameworks for clinical AI systems
Key HIPAA rules
Understanding the major components of HIPAA compliance
Privacy Rule
Controls the use and disclosure of Protected Health Information and establishes individual rights.
- Minimum necessary standard for PHI use
- Individual rights (access, amendment, accounting)
- Notice of privacy practices
- Designated privacy officer
- Workforce training and sanctions
Security Rule
Establishes national standards to protect electronic Protected Health Information (ePHI).
- Administrative safeguards (9 standards)
- Physical safeguards (4 standards)
- Technical safeguards (5 standards)
- Organizational requirements
- Policies and procedures documentation
Breach Notification Rule
Requires notification to individuals, HHS, and in some cases the media when PHI is breached.
- Breach discovery and assessment
- Individual notification (60 days)
- HHS notification (annual or immediate)
- Media notification (500+ individuals)
- Documentation and mitigation
Enforcement Rule
Establishes procedures for investigations, hearings, and imposition of civil money penalties.
- OCR compliance investigations
- Civil money penalty tiers
- Criminal prosecution referrals
- Corrective action plans
- Resolution agreements
Omnibus Rule
Strengthened HIPAA with business associate liability, breach notification expansion, and HITECH Act implementation.
- Business associate direct liability
- Subcontractor BAA requirements
- Strengthened enforcement
- Expanded individual rights
- Genetic information protections
Security Rule safeguards breakdown
Administrative, physical, and technical safeguards required for ePHI protection
Administrative safeguards
Documented policies, procedures, and processes to manage PHI security
Security management process
Risk analysis, risk management, sanction policy, information system activity review
Assigned security responsibility
Designated security official responsible for HIPAA security
Workforce security
Authorization, supervision, clearance procedures, termination procedures
Information access management
Access authorization, access establishment, access modification
Security awareness and training
Security reminders, protection from malware, log-in monitoring, password management
Security incident procedures
Response and reporting of security incidents
Contingency plan
Data backup, disaster recovery, emergency mode, testing, applications and data criticality
Evaluation
Periodic technical and non-technical evaluation of security measures
Business associate contracts
Written contracts with satisfactory assurances regarding PHI safeguarding
Physical safeguards
Physical measures to protect electronic information systems and buildings
Facility access controls
Contingency operations, facility security plan, access control and validation, maintenance records
Workstation use
Policies and procedures for workstation functions and security
Workstation security
Physical safeguards to restrict workstation access to authorized users
Device and media controls
Disposal, media re-use, accountability, data backup and storage
Technical safeguards
Technology and policies to protect ePHI and control access
Access control
Unique user identification, emergency access, automatic logoff, encryption and decryption
Audit controls
Hardware, software, and procedural mechanisms to record and examine ePHI access
Integrity
Policies to ensure ePHI is not improperly altered or destroyed
Person or entity authentication
Procedures to verify person or entity seeking ePHI access
Transmission security
Integrity controls and encryption for ePHI transmission over networks
24-week implementation roadmap
A practical path to HIPAA compliance with clear milestones
Foundation and gap analysis
- Designate privacy and security officers
- Conduct initial HIPAA gap assessment
- Create PHI inventory and data flow maps
- Review existing policies and procedures
Risk assessment and planning
- Complete comprehensive risk analysis
- Identify threats and vulnerabilities to ePHI
- Prioritize remediation activities
- Develop security management plan
Safeguards implementation
- Implement administrative safeguards
- Deploy physical security controls
- Configure technical safeguards
- Establish business associate agreements
Training and validation
- Conduct workforce privacy and security training
- Test incident response procedures
- Validate technical controls
- Document compliance evidence
HIPAA penalties and enforcement
Understanding the financial and criminal consequences of non-compliance
Civil money penalty tiers
Did not know (and by exercising reasonable diligence would not have known)
Range
$100 - $50,000
Annual max
$25,000
Reasonable cause (violation due to circumstances beyond reasonable control)
Range
$1,000 - $50,000
Annual max
$100,000
Willful neglect (but corrected within 30 days)
Range
$10,000 - $50,000
Annual max
$250,000
Willful neglect (not corrected within 30 days)
Range
$50,000 - $50,000
Annual max
$1,500,000
Criminal penalties
Tier 1 Criminal
Knowingly obtaining or disclosing PHI
Up to $50,000 and up to 1 year imprisonment
Tier 2 Criminal
Obtaining PHI under false pretenses
Up to $100,000 and up to 5 years imprisonment
Tier 3 Criminal
Obtaining or disclosing PHI with intent to sell, transfer, or use for commercial advantage, personal gain, or malicious harm
Up to $250,000 and up to 10 years imprisonment
Note: Penalties are assessed per violation. Multiple violations can result in penalties exceeding annual maximums. The Department of Justice handles criminal prosecutions for HIPAA violations.
HIPAA policy template library
Access ready-to-use HIPAA policy templates covering Privacy Rule, Security Rule, and Breach Notification requirements
Privacy Rule policies
- • Privacy Practices Notice
- • Minimum Necessary Policy
- • Individual Rights Policy
- • Privacy Officer Designation
- • PHI Use and Disclosure
- • Accounting of Disclosures
- • Amendment Request Process
Security Rule policies
- • Security Management Process
- • Access Control Policy
- • Audit Controls Policy
- • Encryption and Decryption
- • Incident Response Plan
- • Contingency Plan
- • Workforce Security Policy
Breach & Compliance
- • Breach Notification Policy
- • Breach Risk Assessment
- • Business Associate Agreement
- • Sanctions Policy
- • Training and Awareness
- • Compliance Monitoring
- • Risk Assessment Policy
Frequently asked questions
Common questions about HIPAA compliance
Ready to achieve HIPAA compliance?
Start your compliance journey with our guided HIPAA assessment and implementation tools designed for healthcare organizations.