The Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for protecting Protected Health Information. Whether you're a covered entity, business associate, or subcontractor, we help you implement Privacy Rule, Security Rule, and Breach Notification requirements with clear processes and audit-ready documentation.
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that established national standards to protect sensitive patient health information from being disclosed without the patient's consent or knowledge.
Enforced by: U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). HIPAA applies to covered entities (healthcare providers, health plans, clearinghouses), business associates, and their subcontractors.
Controls PHI use and disclosure
Protects electronic PHI (ePHI)
Complements SOC 2 certification and ISO 27001 for healthcare information security.
Covered entities
Healthcare providers, health plans, healthcare clearinghouses that transmit health information electronically
Business associates
Third parties that create, receive, maintain, or transmit PHI on behalf of covered entities
Subcontractors
Entities that create, receive, maintain, or transmit PHI on behalf of business associates
Healthcare providers
Hospitals, clinics, physicians, dentists, pharmacies, nursing homes, home health agencies
Health plans
Health insurance companies, HMOs, employer health plans, government health programs
Healthcare technology vendors
EHR vendors, cloud storage, data analytics, billing services, IT support, consultants
Concrete capabilities that address Privacy Rule, Security Rule, and Breach Notification requirements
Identify and document all systems that create, receive, maintain, or transmit Protected Health Information. The platform maintains a complete PHI data flow map required for Privacy Rule compliance and breach response planning.
Addresses: Privacy Rule: PHI identification, minimum necessary, data flow documentation
Track implementation of administrative, physical, and technical safeguards required by the Security Rule. The platform documents security controls, access controls, encryption measures, and audit logging across your PHI infrastructure.
Addresses: Security Rule: Access controls, encryption, audit controls, integrity controls
Conduct HIPAA-aligned risk assessments identifying threats and vulnerabilities to PHI confidentiality, integrity, and availability. The platform generates risk documentation and tracks remediation required by the Security Rule.
Addresses: Security Rule: Risk analysis, risk management, security management process
Maintain required HIPAA policies, procedures, and documentation with version control and approval workflows. The platform ensures policies address all Privacy and Security Rule requirements with proper review cycles.
Addresses: Privacy & Security Rules: Policies, procedures, documentation, workforce training
Manage HIPAA breach investigations with structured workflows meeting the Breach Notification Rule's 60-day timeline. The platform tracks breach discovery, harm assessment, notification obligations, and OCR reporting.
Addresses: Breach Notification Rule: Discovery, assessment, notification, documentation
Track all business associates and subcontractors with BAA status, risk assessments, and ongoing monitoring. The platform maintains the third-party oversight required by the Privacy and Security Rules.
Addresses: Privacy & Security Rules: BAA tracking, vendor risk, subcontractor management
All PHI-related activities are tracked with timestamps, assigned owners, and approval workflows. This audit trail demonstrates systematic compliance and supports OCR investigations or audits.
VerifyWise provides dedicated tooling for all HIPAA rule requirements
HIPAA requirements
Requirements with dedicated tooling
Coverage across all rules
PHI use, disclosure, rights, minimum necessary
Administrative, physical, technical safeguards
Discovery, notification, documentation, mitigation
Investigations, penalties, compliance, audits
Evidence packages for OCR investigations and compliance reviews
Automated breach notification workflows meeting OCR timelines
Track business associates and subcontractors with BAA status
Combine HIPAA with AI governance frameworks for clinical AI systems
Understanding the major components of HIPAA compliance
Controls the use and disclosure of Protected Health Information and establishes individual rights.
Establishes national standards to protect electronic Protected Health Information (ePHI).
Requires notification to individuals, HHS, and in some cases the media when PHI is breached.
Establishes procedures for investigations, hearings, and imposition of civil money penalties.
Strengthened HIPAA with business associate liability, breach notification expansion, and HITECH Act implementation.
Administrative, physical, and technical safeguards required for ePHI protection
Documented policies, procedures, and processes to manage PHI security
Risk analysis, risk management, sanction policy, information system activity review
Designated security official responsible for HIPAA security
Authorization, supervision, clearance procedures, termination procedures
Access authorization, access establishment, access modification
Security reminders, protection from malware, log-in monitoring, password management
Response and reporting of security incidents
Data backup, disaster recovery, emergency mode, testing, applications and data criticality
Periodic technical and non-technical evaluation of security measures
Written contracts with satisfactory assurances regarding PHI safeguarding
Physical measures to protect electronic information systems and buildings
Contingency operations, facility security plan, access control and validation, maintenance records
Policies and procedures for workstation functions and security
Physical safeguards to restrict workstation access to authorized users
Disposal, media re-use, accountability, data backup and storage
Technology and policies to protect ePHI and control access
Unique user identification, emergency access, automatic logoff, encryption and decryption
Hardware, software, and procedural mechanisms to record and examine ePHI access
Policies to ensure ePHI is not improperly altered or destroyed
Procedures to verify person or entity seeking ePHI access
Integrity controls and encryption for ePHI transmission over networks
A practical path to HIPAA compliance with clear milestones
Understanding the financial and criminal consequences of non-compliance
Did not know (and by exercising reasonable diligence would not have known)
Range
$100 - $50,000
Annual max
$25,000
Reasonable cause (violation due to circumstances beyond reasonable control)
Range
$1,000 - $50,000
Annual max
$100,000
Willful neglect (but corrected within 30 days)
Range
$10,000 - $50,000
Annual max
$250,000
Willful neglect (not corrected within 30 days)
Range
$50,000 - $50,000
Annual max
$1,500,000
Knowingly obtaining or disclosing PHI
Up to $50,000 and up to 1 year imprisonment
Obtaining PHI under false pretenses
Up to $100,000 and up to 5 years imprisonment
Obtaining or disclosing PHI with intent to sell, transfer, or use for commercial advantage, personal gain, or malicious harm
Up to $250,000 and up to 10 years imprisonment
Note: Penalties are assessed per violation. Multiple violations can result in penalties exceeding annual maximums. The Department of Justice handles criminal prosecutions for HIPAA violations.
Access ready-to-use HIPAA policy templates covering Privacy Rule, Security Rule, and Breach Notification requirements
Common questions about HIPAA compliance
Start your compliance journey with our guided HIPAA assessment and implementation tools designed for healthcare organizations.