Get audit-ready for HIPAA
HIPAA · Health Insurance Portability and Accountability Act
US federal law requiring safeguards for protected health information (PHI). Covers privacy, security, breach notification, and enforcement rules for covered entities and business associates.
HIPAAWhat is HIPAA?
US federal law requiring safeguards for protected health information (PHI). Covers privacy, security, breach notification, and enforcement rules for covered entities and business associates.
Who it applies to
Covered entities - health plans, providers and clearinghouses - and the business associates that handle protected health information for them. A software vendor touching PHI is a business associate and is directly liable.
How the standard is organised
Separate rules rather than one control set: the Security Rule for electronic PHI, organised into administrative, physical and technical safeguards, alongside the Privacy Rule and the Breach Notification Rule.
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
HIPAA on the Bitkosh platform
The 54 HIPAA controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- §164.308(a)(3)(ii)(B)Workforce Clearance Procedure
Implement procedures to determine that access of a workforce member to ePHI is appropriate
Administrative Safeguards - §164.312(c)(2)Mechanism to Authenticate ePHI
Implement electronic mechanisms to corroborate that ePHI has not been altered or destroyed improperly
Technical Safeguards - §164.314(a)(1)Business Associate Contracts or Other Arrangements
Satisfactorily assure that business associate will appropriately safeguard information
Organizational Requirements - §164.312(a)(2)(iii)Automatic Logoff
Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity
Technical Safeguards - §164.308(a)(7)(ii)(C)Emergency Mode Operation Plan
Establish procedures to enable continuation of critical business processes for protection of ePHI during an emergency
Administrative Safeguards - §164.310(b)Workstation Use
Implement policies and procedures for proper workstation use and access to ePHI
Physical Safeguards
More healthcare frameworks
Frequently Asked Questions
Who publishes HIPAA, and who does it apply to?
How is HIPAA conformance demonstrated?
How is HIPAA structured?
Ready to get audit-ready for HIPAA?
See how the Bitkosh Readiness Platform gets you audit-ready for HIPAA — and the other 47 ready frameworks — from a single control library.