HIPAA
HIPAA compliance management
Compliancy helps covered entities and business associates manage HIPAA obligations by tracking Security Rule safeguards, risk analysis, workforce policies, business associate agreements and supporting evidence.
What HIPAA is
- HIPAA is United States federal law governing protected health information (PHI).
- The Security Rule requires administrative, physical and technical safeguards for electronic PHI.
- The Privacy Rule governs use and disclosure of PHI; the Breach Notification Rule sets reporting duties.
- SaaS vendors handling PHI on behalf of a covered entity are usually business associates and sign a business associate agreement (BAA).
What organisations need to manage
- A documented security risk analysis and risk management plan
- Administrative, physical and technical safeguards
- Workforce training and sanction policies
- Business associate agreements with downstream vendors
- Access controls, audit logging and encryption decisions
- Incident and breach response procedures
How Compliancy helps
Safeguard mapping
Map required and addressable safeguards to the controls that implement them.
Risk analysis
Record risks to ePHI with owners, treatment and review dates.
BAA tracking
Track business associate agreements alongside vendor records and review cycles.
Evidence
Keep the records that demonstrate safeguards are operating, not just documented.
HIPAA controls21John DoeAdministratorJD
HIPAA readiness
AC-04Quarterly user access reviewSarah L.HIPAAOperating
EN-01Encryption in transit and at restMarcus T.HIPAAOperating
VN-01Vendor security reviewPriya R.HIPAANeeds review
Reporting
Readiness you can show, not assemble.
Reports21John DoeAdministratorJD
Compliance overview
Track your compliance performance over time.
Last 6 monthsExport
78%Overall▲ 6%
235Policies▲ 12%
48Risks▼ 4%
12Assessments▲ 2
92%Tasks done▲ 8%
Compliance trend
DecJanFebMarAprMay
Compliance by category
78%Compliant
- Compliant 78%
- In progress 15%
- Non-compliant 7%
How it connects to other frameworks
HIPAA technical safeguards align closely with SOC 2 common criteria and ISO 27001 controls, so access control and logging evidence can be reused across all three.
HIPAA questions
Is there a HIPAA certification?
No. HIPAA has no official certification. Organisations demonstrate compliance through documented safeguards, risk analysis and evidence.
Does Compliancy sign a BAA?
Contractual arrangements are handled commercially. Speak to our team about your requirements.
Can Compliancy run HIPAA and SOC 2 together?
Yes. Shared controls are mapped to both frameworks in one workspace.
Related resources
Run HIPAA in one place.
Compliancy does not issue reports, certificates or legal advice. It manages the program behind them.