Are you a business associate?
A business associate is an organisation that creates, receives, maintains or transmits PHI on behalf of a covered entity. Hosting, analytics, support tooling and backups can all bring PHI into scope. A business associate agreement formalises the relationship.
The Security Rule safeguards
- Administrative: risk analysis, workforce training, sanction policy, contingency planning.
- Physical: facility access, workstation use, device and media controls.
- Technical: access control, audit controls, integrity, transmission security.
Required versus addressable
Some specifications are required; others are addressable, meaning you must assess whether they are reasonable and appropriate and document the decision, including any alternative implemented.
Evidencing safeguards
HIPAA has no certificate. What you can show is a current risk analysis, documented safeguards, training records, BAAs with downstream vendors and evidence that access, logging and incident processes operate.
There is no official HIPAA certification. Be cautious of any vendor claiming to provide one.
See this in the product
Compliancy holds the controls, evidence and records described above in one platform.