Passeca - Governance, Risk management, and Compliance support
Under attack?
HIPAA

HIPAA Compliance Services

For covered entities and business associates handling protected health information (PHI) — Security and Privacy Rule readiness, risk analysis, BAAs, and breach-notification readiness.

Book a free HIPAA scoping callSee all frameworks

HIPAA is the US federal law that sets national standards for protecting health information (PHI). Passeca classifies whether you are a covered entity or business associate, runs the mandatory Security Rule risk analysis, implements the administrative, physical and technical safeguards, builds the BAA programme, and prepares the breach-notification process — operating the Security Rule controls on an ISO 27001 baseline.

Definition

What is HIPAA?

HIPAA (the Health Insurance Portability and Accountability Act of 1996) is the US federal law that establishes national standards for the protection of individually identifiable health information, referred to as protected health information (PHI). It is enforced by the Office for Civil Rights (OCR) within the US Department of Health and Human Services.

Three rules carry the practical requirements. The Privacy Rule governs the use and disclosure of PHI in any form. The Security Rule sets administrative, physical and technical safeguards specifically for electronic PHI (ePHI). The Breach Notification Rule requires notification of affected individuals, HHS and (for large breaches) the media. Together they apply to covered entities (health plans, clearinghouses, providers) and their business associates (vendors that handle PHI on their behalf).

Scope

Who needs HIPAA compliance?

  • You are a healthcare provider, plan or clearinghouse. These are covered entities under HIPAA.
  • You are a SaaS or technology vendor handling PHI. You are a business associate and need a BAA with each covered entity.
  • You provide billing, claims or analytics for US healthcare. These services routinely process PHI.
  • A US healthcare customer sent a HIPAA questionnaire. That is usually the trigger to formalise compliance.
Requirements

What does HIPAA actually require?

The HIPAA Security Rule organises its requirements into three safeguard categories — administrative, physical and technical — backed by a foundational risk analysis. The Privacy Rule governs uses and disclosures; the Breach Notification Rule governs response.

  • Administrative safeguards — risk analysis and risk management, security-management process, workforce security, access management, security awareness and training, contingency planning, and evaluation.
  • Physical safeguards — facility access controls, workstation use and security, and device and media controls including disposal and reuse of ePHI media.
  • Technical safeguards — access control (unique user IDs, automatic logoff, encryption), audit controls, integrity controls, and transmission security for ePHI in transit.
  • Organisational requirements — Business Associate Agreements with all vendors that handle PHI.
  • Policies, procedures and documentation — retained for six years from creation or last effective date.
  • Privacy Rule — permitted uses and disclosures, minimum-necessary standard, and individuals' rights to access and amend their PHI.
  • Breach Notification Rule — individual notification within 60 days, HHS notification, and media notification for breaches affecting 500+ individuals.

The risk analysis underpins all of this: you must implement safeguards that are reasonable and appropriate relative to the risks the analysis identifies, and document the rationale for any measure you implement.

The engagement

How Passeca helps you achieve HIPAA compliance

  1. 01

    Entity classification & scope

    We confirm whether you are a covered entity or a business associate, define the PHI in scope, and map your ePHI environment — the systems, devices and people that touch electronic protected health information.

  2. 02

    Risk analysis

    We conduct the HIPAA Security Rule risk analysis — the foundational, mandatory requirement — identifying threats and vulnerabilities to the confidentiality, integrity and availability of ePHI, and the likelihood and impact of each.

  3. 03

    Risk management & remediation

    We design the risk-management plan and implement the administrative, physical and technical safeguards the Security Rule requires — access control, audit controls, integrity, transmission security and the workforce measures.

  4. 04

    Policies, BAAs & training

    We build the required HIPAA policies, stand up the Business Associate Agreement process for your vendors, and deliver the PassHRM security-awareness training the Security Rule expects of the workforce.

  5. 05

    Ongoing compliance & breach readiness

    We keep the risk analysis current, run periodic reviews, and prepare the breach-notification process so you can meet the HIPAA Breach Notification Rule timelines if ePHI is compromised.

Deliverables

What you get from the engagement

An entity classification — covered entity or business associate
A scoped ePHI environment map
The HIPAA Security Rule risk analysis (45 CFR 164.308)
Implemented administrative, physical and technical safeguards
The HIPAA policy set, retained to the six-year requirement
A Business Associate Agreement programme and template
Workforce security-awareness training on PassHRM
A breach-notification process tested against the 60-day rule
Timeline

How long does HIPAA compliance take?

MaturityTypical durationWhat drives it
No risk analysis, no baseline4–8 monthsRisk analysis plus full safeguard implementation
ISO 27001 baseline exists2–4 monthsClosing HIPAA-specific gaps on top of the ISMS
Breach-readiness review only4–8 weeksTesting the breach-notification process

The risk analysis is the gating deliverable — nothing else can be justified without it. Organisations operating ISO 27001 controls typically satisfy most Security Rule technical safeguards already.

Cost

How much does HIPAA compliance cost?

HIPAA is a regulation, not a certificate, so there is no certification-body fee. Cost is consulting to conduct the risk analysis, implement safeguards, build policies and the BAA programme, and deliver workforce training.

MaturityConsulting (Passeca)
No risk analysis, no baselinePrice on request
ISO 27001 baseline existsPrice on request
Breach-readiness review onlyPrice on request
Overlap

Doing more than one framework?

 HIPAAISO 27001GDPR
Risk analysisDPIA
Access control (ePHI)
Encryption (at rest / transit)
Audit controls / logging
Business Associate AgreementsSupplierDPA
Breach notification60 daysIncident72 hours
ScopeUS PHIGlobalEU residents

Organisations handling health data on both sides of the Atlantic typically need HIPAA and the GDPR. ISO 27001 is the shared control baseline beneath both. Passeca maps evidence once in Hyperproof so a single body of work serves all three regimes.

FAQ

HIPAA compliance, answered

The questions covered entities and business associates ask about meeting HIPAA.

What is HIPAA?
HIPAA (the Health Insurance Portability and Accountability Act of 1996) is the US federal law that sets national standards for the protection of individually identifiable health information, called protected health information (PHI). The HIPAA Security Rule and Privacy Rule govern how covered entities and business associates handle PHI.
Who needs to comply with HIPAA?
Covered entities — health plans, healthcare clearinghouses and healthcare providers that transmit health information electronically — and their business associates, which are vendors that create, receive, maintain or transmit PHI on a covered entity's behalf. A SaaS vendor processing PHI is almost always a business associate.
What is the difference between the Privacy Rule and the Security Rule?
The Privacy Rule governs all PHI in any form and sets limits on uses and disclosures. The Security Rule specifically governs electronic PHI (ePHI) and requires administrative, physical and technical safeguards. The Breach Notification Rule requires notification when unsecured PHI is breached.
Is the HIPAA risk analysis mandatory?
Yes. The Security Rule requires an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI (45 CFR 164.308(a)(1)(ii)(A)). It is the foundation of a HIPAA compliance programme and the single most cited deficiency in OCR enforcement actions.
What is a Business Associate Agreement (BAA)?
A BAA is a contract that a covered entity must have with each business associate that handles PHI on its behalf. The BAA defines how the business associate may use and disclose PHI and requires it to safeguard it to the standard of the Security Rule. No BAA, no PHI handling.
What are the HIPAA breach-notification timelines?
Under the Breach Notification Rule, affected individuals must be notified without unreasonable delay and no later than 60 days from discovery. The Department of Health and Human Services must be notified, and breaches affecting 500+ individuals in a jurisdiction must be reported to the media. Business associates must notify covered entities without undue delay.
Does ISO 27001 help with HIPAA?
Yes. The ISO 27001 control set satisfies a large portion of the HIPAA Security Rule technical and administrative safeguards. ISO 27001 is not a substitute for the HIPAA risk analysis or the Privacy Rule, but it is the most common framework used to operate the Security Rule controls. Passeca builds evidence once in Hyperproof to serve both.
How much does HIPAA compliance cost?
HIPAA is a regulation, not a certificate, so there is no certification-body fee. Cost is consulting to conduct the risk analysis, implement safeguards, build policies and BAAs, and deliver training. The risk analysis and BAA programme are the largest effort components.
Always-on defence

Handling PHI for a US healthcare customer?

Book a free scoping call. We will classify you, run the Security Rule risk analysis, and give you a timeline and cost band — including the BAAs you need to sign.

Book a free consultationSee healthcare bundle

Related

Compliance hubAll 11 frameworks in one placeISO 27001 CertificationThe Security Rule control baselineGDPR ComplianceFor organisations also handling EU dataHealthcare industryThe Passeca healthcare bundlePassHRMWorkforce security-awareness trainingRansomware ProtectionAnti-ransomware for PHI environmentsBook a consultationFree HIPAA scoping call