Regulation · Health Insurance Portability and Accountability Act
HIPAA
The US law protecting health information. Essential for health technology companies serving US providers and payers.
Overview
What is HIPAA?
HIPAA sets national standards in the United States for protecting health information. If you create, receive, store or transmit protected health information (PHI) on behalf of a US healthcare organisation, you are likely a business associate with direct obligations under the law.
Who needs it
- Health technology and digital health companies with US customers
- Vendors signing Business Associate Agreements (BAAs)
- SaaS platforms that store or process PHI
What’s involved
The path to HIPAA.
- 01
Security risk analysis
A documented assessment of risks to the confidentiality, integrity and availability of PHI.
- 02
Administrative safeguards
Security management, workforce training, access management and contingency planning.
- 03
Physical and technical safeguards
Device and facility controls, access controls, audit logging, integrity and transmission security.
- 04
Breach readiness
Procedures to assess and notify breaches of unsecured PHI within required timeframes.
How we help
We carry the documentation. You bring the decisions.
One program, built around your business, mapped to every framework you need.
- HIPAA security risk analysis
- Policies and procedures for the Security and Privacy Rules
- Business associate readiness
- Alignment with SOC 2 or ISO 27001 so you build once
- Evidence and monitoring in Vanta
Ready to start on HIPAA?
Tell us where you are and where you need to be. We will spend 30 minutes understanding your situation and give you an honest view of the fastest sensible path.