HIPAA and HITECH

The risk analysis required by the HIPAA Security Rule, identifying threats and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information wherever it is stored, processed, or transmitted.

Inventory ePHI → identify threats and vulnerabilities → analyze likelihood and impact → evaluate current controls → document risks and remediation priorities.

The risk assessment is foundational to an effective HIPAA program and should be reviewed continuously and after material operational changes.

A mapping of practices to the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule for the organization's role.

Map rule requirements → assess administrative, physical, and technical safeguards → design breach-notification procedures → document responsibilities, decisions, and evidence.

Clear rule-by-rule accountability helps organizations respond consistently and demonstrate how risks are managed.

Implementation support for administrative, physical, and technical safeguards plus review of Business Associate Agreements across the vendor chain.

Develop policies and procedures → implement access control, encryption, and audit logging → inventory and review BAAs → verify vendor safeguards and responsibilities.

A signed BAA does not replace actual safeguards; organizations handling PHI need both contractual clarity and operating controls.

Role-based training and continuous monitoring so evidence remains current after the initial assessment.

Deliver workforce training → track attestations → periodically retest controls → review the compliance program as systems and operations change.

HIPAA has no universal certification; documented risk assessments, trained personnel, and maintained safeguards demonstrate an operating program. Organizations needing a validated credential can consider a HITRUST assessment.