HIPAA Requirements
What HIPAA Compliance Requires From a Practice
Every covered entity and business associate must meet five core HIPAA obligations: a Security Risk Assessment, written policies, workforce training, business associate agreements, and technical safeguards.
The requirements
The five core obligations
Every covered entity and business associate must satisfy five core obligations under the HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164):
- Security Risk Assessment (SRA). An accurate, thorough analysis of risks to electronic PHI, required by 45 CFR 164.308(a)(1)(ii)(A). OCR runs a Risk Analysis Initiative focused on this requirement.
- Written policies and procedures. Reasonable and appropriate policies, kept in writing and tailored to your operations, per 45 CFR 164.316(a). Generic templates alone do not satisfy this.
- Workforce training. Security awareness and training for every workforce member, documented with dates, per 45 CFR 164.308(a)(5)(i).
- Business associate agreements. A signed BAA with every vendor that creates, receives, maintains, or transmits PHI on your behalf, per 45 CFR 164.308(b)(1).
- Technical safeguards. Access controls, audit controls, integrity controls, authentication, and transmission security, per 45 CFR 164.312.
Compliance documentation must be retained for six years from creation or the date it was last in effect, per 45 CFR 164.316(b)(2). One Guy Consulting produces each of these outputs so they would hold up under OCR review.
Official guidance: HHS: HIPAA, HHS: the Security Rule, and HHS OCR: compliance and enforcement.
Next