Executive Summary: What is it?
The Health Insurance Portability and Accountability Act (HIPAA) is a US federal law that mandated the creation of national standards to protect sensitive patient health information (PHI) from being disclosed without the patient's consent or knowledge.
CFO / Business Impact: What does it cost/risk?
- Healthcare Market Access: HIPAA binds covered entities (health plans, health care clearinghouses, and health care providers that conduct covered transactions electronically) and their business associates, not software. A tool that handles PHI for them is chosen on whether it supports the safeguards they must implement.
- Liability Management: Ensures strict data handling protocols to prevent breaches and subsequent legal action.
Technical Reality: How does it work?
- Audit Logging: Systems that contain or use electronic PHI need mechanisms that record and examine activity in them; the rule sets no log format.
- Encryption: Encryption of stored and transmitted electronic PHI is Addressable, not Required: the organization implements it where reasonable and appropriate, or documents why not and implements an equivalent alternative measure if that is reasonable and appropriate.
- RBAC: Strict "Need to Know" access controls must be enforced.
What the Label Means in a Solution Profile
HIPAA binds healthcare organizations and their business associates, not software, and no government certifies products for HIPAA.
- Self-Hosted line: "HIPAA Ready" means the free self-hosted build provides the mechanisms behind five technical safeguards of 45 CFR 164.312 (individual logins, audit logs of user activity, session timeout, encrypted network traffic, authentication), plus role-based access and data export, so your team can switch them on.
- Managed service line: "HIPAA (Self-Assessed)" means the vendor publicly offers a Business Associate Agreement for the service. "HIPAA (Audited)" means an independent assessor checked the service: a current HITRUST r2 or i1 certification, or a SOC 2 Type 2 report that covers the HIPAA Security Rule.