Tag
HIPAA
27 articles
Compliance frameworks
Mapping HIPAA to SOC 2 controls
A working map from HIPAA Security Rule standards to SOC 2 criteria, where the two diverge, and how to run one control set that serves both obligations.
5 min read
Compliance frameworks
HIPAA workforce training that counts as evidence
The two HIPAA training requirements, who counts as workforce, the records an investigator or customer asks for, and how to prove that no one was missed.
6 min read
Risk and vendors
NIST 800-30 risk assessments
How to run a risk assessment with NIST SP 800-30 Rev. 1: the four steps, the risk model, how likelihood and impact combine, and what the report must hold.
6 min read
Security engineering
Encryption at rest and in transit
What encryption at rest and in transit each protect against, the layers where each applies, what the frameworks say, and the evidence an auditor accepts.
6 min read
Compliance frameworks
Addressable vs required: HIPAA encryption explained
What addressable means in the HIPAA Security Rule, where encryption sits in it, how it links to breach notification, and how to document each decision.
6 min read
Compliance frameworks
HIPAA audit logs: what to record and keep
What the Security Rule requires of audit controls, which events to log in systems holding ePHI, how to review them, and what it leaves to you on retention.
6 min read
Security engineering
Business continuity and disaster recovery plans
Continuity keeps the business running; recovery restores the technology. How to run an impact analysis, map dependencies, write both plans, and test them.
6 min read
Audit readiness
How long to keep audit evidence
What SOC 2, ISO 27001, HIPAA and PCI DSS say about keeping evidence, what the audit cycle implies, and why privacy law limits how long you should keep it.
6 min read
Compliance frameworks
HIPAA for SaaS companies selling to healthcare
How a SaaS company works out whether it is a HIPAA business associate, what that role obligates it to do, and what healthcare buyers expect to see first.
6 min read
Security engineering
Backup and restore testing
A backup is only a control once you have restored from it. What to back up, how to keep backups out of an incident's reach, and how to run and record restores.
6 min read
Compliance frameworks
The HIPAA minimum necessary standard
What HIPAA's minimum necessary standard requires for uses, disclosures and requests of PHI, where it does not apply, and how a SaaS vendor designs for it.
6 min read
Risk and vendors
Offboarding a vendor
How to offboard a vendor: inventory what it holds, export data, revoke every credential and DNS record, confirm deletion, update records, and keep evidence.
6 min read
Security engineering
Writing an incident response plan
An incident response plan people can follow at 3 a.m.: what it must contain, setting severity and roles, tracking notification deadlines, and what to keep.
6 min read
Compliance frameworks
PHI vs ePHI: what counts as protected health information
How HIPAA defines PHI and ePHI, why the holder matters as much as the data, what the definitions exclude, and how to classify the edge cases SaaS teams hit.
6 min read
Security engineering
Centralized logging for compliance
What to log, what each event must contain, how long to keep it, and how to protect it. Centralized logging mapped to SOC 2, ISO 27001, PCI DSS and HIPAA.
5 min read
Compliance frameworks
HITRUST vs SOC 2 for healthcare buyers
How a HITRUST certification and a SOC 2 report differ in who issues them, what they test and how long they last, and how to tell which your buyer needs.
6 min read
Compliance frameworks
HIPAA breach notification: timelines and thresholds
When an incident is a HIPAA breach, when the 60-day clock starts, who must be told at the 500-person thresholds, and what business associates owe customers.
6 min read
Risk and vendors
A vendor due diligence checklist
A pre-contract vendor due diligence checklist: assurance reports, data handling, access, incidents, contract terms, sub-processors and the approval record.
6 min read
Security engineering
Full-disk encryption on every laptop
A lost laptop is a non-event if you can prove it was encrypted. What the rules say, why recovery keys matter, and how to evidence encryption on every device.
5 min read
Compliance frameworks
Why the same control appears in four frameworks
SOC 2, ISO 27001, HIPAA and PCI DSS ask overlapping questions in different words. Mapping once and reusing the evidence is what makes the second one fast.
3 min read
Compliance frameworks
The HIPAA risk analysis requirement
What the HIPAA Security Rule's risk analysis must cover, the elements HHS guidance expects, how to scope all ePHI, and what is often mistaken for one.
6 min read
Compliance frameworks
Business associate agreements: what to check before signing
What HIPAA requires every business associate agreement to contain, the clauses customers add on top, and how to test whether you can perform each.
6 min read
Security engineering
Offboarding that removes access the same day
Late access removal is a classic audit exception. How to set a testable standard, start from a trigger you trust, and remove access in the right order.
6 min read
Compliance frameworks
HIPAA technical safeguards for SaaS teams
What each HIPAA technical safeguard means inside a multi-tenant SaaS product, where ePHI escapes your controls, and the evidence a healthcare buyer expects.
6 min read