Compliance Framework · Healthcare & Life Sciences

HIPAA

HIPAA Security & Privacy Rules

Health Insurance Portability and Accountability Act

The baseline for Protected Health Information (PHI) privacy and security in healthcare organizations.

Book a strategy call All frameworks

$1.9M

Maximum HIPAA penalty per violation category, per year

60 days

Notification window for breaches affecting 500+ individuals

6 years

Required audit log and documentation retention

$10.93M

Average healthcare breach cost in 2024 (IBM)

"PHI Protection That Never Sleeps"

$1.9M

Maximum HIPAA penalty per violation category, per year

60 days

Notification window for breaches affecting 500+ individuals

6 years

Required audit log and documentation retention

$10.93M

Average healthcare breach cost in 2024 (IBM)

Sources: HIPAA Security Rule, 45 CFR Part 164 Subpart C; HHS Office for Civil Rights enforcement reports; IBM Cost of a Data Breach Report 2024 (healthcare segment)

What HIPAA requires

The core obligations at a glance.

Every HIPAA program AdVran builds is sized against these requirements. Use this as a quick orientation before reading the deeper analysis below.

Required

Technical safeguards including encryption, access controls, audit logs, integrity controls (45 CFR 164.312)

Required

Administrative safeguards including risk analysis, workforce training, sanction policies (45 CFR 164.308)

Required

Physical safeguards including facility access, workstation security, device disposal (45 CFR 164.310)

Required

Business Associate Agreements with every vendor that touches PHI

How AdVran handles HIPAA

From gap analysis to audit-ready, in 3 to 6 months.

01

Risk analysis baseline

We document every system that creates, receives, maintains, or transmits PHI. Output is a written risk analysis required by 45 CFR 164.308(a)(1)(ii)(A). The single most-cited gap in HIPAA enforcement actions.

02

Safeguard implementation

Technical (encryption, access controls, audit logs), administrative (workforce policies, training, BAAs), and physical (facility, device) safeguards deployed and documented.

03

Continuous monitoring

Audit logs collected and retained for six years. Access reviewed monthly. AdVran's SOC watches PHI systems 24/7 for anomalous access patterns.

04

Audit readiness

Evidence packages organized for OCR audit. Incident response plan tested annually. Breach notification timelines (60 days for individuals and HHS) built into runbooks.

What Is HIPAA?

HIPAA (Health Insurance Portability and Accountability Act) is the federal law governing privacy and security of Protected Health Information (PHI) for healthcare providers, health plans, and their business associates. The HIPAA Security Rule requires technical, administrative, and physical safeguards across all systems that store, transmit, or process PHI. HHS OCR can impose civil monetary penalties up to $1.9 million per violation category per year for willful neglect. Healthcare is also the most-breached industry in the United States, with an average breach cost of $10.93 million in 2024 (IBM Cost of a Data Breach Report).

Why Choose AdVran for HIPAA?

Healthcare organizations are the top target for ransomware. HIPAA penalties can reach $1.9 million per violation category per year, and OCR enforcement has been consistent. The gap between “having policies” and “enforcing controls” is where breaches happen and where enforcement actions find their footing.

A signed BAA and a policy binder don’t satisfy HIPAA. The technical and administrative controls they reference have to operate continuously across every system that touches PHI.

1. Technical Safeguards, Operationalized

We don’t just document HIPAA technical safeguards; we operate them. Encryption at rest and in transit, access controls with audit logging, automatic session timeouts, and emergency access procedures are built into the infrastructure we manage every day.

2. Business Associate Agreement (BAA) Backed by Action

As your managed service provider, we sign a BAA and back it with actual security controls: 24/7 SOC monitoring, encrypted communications, workforce training, and incident response capabilities. Our BAA reflects our operational reality, not just a contractual formality.

3. Breach Notification Readiness

HIPAA’s 60-day breach notification requirement demands rapid detection and scope determination. Our incident response services determine breach scope within hours, prepare the documentation HHS requires, and support the individual notification process. Under California Civil Code 1798.82, state law may impose shorter timelines, so the clock starts the moment discovery is confirmed.

4. PHI Access Monitoring

We set up and monitor role-based access to every system containing PHI: EHRs, billing platforms, communication tools, and file shares. Unusual access patterns trigger immediate investigation by our SOC analysts, not a next-morning alert in someone’s inbox.

5. Risk Analysis as a Living Process

HIPAA requires regular risk analysis, not a one-time report. We run continuous risk assessments, maintain a live risk register, and prioritize remediation by its actual impact on PHI. That keeps you ahead of both threats and auditors.

Frequently Asked Questions About HIPAA Compliance

What is HIPAA and who must comply?

HIPAA applies to covered entities, including healthcare providers, health plans, and healthcare clearinghouses, and their business associates: IT service providers, cloud vendors, and consultants who access PHI on their behalf. If you provide healthcare services, process health insurance claims, or manage systems holding patient information, HIPAA applies. Business associates must sign a Business Associate Agreement with covered entities before accessing PHI.

What are the main HIPAA Security Rule requirements?

The HIPAA Security Rule (45 CFR Part 164) requires covered entities and business associates to set up access controls and audit logs for PHI systems, encrypt PHI in transit and at rest, train the workforce on security policies, maintain incident response procedures, and conduct regular risk analysis. Risk analysis is the most frequently cited gap in HHS OCR enforcement actions: 71% of enforcement cases cite inadequate risk analysis as a contributing factor.

What triggers a HIPAA breach notification?

A HIPAA breach is any unauthorized acquisition, access, use, or disclosure of unsecured PHI that compromises its privacy or security. Breaches affecting 500 or more individuals require notification to HHS and affected individuals within 60 days of discovery. Breaches affecting fewer than 500 individuals must be reported to HHS annually. California’s breach notification law (Civil Code 1798.82) may impose shorter timelines.

What are the penalties for HIPAA violations?

HIPAA penalties range from $100 per violation (no knowledge) to $50,000 per violation with a $1.9 million annual cap per violation category. Willful neglect with no correction can trigger the maximum. HHS OCR levied over $6.2 million in civil monetary penalties in 2023. Criminal penalties under HIPAA can reach $250,000 and 10 years imprisonment for knowing violations involving intent to sell PHI.

How does HIPAA apply to cloud services and IT providers?

Cloud services and IT providers that store, process, or transmit PHI are business associates under HIPAA and must sign a BAA. As an AdVran managed services client, you get a signed BAA that defines our security obligations for PHI systems we manage. Our SOC monitoring, access controls, encryption practices, and incident response procedures are built to satisfy HIPAA Security Rule requirements across all managed environments.

AdVran’s vulnerability management service runs scheduled scans across your environment, prioritizes findings by exploitability, and tracks remediation to closure, meeting HIPAA Security Rule §164.308(a)(8), which requires periodic technical and non-technical evaluations to ensure security controls remain effective.

Business continuity planning (BCP) is a direct HIPAA requirement. §164.308(a)(7) mandates a contingency plan that includes data backup procedures, a disaster recovery plan, and an emergency mode operation plan for systems containing PHI. AdVran’s business continuity and disaster recovery services include documented recovery plans, tested backup procedures, and RTO/RPO targets aligned to your compliance obligations.

Healthcare organizations frequently operate under multiple overlapping regulatory frameworks. FIPS 140-2 encryption validation requirements apply to federal healthcare programs and healthcare entities handling government-sponsored patient data. FedRAMP applies when healthcare organizations deploy cloud services used by federal agencies. 21 CFR Part 11 governs electronic records and signatures for life sciences and pharmaceutical organizations operating within the same regulated healthcare environment.

Self-assessment

HIPAA Security Rule readiness snapshot

This checks whether nineteen basic practices from the current HIPAA Security Rule and Breach Notification Rule are in place at your practice, using the text of 45 CFR 164 as it stands today. The questions say electronic patient information throughout, which is what the rule calls electronic protected health information, or ePHI. It is a self-assessment and not the risk analysis required by 45 CFR 164.308(a)(1)(ii)(A), and a strong score is not a compliance opinion and would not serve as a defense in an OCR investigation.

  1. 1. Can you produce a written risk analysis from the last 12 months that lists every place electronic patient information is created, stored or sent, including cloud systems, laptops and phones? higher weight

    45 CFR 164.308(a)(1)(ii)(A) risk analysis, Required

  2. 2. For each risk your written risk analysis identified, is there a plan naming the person fixing it and the date it is due?

    45 CFR 164.308(a)(1)(ii)(B) risk management, Required

  3. 3. Is one specific person named in writing as the security official responsible for your HIPAA security policies and procedures, and does that person know they hold the role?

    45 CFR 164.308(a)(2) assigned security responsibility, Standard with no implementation specifications, so the required and addressable labels do not apply and the standard itself must be met

  4. 4. Can you show the date each current workforce member, including clinicians, temporary staff and management, last completed security awareness training, and point to a written policy stating what happens when someone breaks your security rules?

    45 CFR 164.308(a)(5)(i) security awareness and training, Standard, and 45 CFR 164.308(a)(1)(ii)(C) sanction policy, Required

  5. 5. Do you keep a current record of which staff are approved to see electronic patient information in each system, and is removing that access a required step on your leavers checklist that gets done on the person's last day?

    45 CFR 164.308(a)(4)(ii)(B) access authorization, Addressable, and 45 CFR 164.308(a)(3)(ii)(C) termination procedures, Addressable

  6. 6. Do the systems holding electronic patient information record which user opened or changed which record, and does a named person review those records on a set schedule rather than only after a complaint? higher weight

    45 CFR 164.312(b) audit controls, Standard with no implementation specifications, and 45 CFR 164.308(a)(1)(ii)(D) information system activity review, Required

  7. 7. If electronic patient information were altered or deleted without authorization, could you tell that it had happened, for example from version history, a monitored change log or a file integrity check?

    45 CFR 164.312(c)(1) integrity, Standard, with 45 CFR 164.312(c)(2) mechanism to authenticate electronic protected health information, Addressable

  8. 8. When staff send electronic patient information outside your own network, by email, patient portal, referral upload or fax to email, is there one defined method they are told to use that protects the information while it travels?

    45 CFR 164.312(e)(1) transmission security, Standard, with 45 CFR 164.312(e)(2)(i) integrity controls, Addressable

  9. 9. Have you made and written down a decision, system by system, on whether electronic patient information is encrypted on servers, laptops, phones and backups and while it is being sent?

    45 CFR 164.312(a)(2)(iv) encryption and decryption, Addressable, and 45 CFR 164.312(e)(2)(ii) encryption, Addressable. Addressable does not mean optional: under 45 CFR 164.306(d)(3) you must assess whether the specification is reasonable and appropriate, then either implement it or document why it is not and implement an equivalent alternative measure if that is reasonable and appropriate

  10. 10. Is physical access to the servers, computers and backup media holding electronic patient information limited to the people who need it?

    45 CFR 164.310(a)(1) facility access controls, Standard

  11. 11. Are drives, laptops, phones, copiers and backup media wiped or destroyed before they are disposed of, resold, returned or passed to anyone else? higher weight

    45 CFR 164.310(d)(2)(i) disposal, Required, and 45 CFR 164.310(d)(2)(ii) media re-use, Required

  12. 12. Do you hold backups of electronic patient information that someone has restored from in a test in the last 12 months, and do you have written steps for treating patients and protecting records while your systems are down? higher weight

    45 CFR 164.308(a)(7)(ii)(A) data backup plan, Required, 45 CFR 164.308(a)(7)(ii)(B) disaster recovery plan, Required, and 45 CFR 164.308(a)(7)(ii)(C) emergency mode operation plan, Required. The periodic testing of those plans sits at 45 CFR 164.308(a)(7)(ii)(D), Addressable

  13. 13. Is anti-malware or endpoint protection running on every computer and server that touches electronic patient information, and does someone check that it is still switched on and up to date? higher weight

    45 CFR 164.308(a)(5)(ii)(B) protection from malicious software, Addressable, whose text is procedures for guarding against, detecting, and reporting malicious software. Addressable does not mean optional: under 45 CFR 164.306(d)(3) you must assess whether it is reasonable and appropriate, then either implement it or document why it is not and implement an equivalent alternative measure if that is reasonable and appropriate

  14. 14. Do you have written rules for how passwords are created, changed and kept safe, and are they followed in practice rather than passwords being shared or reused across systems?

    45 CFR 164.308(a)(5)(ii)(D) password management, Addressable, whose text is procedures for creating, changing, and safeguarding passwords. Addressable does not mean optional: under 45 CFR 164.306(d)(3) you must assess whether it is reasonable and appropriate, then either implement it or document why it is not and implement an equivalent alternative measure if that is reasonable and appropriate

  15. 15. Do you have a signed business associate agreement on file for every outside party that handles electronic patient information for you, including your IT provider, billing company, EHR or cloud vendor, shredding service and answering service? higher weight

    45 CFR 164.308(b)(1) and 45 CFR 164.308(b)(3) written contract or other arrangement, Required, with the contract content set by 45 CFR 164.314(a)(2)(i), Required

  16. 16. If you learned today that patient information had been exposed, do you have written steps naming who decides whether it is a reportable breach, who notifies the affected individuals, and the deadline you are working to? higher weight

    45 CFR 164.308(a)(6)(ii) response and reporting, Required, and 45 CFR 164.404(b) timeliness of notification, which sets no later than 60 calendar days after discovery. Subpart D implementation specifications are mandatory and are not labeled required or addressable

  17. 17. Does every person who uses a system holding electronic patient information sign in with their own named account, with no shared or generic logins at the front desk, in the back office or on clinical workstations? higher weight

    45 CFR 164.312(a)(2)(i) unique user identification, Required, with 45 CFR 164.312(d) person or entity authentication, Standard with no implementation specifications

  18. 18. Are screens showing electronic patient information positioned or shielded so patients and visitors cannot read them, and do unattended workstations lock themselves after a set period of inactivity?

    45 CFR 164.310(b) workstation use, Standard, and 45 CFR 164.310(c) workstation security, Standard, both with no implementation specifications, together with 45 CFR 164.312(a)(2)(iii) automatic logoff, Addressable

  19. 19. Are your written security policies kept for at least six years from the date each version was last in effect, available to the staff who have to follow them, and reviewed and updated when something about your systems or premises changes?

    45 CFR 164.316(b)(2)(i) time limit, Required, which sets six years, 45 CFR 164.316(b)(2)(ii) availability, Required, and 45 CFR 164.316(b)(2)(iii) updates, Required, all under the documentation standard at 45 CFR 164.316(b)(1)

Sources

Common questions

HIPAA compliance.

Don't see yours? Call (714) 694-4573 or email contact@advran.com.

What is HIPAA and who needs to comply? +

The baseline for Protected Health Information (PHI) privacy and security in healthcare organizations.

How does AdVran help with HIPAA compliance? +

AdVran provides end-to-end HIPAA compliance management, including gap assessment, control implementation, continuous monitoring, evidence collection, and audit coordination. Our team handles the technical complexity so you can focus on your business.

How long does it take to achieve HIPAA compliance? +

Timeline depends on your current security posture and the scope of required controls. Most organizations achieve initial compliance within 3-6 months with AdVran's guidance. We provide a detailed timeline during our initial assessment.

What happens if we fail a compliance audit? +

AdVran conducts pre-audit readiness assessments to identify and resolve gaps before the official audit. If issues are found during an audit, we provide immediate remediation support and work with auditors to address findings.

Related frameworks

More in Healthcare & Life Sciences

All frameworks
FDA 21 CFR Part 11

21 CFR Part 11

FDA Electronic Records and Electronic Signatures

FDA requirement for electronic records and signatures in clinical trials, R&D, and pharmaceutical manufacturing environments.

Learn more
HITECH

HITECH Act

Health Information Technology for Economic and Clinical Health Act

Mandates strict breach notifications, increases penalties for HIPAA non-compliance, and extends requirements to business associates.

Learn more