Protect patient data and achieve HIPAA compliance in weeks

HIPAA (Health Insurance Portability and Accountability Act) is a U.S. federal law that establishes national standards for protecting sensitive patient health information. It requires organizations that handle Protected Health Information (PHI) to implement physical, administrative, and technical safeguards to ensure the confidentiality, integrity, and availability of that data.

HIPAA applies to two categories of organizations: Covered Entities (healthcare providers, health plans, healthcare clearinghouses) and Business Associates (organizations that handle PHI on behalf of covered entities). If your SaaS product stores, processes, or transmits patient health information, you likely need to be HIPAA compliant, even if you are not a healthcare company.

PHI includes any individually identifiable health information held or transmitted by a covered entity or business associate. This encompasses 18 identifiers including names, addresses, dates, Social Security numbers, medical record numbers, and biometric identifiers, when combined with health information like diagnoses, treatments, or payment data.

HIPAA violations can result in significant civil and criminal penalties. Civil penalties range from $100 to $50,000 per violation, with annual maximums up to $1.5 million per violation category. Criminal penalties for willful violations can include fines up to $250,000 and imprisonment up to 10 years. Beyond fines, breaches result in reputational damage and loss of patient trust.

No, there is no official HIPAA certification issued by HHS or any government body. Unlike SOC 2 or ISO 27001, HIPAA does not have a formal certification process. However, organizations commonly undergo third-party assessments to validate compliance, and many choose to obtain a SOC 2 Type II report with HIPAA criteria to demonstrate their compliance posture to customers.

A BAA is a contract between a covered entity and a business associate that establishes permitted uses and disclosures of PHI, requires the business associate to implement safeguards, and ensures compliance with HIPAA rules. Without a signed BAA, sharing PHI with a vendor is itself a HIPAA violation.

HIPAA requires covered entities and business associates to conduct a thorough risk assessment, but does not specify a frequency. However, OCR guidance recommends annual assessments and additional assessments when significant changes occur to your environment. Evidr helps you conduct and document risk assessments with AI-powered threat identification and mitigation tracking.