The short version
- HIPAA compliance governs how covered entities and business associates handle protected health information.
- The core federal regulations are the Security Rule, the Privacy Rule, and the Breach Notification Rule.
- Compliance is a continuous posture, not a certification; it is demonstrated through a written program, controls, and evidence.
The longer explanation
The structure of HIPAA
HIPAA is a statute (1996, with HITECH amendments in 2009 and the Omnibus Rule in 2013). The operational rules are:
- Privacy Rule. Governs when and how PHI can be used and disclosed. Defines individual rights — access, amendment, accounting of disclosures.
- Security Rule. Administrative, physical, and technical safeguards for electronic PHI (ePHI).
- Breach Notification Rule. Notification obligations when unsecured PHI is impermissibly used or disclosed.
- Enforcement Rule. Penalty structure and enforcement procedures administered by HHS Office for Civil Rights.
What the Security Rule actually asks for
The Security Rule is risk-based and flexible — it does not prescribe specific technologies. The required controls fall into three categories:
Administrative safeguards (roughly half the rule). A written risk analysis, security management process, workforce access authorization, training, contingency planning (backups, disaster recovery, emergency mode), evaluation of the security program over time.
Physical safeguards. Facility access controls, workstation use and security, device and media controls including disposal and re-use procedures.
Technical safeguards. Access controls, audit controls, integrity controls, person or entity authentication, transmission security.
Most controls in the rule are "required" (must implement) or "addressable" (must either implement or document why a reasonable alternative meets the standard).
Business associate relationships
If a vendor touches PHI on behalf of a covered entity, the relationship requires a business associate agreement (BAA). The BAA flows HIPAA obligations to the vendor. Subcontractors the vendor uses must in turn sign BAAs with the vendor. SaaS and cloud vendors serving healthcare clients build their compliance posture around this BAA chain.
What clients actually need in place
The artifacts our HIPAA engagements produce:
- HIPAA risk analysis. The foundational document, updated annually at minimum.
- Written policies and procedures covering each required safeguard.
- Workforce training records and acknowledgments.
- Access control evidence — who has access to what, reviewed periodically.
- Audit log evidence and monitoring for anomalous access.
- Encryption at rest and in transit for ePHI.
- BAAs with every covered business associate.
- Incident response plan with defined breach-evaluation and notification procedures.
- Business continuity and disaster recovery plans with tested RTOs.
How Thoughtwave approaches this
Our cybersecurity practice runs HIPAA readiness and ongoing-monitoring engagements for covered entities and business associates. We focus on the controls that auditors and examiners actually test — not every clause in the rule — and we build the audit and evidence layer so the client's next review cycle is dramatically faster than the current one.
For deeper context, see our Cybersecurity Solutions service and our work with Healthcare & Pharma clients.
HIPAA readiness engagements typically take 8-16 weeks depending on the client's starting posture. The first half of the engagement produces the artifacts (risk analysis, written policies, training records, access-control evidence); the second half remediates the gaps identified during the review. For clients where AI is part of the handling stack, a separate review covers how protected health information moves through retrieval, prompting, and audit layers — a review our agentic AI governance work is specifically designed for.