Skip to main content
HIPAA (Health Insurance Portability and Accountability Act) is a US federal law that sets standards for protecting sensitive patient health information. The HIPAA Security Rule establishes requirements for safeguarding electronic Protected Health Information (ePHI).

​
Who needs HIPAA compliance?

Covered entities

Healthcare providers, health plans, and healthcare clearinghouses that transmit health information electronically.

Business associates

Any organization that creates, receives, maintains, or transmits ePHI on behalf of a covered entity — including SaaS vendors, cloud providers, and consultants.

​
Three categories of safeguards

Administrative

Policies and procedures for managing ePHI — risk analysis, workforce training, contingency planning, and access management.

Physical

Physical measures to protect systems and facilities — facility access controls, workstation security, and device disposal.

Technical

Technology controls to protect ePHI — access controls, audit controls, integrity controls, transmission security, and encryption.

​
Key HIPAA requirements

RequirementDescription
Risk AnalysisConduct thorough assessment of potential risks to ePHI
Access ControlsLimit access to ePHI to authorized individuals
Audit ControlsTrack and monitor access to systems containing ePHI
EncryptionEncrypt ePHI at rest and in transit
Business Associate AgreementsExecute BAAs with all vendors handling ePHI
Breach NotificationReport breaches to affected individuals and HHS
TrainingRegular workforce security awareness training
HIPAA violations can result in fines from 100to100 to 50,000 per violation, with annual maximums of $1.5 million per violation category. Criminal penalties can include imprisonment.

​
How DSALTA helps

  • HIPAA-specific controls mapped to Security Rule requirements
  • Administrative, physical, and technical safeguards pre-configured
  • Risk assessment tools with the risk register
  • Vendor management for Business Associate tracking
  • Policy templates for HIPAA-required documentation
  • Cross-framework mapping — overlaps with SOC 2, ISO 27001, and GDPR

​
Frequently asked questions

Yes, if your software stores, processes, or transmits ePHI on behalf of healthcare organizations. You are considered a Business Associate and must comply with HIPAA requirements.
A BAA is a contract between a covered entity and a business associate that outlines responsibilities for protecting ePHI. DSALTA helps you track BAAs through vendor management.
No. Unlike SOC 2 or ISO 27001, there is no official HIPAA certification. Compliance is demonstrated through documentation, risk assessments, and audit readiness — which DSALTA provides.