> ## Documentation Index
> Fetch the complete documentation index at: https://help.dsalta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# HIPAA

> Protect healthcare data with HIPAA-compliant administrative, physical, and technical safeguards.

HIPAA (Health Insurance Portability and Accountability Act) is a US federal law that sets standards for protecting sensitive patient health information. The HIPAA Security Rule establishes requirements for safeguarding electronic Protected Health Information (ePHI).

## Who needs HIPAA compliance?

<CardGroup cols={2}>
  <Card title="Covered entities" icon="hospital">
    Healthcare providers, health plans, and healthcare clearinghouses that transmit health information electronically.
  </Card>

  <Card title="Business associates" icon="handshake">
    Any organization that creates, receives, maintains, or transmits ePHI on behalf of a covered entity — including SaaS vendors, cloud providers, and consultants.
  </Card>
</CardGroup>

## Three categories of safeguards

<CardGroup cols={3}>
  <Card title="Administrative" icon="clipboard-list">
    Policies and procedures for managing ePHI — risk analysis, workforce training, contingency planning, and access management.
  </Card>

  <Card title="Physical" icon="building-lock">
    Physical measures to protect systems and facilities — facility access controls, workstation security, and device disposal.
  </Card>

  <Card title="Technical" icon="laptop-code">
    Technology controls to protect ePHI — access controls, audit controls, integrity controls, transmission security, and encryption.
  </Card>
</CardGroup>

## Key HIPAA requirements

| Requirement                       | Description                                            |
| --------------------------------- | ------------------------------------------------------ |
| **Risk Analysis**                 | Conduct thorough assessment of potential risks to ePHI |
| **Access Controls**               | Limit access to ePHI to authorized individuals         |
| **Audit Controls**                | Track and monitor access to systems containing ePHI    |
| **Encryption**                    | Encrypt ePHI at rest and in transit                    |
| **Business Associate Agreements** | Execute BAAs with all vendors handling ePHI            |
| **Breach Notification**           | Report breaches to affected individuals and HHS        |
| **Training**                      | Regular workforce security awareness training          |

<Warning>
  HIPAA violations can result in fines from **$100 to $50,000 per violation**, with annual maximums of **\$1.5 million per violation category**. Criminal penalties can include imprisonment.
</Warning>

## How DSALTA helps

* **HIPAA-specific controls** mapped to Security Rule requirements
* **Administrative, physical, and technical safeguards** pre-configured
* **Risk assessment tools** with the risk register
* **Vendor management** for Business Associate tracking
* **Policy templates** for HIPAA-required documentation
* **Cross-framework mapping** — overlaps with SOC 2, ISO 27001, and GDPR

## Frequently asked questions

<AccordionGroup>
  <Accordion title="Do I need HIPAA if I'm a SaaS company?" icon="cloud">
    Yes, if your software stores, processes, or transmits ePHI on behalf of healthcare organizations. You are considered a Business Associate and must comply with HIPAA requirements.
  </Accordion>

  <Accordion title="What is a Business Associate Agreement (BAA)?" icon="file-contract">
    A BAA is a contract between a covered entity and a business associate that outlines responsibilities for protecting ePHI. DSALTA helps you track BAAs through vendor management.
  </Accordion>

  <Accordion title="Is there a HIPAA certification?" icon="certificate">
    No. Unlike SOC 2 or ISO 27001, there is no official HIPAA certification. Compliance is demonstrated through documentation, risk assessments, and audit readiness — which DSALTA provides.
  </Accordion>
</AccordionGroup>

## How DSALTA automates this

**343** of DSALTA's automated checks contribute evidence to this framework, drawn from **73** integrations. Browse them in the [Compliance Tests](/tests/overview) catalog. They are linked through the controls each check satisfies, so a single check usually contributes to several frameworks at once — the count is not a list of checks unique to this one.

## Related pages

* [Active Frameworks](/guides/compliance/frameworks-active)
* [Risk Register](/guides/data-library/risk-register)