Getting Started with HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for protecting the privacy and security of individually identifiable health information in the United States. HIPAA applies to covered entities (health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically) and their business associates. HIPAA compliance is enforced by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). Matproof maps HIPAA requirements to controls, policies, and evidence workflows so you can demonstrate compliance during OCR audits and respond to breach investigations.

Activate HIPAA under Settings - Frameworks - HIPAA. Controls are pre-populated across the Privacy Rule, Security Rule, and Breach Notification Rule.

Am I in Scope?

Entity Type	Definition	Key Obligations
Covered Entity	Health plans, healthcare clearinghouses, healthcare providers who transmit PHI electronically	Full compliance with Privacy, Security, and Breach Notification Rules
Business Associate	Any entity that creates, receives, maintains, or transmits PHI on behalf of a covered entity	Security Rule compliance, breach notification, Business Associate Agreement (BAA) required

If you handle Protected Health Information (PHI) for a US healthcare organization - even as a technology vendor or cloud provider - you are likely a business associate and must comply with HIPAA.

HIPAA Rules in Matproof

Privacy Rule

Policies, ControlsGoverns the use and disclosure of PHI. Requires a Notice of Privacy Practices, patient rights (access, amendment, accounting of disclosures), and minimum necessary standards.

Security Rule

Controls, EvidenceRequires administrative, physical, and technical safeguards to protect electronic PHI (ePHI). Includes risk analysis, access controls, audit controls, transmission security, and encryption.

Breach Notification Rule

IncidentsRequires notification to affected individuals, HHS, and (for breaches affecting 500+ individuals) the media. Notification deadlines: 60 days for individuals and HHS, without unreasonable delay for business associates to covered entities.

Business Associate Agreements

Vendor RiskTrack BAAs with all business associates. Ensure agreements include required provisions for PHI handling, breach notification, and termination.

Security Rule Safeguards

The Security Rule organizes requirements into three categories:

Administrative Safeguards

Standard	Requirement	Matproof Control
Security Management Process	Risk analysis, risk management, sanction policy, information system activity review	Risk Management, Controls
Assigned Security Responsibility	Designate a security official	People
Workforce Security	Authorization, supervision, clearance procedures, termination procedures	People, Controls
Information Access Management	Access authorization, access establishment and modification	Controls
Security Awareness and Training	Security reminders, malicious software protection, log-in monitoring, password management	People, Controls
Security Incident Procedures	Response and reporting	Incidents
Contingency Plan	Data backup, disaster recovery, emergency mode operations, testing, criticality analysis	Policies, Controls
Evaluation	Periodic technical and nontechnical evaluation	Audit Programs

Physical Safeguards

Standard	Requirement
Facility Access Controls	Contingency operations, facility security plan, access control and validation, maintenance records
Workstation Use	Policies for workstation use and security
Workstation Security	Physical safeguards for workstations accessing ePHI
Device and Media Controls	Disposal, media re-use, accountability, data backup and storage

Technical Safeguards

Standard	Requirement
Access Control	Unique user identification, emergency access procedure, automatic logoff, encryption and decryption
Audit Controls	Mechanisms to record and examine activity in information systems containing ePHI
Integrity	Mechanisms to authenticate ePHI and protect against improper alteration or destruction
Person or Entity Authentication	Verify the identity of persons seeking access to ePHI
Transmission Security	Integrity controls and encryption for ePHI transmitted over networks

Recommended Implementation Plan

Penalties

Tier	Violation Type	Penalty per Violation	Annual Maximum
1	Lack of knowledge	$137 -$ 68,928	$2,067,813
2	Reasonable cause	$1,379 -$ 68,928	$2,067,813
3	Willful neglect (corrected within 30 days)	$13,785 -$ 68,928	$2,067,813
4	Willful neglect (not corrected)	$68,928+	$2,067,813

Penalty amounts are adjusted annually for inflation. Criminal penalties (up to $250,000 and imprisonment) may apply for knowing misuse of PHI.

Next Steps

Risk Management - conducting your HIPAA risk analysis
Vendor Risk - managing Business Associate Agreements
Incidents - configuring breach notification workflows
People - workforce training tracking and access management

EU Regulations

German Regulations

International Standards

Industry-Specific

Getting Started with HIPAA

Getting Started with HIPAA

Am I in Scope?

HIPAA Rules in Matproof

Privacy Rule

Security Rule

Breach Notification Rule

Business Associate Agreements

Security Rule Safeguards

Administrative Safeguards

Physical Safeguards

Technical Safeguards

Recommended Implementation Plan

Penalties

Next Steps

​Getting Started with HIPAA

​Am I in Scope?

​HIPAA Rules in Matproof

Privacy Rule

Security Rule

Breach Notification Rule

Business Associate Agreements

​Security Rule Safeguards

​Administrative Safeguards

​Physical Safeguards

​Technical Safeguards

​Recommended Implementation Plan

​Penalties

​Next Steps

Getting Started with HIPAA

Am I in Scope?

HIPAA Rules in Matproof

Security Rule Safeguards

Administrative Safeguards

Physical Safeguards

Technical Safeguards

Recommended Implementation Plan

Penalties

Next Steps