The Health Insurance Portability and Accountability Act sets the standard for protecting sensitive patient health information. Any organisation handling Protected Health Information must comply.
What is HIPAA?
The Health Insurance Portability and Accountability Act (HIPAA) was enacted in 1996 and establishes national standards for the protection of Protected Health Information (PHI). It applies to covered entities (healthcare providers, health plans, healthcare clearinghouses) and their business associates.
HIPAA is enforced by the Office for Civil Rights (OCR) within the US Department of Health and Human Services (HHS). Penalties for non-compliance range from $100 to $50,000 per violation, with a maximum of $1.9 million per violation category per year.
For UK and European organisations providing services to US healthcare entities, HIPAA compliance is often a contractual requirement, even if not directly mandated by US law.
Compliance requirements
HIPAA compliance spans administrative, physical, and technical safeguards across three primary rules.
Establishes national standards for the protection of individually identifiable health information, defining permitted uses and disclosures of Protected Health Information (PHI).
Sets standards for protecting electronic PHI (ePHI) through administrative, physical, and technical safeguards. Applies to covered entities and business associates.
Requires covered entities to notify affected individuals, HHS, and in some cases the media, following a breach of unsecured PHI within 60 days.
Written contracts with all business associates who handle PHI on your behalf, defining permitted uses, safeguards, and breach reporting obligations.
A thorough and accurate assessment of potential risks and vulnerabilities to ePHI confidentiality, integrity, and availability, and a risk management plan to address them.
All workforce members must receive HIPAA training appropriate to their role, with documented completion records maintained.
Compliance process
Netru builds HIPAA compliance programmes that satisfy OCR requirements and stand up to scrutiny.
We conduct a comprehensive HIPAA risk analysis, identifying all PHI flows, assessing threats and vulnerabilities, and producing a risk register.
Your current administrative, physical, and technical safeguards are assessed against HIPAA requirements, with a prioritised remediation roadmap.
We develop or update your HIPAA policies, procedures, and workforce training programme to meet regulatory requirements.
All Business Associate Agreements are reviewed and updated to ensure they meet current HIPAA requirements.
Technical safeguards, encryption, access controls, audit logging, and transmission security, are implemented and documented.
Annual risk analysis updates, workforce training refreshers, and incident response support to maintain HIPAA compliance.
How Netru delivers it
Our team has deep experience in healthcare compliance. We build HIPAA programmes that are practical, defensible, and designed to scale with your organisation.
Talk to our teamBefore you talk to anyone