Meet every HIPAA rule, from Privacy to Breach Notification

HIPAA Administrative Simplification is the set of US federal regulations in 45 CFR Parts 160, 162 and 164 that HHS issued under Title II of HIPAA. Part 160 covers general provisions, preemption and enforcement, Part 162 covers electronic transaction standards, code sets and identifiers, and Part 164 contains the Security, Breach Notification and Privacy Rules. HHS publishes them together as a combined regulation text.

The 2013 Omnibus Rule amended the Administrative Simplification regulations to implement the HITECH Act. It made business associates and their subcontractors directly liable for parts of the Security and Privacy Rules, replaced the harm threshold for breaches with a presumption of breach unless a risk assessment shows a low probability of compromise, strengthened individual rights and limits on marketing and sale of PHI, and updated the Enforcement Rule. It was published on 25 January 2013 and most provisions required compliance by 23 September 2013.

Covered entities must comply: health plans, healthcare clearinghouses and healthcare providers that transmit health information electronically in connection with standard transactions. Since the 2013 Omnibus Rule, business associates that create, receive, maintain or transmit protected health information for a covered entity, and their subcontractors, are also directly liable for the Security Rule and for certain Privacy and Breach Notification Rule requirements. Software and cloud providers serving US healthcare are often business associates.

HHS Office for Civil Rights can impose civil money penalties under 45 CFR Part 160 Subpart D, using tiers based on the level of culpability, from violations the entity did not know about to wilful neglect that is not corrected. Penalty amounts are adjusted for inflation each year. Knowingly obtaining or disclosing individually identifiable health information in breach of HIPAA can also lead to criminal penalties enforced by the US Department of Justice.

Under 45 CFR Part 164 Subpart D, covered entities must notify affected individuals of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. Breaches affecting more than 500 residents of a state or jurisdiction also require notice to prominent media outlets, and all breaches must be reported to HHS. Business associates must notify the covered entity, and a law enforcement delay can apply.

HIPAA is a US legal requirement, while ISO 27001 and SOC 2 are voluntary assurance frameworks, so certification or an attestation report does not by itself prove HIPAA compliance. Many Security Rule safeguards overlap with ISO 27001 and SOC 2 controls, such as risk assessment, access control and incident response. GDPR is an EU and UK data protection law; both protect personal data, but their scope, legal bases and breach timelines differ.

No. HHS does not recognise any official HIPAA certification for organisations. Compliance is demonstrated by meeting the regulations, documenting policies and risk analyses, signing business associate agreements and keeping required records, typically for six years. Organisations often use independent assessments, or a SOC 2 report that includes HIPAA criteria, to show customers how they meet the requirements, but HHS Office for Civil Rights decides compliance through complaints, investigations and compliance reviews.

Yes. HIPAA Administrative Simplification is supported in OneClickComply today. The same controls, evidence and policies you use for frameworks such as ISO 27001 or SOC 2 are mapped to the Security, Privacy and Breach Notification requirements, so work done once counts towards each. Automated evidence collection and continuous monitoring keep your records current. OneClickComply does not certify HIPAA compliance.