Openlane
HIPAA logo

HIPAA compliance

Connect the administrative, physical, and technical safeguards you operate to the risk analysis, training records, and business associate agreements behind them.

No credit card. 30-day free trial.

Safeguards connected to the risk analysis behind them

Each safeguard carries the policy that describes it, the risk it treats, and the evidence that shows it operating, on the same record as your BAAs and training.

Security Rule safeguards

Track administrative, physical, and technical safeguards as controls with owners. Each one links to the policy that describes it and the evidence that shows it operating.

  • Administrative, physical, and technical safeguards as controls
  • Addressable decisions documented with their rationale

Risk analysis

Inventory the systems that hold ePHI, record the threats and vulnerabilities to each, and score the risks by impact and likelihood in one register.

  • ePHI systems in the registry
  • Risk register with treatment decisions

Business associate agreements

Keep every business associate in the vendor registry with its agreement, renewal date, and review history, so no one handles PHI without a BAA on file.

  • BAA and renewal dates on each vendor record
  • Vendor reviews on a schedule

Breach notification procedures

Keep incident response procedures aligned with the Breach Notification Rule as policies, and track each incident, its risk assessment, and its notifications with owners and dates.

  • Incident records with dates and owners
  • Procedures linked to the controls they support

Access and audit evidence

Attach audit log samples and access review results to the safeguards that require them, and keep the documentation the Security Rule asks you to retain for six years on the same record.

  • Recurring access reviews
  • Documentation kept with its history

Workforce training

Assign HIPAA training as a recurring campaign, track who has completed it, and keep the records beside the training safeguard they demonstrate.

  • Recurring training campaigns
  • Completion tracked per person
Part of Compliance

Connect the safeguards to the risk analysis

Put your policies, training records, and business associate agreements on the same record as the controls they support.

Request a Framework

No credit card. 30-day free trial.

Frequently asked questions

HIPAA basics

What is HIPAA compliance?

HIPAA (the Health Insurance Portability and Accountability Act) is the US federal law that sets national standards for protecting health information. Its Privacy Rule, Security Rule, and Breach Notification Rule apply to covered entities (health care providers, health plans, and health care clearinghouses) and to the business associates that handle protected health information on their behalf.

What is Protected Health Information (PHI)?

PHI is individually identifiable health information created, received, maintained, or transmitted by a covered entity or business associate, including medical records, billing information, and insurance details. Electronic PHI (ePHI) is PHI in electronic form and is what the Security Rule's safeguards protect.

Who needs to comply with HIPAA?

Covered entities and their business associates. A business associate is any organization that creates, receives, maintains, or transmits PHI on a covered entity's behalf, which includes cloud providers, IT vendors, billing companies, consultants, and SaaS platforms that store or process PHI.

What is a Business Associate Agreement (BAA)?

A BAA is the contract between a covered entity and a business associate (or between a business associate and its subcontractor) that sets out how PHI may be used, the safeguards required, breach reporting duties, and what happens when the agreement ends. A business associate must have one in place before handling PHI.

Security and Privacy Rules

What are the three types of HIPAA safeguards?

The Security Rule requires three kinds of safeguards for ePHI. Administrative safeguards are policies, procedures, training, and risk management. Physical safeguards cover facility access, workstation security, and device and media controls. Technical safeguards cover access control, audit controls, integrity, authentication, and transmission security.

Is encryption required under HIPAA?

Encryption is an addressable specification under the Security Rule. You must implement it where reasonable and appropriate, or document why it is not and put an equivalent measure in place. PHI encrypted to HHS guidance is not "unsecured PHI", so its loss does not trigger breach notification.

What are the HIPAA audit control requirements?

The Security Rule requires audit controls that record and examine activity in systems containing ePHI. It does not prescribe log fields; you decide what to log based on your risk analysis and review the logs regularly. The six-year retention rule applies to required documentation such as policies, procedures, and risk analyses, not to every log.

How long must HIPAA documentation be retained?

Covered entities and business associates must retain required documentation for six years from the date it was created or last in effect, whichever is later. That includes policies and procedures, risk analyses, training records, and BAAs.

Openlane for HIPAA

How does Openlane help with HIPAA compliance?

Openlane holds your HIPAA program in one record: each safeguard tied to its owner, its evidence, and the risk analysis that justified it. Business associate agreements, policies, and training records sit beside the controls they support instead of in separate folders.

Can Openlane help with breach notification requirements?

Openlane keeps your Breach Notification Rule procedures as policies linked to the controls they support, and tracks each incident, its risk assessment, and its notifications with owners and dates. The rule's deadlines are yours to meet: individuals within 60 days of discovery; HHS within 60 days for breaches affecting 500 or more people, or in the annual log for smaller ones.

Does Openlane support multi-framework compliance?

Many organizations need HIPAA alongside SOC 2 or ISO 27001, and Openlane maps one control to every framework it satisfies, so the access control you implement for the Security Rule also answers the SOC 2 or Annex A control, with unlimited frameworks at no added charge.

© Copyright theopenlane, Inc. All Rights Reserved.

Openlane on Product Hunt
California Consumer Privacy Act (CCPA) Opt-Out IconYour Privacy ChoicesNotice at Collection