HIPAA Compliance
the risk analysis is the document.

HIPAA applies to two main categories. Covered entities: health plans, healthcare clearinghouses, and healthcare providers that transmit health information electronically (which is functionally all of them). Business associates: any vendor that creates, receives, maintains, or transmits protected health information on behalf of a covered entity. The Privacy Rule, Security Rule, and Breach Notification Rule apply to both covered entities and business associates — though OCR has historically focused enforcement on covered entities, that has shifted in recent years with direct BA enforcement actions.

Covered entities have a direct relationship with patients or plan members — they are the source of the PHI. Business associates have a service relationship with the covered entity (or with another business associate as a subcontractor) that requires access to PHI. Examples of business associates: cloud hosting providers, EHR vendors, billing services, legal counsel, IT support companies (including WCC when handling PHI environments). Each business associate relationship requires a written Business Associate Agreement (BAA). Business associates can be fined directly by OCR.

45 CFR § 164.308(a)(1)(ii)(A) requires every covered entity and business associate to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. Written. Enterprise-wide. Updated when the environment changes. OCR cites failure to conduct an accurate and thorough risk analysis in nearly every Security Rule settlement — it is the most-cited finding by a wide margin. The risk analysis is the foundation document that all other Security Rule safeguards map to.

45 CFR §§ 164.400-414 require notification of a breach of unsecured PHI within 60 days of discovery. For breaches affecting 500 or more individuals: notify affected individuals, HHS via the HHS Breach Notification Portal, and prominent media in the affected geographic area. For breaches affecting fewer than 500: notify affected individuals within 60 days plus file an annual log with HHS by March 1 of the following year. The 60-day clock starts at discovery, not investigation completion. Business associates must notify covered entities, typically within 60 days, allowing the covered entity to meet its own notification obligations.

Encryption is an "addressable" implementation specification under 45 CFR § 164.312(a)(2)(iv) and § 164.312(e)(2)(ii) — meaning the covered entity must either implement encryption, document why it is not reasonable and appropriate, or implement an equivalent alternative. In practice: every modern HIPAA Security Rule program implements encryption at rest (AES-256) and in transit (TLS 1.3). Encrypted PHI is excluded from the breach notification requirement when properly encrypted. The "encryption is not required" technicality is not a defensible position with OCR — the answer is essentially always encrypt.

Pricing depends on organization type, user count, ePHI environment complexity, and existing maturity. A standalone HIPAA Security Rule program for a small practice (under 25 users) typically runs $2,500-$5,500 per month covering risk analysis, security officer function, training, monitoring, and IR. Mid-market healthcare organizations (50-300 users) typically run $5,500-$12,000 per month. Bundled into broader managed IT typically costs less than standalone. Initial risk analysis is typically a fixed-fee engagement of $8,000-$18,000 depending on environment complexity.