# HIPAA compliance for SaaS: a practical implementation guide

> HIPAA is a US law, not a certification. If your software stores, processes or transmits protected health information for a hospital, health plan or digital-health customer, you are a business associate and the Security, Privacy and Breach Notification Rules apply to you directly. This guide explains what is in scope, the order to do the work in, the controls that take real engineering effort, and how HHS enforces the rules as of October 2026.

- Source: https://support.icompaas.com/compliance/hipaa
- Reviewed: 2026-10-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

## At a glance

- **Issuing body:** US Department of Health and Human Services, Office for Civil Rights (OCR)
- **Current rules:** 45 CFR Parts 160 and 164: Privacy, Security and Breach Notification Rules; the Security Rule was last substantively amended by the 2013 Omnibus Rule (compliance date 23 September 2013)
- **Pending change:** Security Rule NPRM published 6 January 2025 (90 FR 898). Not final as of October 2026; listed as a long-term action with final action projected July 2027
- **Applies to:** Covered entities (health plans, clearinghouses, most providers) and business associates, including subcontractors that handle PHI
- **Assessment type:** No HHS certification. Self-performed risk analysis, customer due diligence, OCR complaint investigations, breach investigations and periodic audits
- **Typical first-time timeline:** 3 to 6 months for a cloud-native SaaS that already has a SOC 2; longer without one (practitioner estimate)
- **Renewal / cycle:** Continuous. Risk analysis reviewed periodically (annually in practice); documentation retained 6 years
- **Penalties:** Civil money penalties in four culpability tiers, from 145 to 2,190,294 US dollars per violation, capped at 2,190,294 per identical provision per calendar year (inflation adjustment published 28 January 2026); criminal referral to the Department of Justice is possible

## Who HIPAA applies to, and what triggers it for a SaaS company

HIPAA regulates two groups. **Covered entities** are health plans, health care clearinghouses and health care providers that transmit standard transactions (claims, eligibility checks) electronically. **Business associates** are anyone who creates, receives, maintains or transmits protected health information (PHI) on a covered entity's behalf, plus any **subcontractor** that does the same for a business associate ([45 CFR 160.103](https://www.ecfr.gov/current/title-45/section-160.103)). A SaaS platform used by a clinic, a payer or a digital-health company to hold patient data is a business associate. Since the 2013 Omnibus Rule, business associates are _directly_ liable to HHS for Security Rule compliance, for the Privacy Rule obligations in their contract and for breach notification; the contract chain does not shield you.

Two points catch engineering teams out. First, HHS's [cloud computing guidance](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html) says a cloud provider that only stores encrypted ePHI and never holds the key is still a business associate. Storing ciphertext does not take you out of scope. Second, HIPAA covers electronic PHI wherever it lands: logs, support tickets, analytics events and backups included.

The commercial trigger is usually a **business associate agreement (BAA)**. A hospital or health plan will not send PHI without one, and their procurement team will follow it with a security questionnaire that asks for your risk analysis, policies and often a SOC 2 report. The legal trigger is the law itself: once PHI is on your systems, the Security Rule and the Breach Notification Rule apply whether or not you have signed anything.

Ignoring it has three consequences. OCR investigates complaints and reviews every breach affecting 500 or more people, and settles with a resolution agreement plus a corrective action plan it monitors for two or three years. Civil money penalties are tiered by culpability; the January 2026 inflation adjustment sets the per-violation range at 145 to 2,190,294 US dollars and the calendar-year cap at 2,190,294 per identical provision ([91 FR 3665](https://www.govinfo.gov/content/pkg/FR-2026-01-28/html/2026-01688.htm)). Under a 2019 notice of enforcement discretion, HHS applies lower annual caps for the three lower tiers (25,000, 100,000 and 250,000 US dollars, inflation-adjusted) and keeps the 1.5 million cap, likewise adjusted, only for uncorrected wilful neglect ([84 FR 18151](https://www.govinfo.gov/content/pkg/FR-2019-04-30/html/2019-08530.htm)). The third consequence is commercial: a public breach listing or a lost BAA negotiation costs more than most penalties.

## How the rules are structured, and what has changed recently

The statute is the Health Insurance Portability and Accountability Act of 1996, strengthened by the HITECH Act of 2009. The rules you implement are in 45 CFR Part 160 (definitions and enforcement) and Part 164: Subpart C is the **Security Rule** (164.302 to 164.318), Subpart D the **Breach Notification Rule** (164.400 to 164.414) and Subpart E the **Privacy Rule** (164.500 to 164.534).

### The Security Rule

It applies to electronic PHI only and is organised into nine administrative standards (164.308), four physical standards (164.310), five technical standards (164.312), organisational requirements for BAAs (164.314) and documentation requirements (164.316). Each standard has implementation specifications that are either **required** or **addressable**. Addressable does not mean optional: under [164.306(d)](https://www.ecfr.gov/current/title-45/section-164.306) you must assess whether the specification is reasonable and appropriate in your environment, implement it if so, and otherwise document why not and implement an equivalent alternative. Encryption, automatic logoff and integrity mechanisms are all addressable today; MFA is not named at all. The rule is deliberately technology-neutral ([flexibility of approach](https://support.icompaas.com/compliance/hipaa/164-306-b-flexibility-of-approach)), which is why the written risk analysis carries so much weight.

### The Privacy Rule for a business associate

A SaaS business associate does not issue notices of privacy practices, but it is bound by its BAA to use PHI only as permitted, apply the [minimum necessary](https://support.icompaas.com/compliance/hipaa/164-514-d-1-minimum-necessary-requirements-standard) standard, flow the same terms down to subcontractors, and support the customer's duties to give individuals access, amendments and an accounting of disclosures ([164.504(e)](https://support.icompaas.com/compliance/hipaa/164-504-e-business-associate-contracts)). Covered entities must act on access requests within 30 days, with one 30-day extension ([164.524(b)(2)](https://support.icompaas.com/compliance/hipaa/164-524-b-2-timely-action)), so your export features matter.

### The Breach Notification Rule

An impermissible use or disclosure of unsecured PHI is presumed to be a breach unless a documented four-factor risk assessment shows a low probability of compromise ([164.402](https://support.icompaas.com/compliance/hipaa/164-402-a-definitions-breach-risk-assessment)). Individuals, HHS and (above 500 residents of a state) the media must be notified without unreasonable delay and no later than 60 calendar days after discovery; a business associate has the same 60-day outer limit to notify its covered entity ([Subpart D](https://www.ecfr.gov/current/title-45/part-164/subpart-D)).

### What has changed

-   **2021 HITECH amendment.** Public Law 116-321 requires HHS to consider whether you had _recognised security practices_ (the NIST Cybersecurity Framework or the 405(d) programme) in place for the previous 12 months when setting fines, audit length and settlement terms ([text](https://www.govinfo.gov/content/pkg/PLAW-116publ321/html/PLAW-116publ321.htm)). It can only mitigate, never increase.
-   **Security Rule NPRM, January 2025.** HHS proposed the first Security Rule rewrite since 2013 ([90 FR 898](https://www.govinfo.gov/content/pkg/FR-2025-01-06/html/2024-30983.htm)): remove the required/addressable distinction; keep a written technology asset inventory and network map; deploy MFA on all technology assets, with limited exceptions; encrypt all ePHI at rest and in transit with narrow exceptions; vulnerability scans at least every six months and penetration testing; restore critical systems and data within 72 hours; review the risk analysis at least every 12 months; notify other regulated entities within 24 hours when a workforce member's access ends; and a documented compliance audit every 12 months. Comments closed 7 March 2025. **As of October 2026 it is pending, not final and not withdrawn.** HHS's NPRM page states the current Security Rule remains in effect, and the 2026 Unified Agenda moved RIN 0945-AA22 to long-term actions with final action projected for July 2027 ([reginfo.gov](https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0945-AA22)). If finalised as proposed, compliance would be due 240 days after publication.
-   **Reproductive health privacy rule.** Most of the April 2024 Privacy Rule amendment was vacated by a federal court on 18 June 2025; only some notice-of-privacy-practices changes survive ([HHS](https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/index.html)). Little of this touches a SaaS business associate.

## Scoping: deciding what is in and out

Scope is defined by data, not by org chart. Start with a written inventory of every place ePHI is created, received, stored or transmitted, and the systems that can affect its confidentiality, integrity or availability. For a cloud SaaS that means production databases and object stores, caches, queues, search indexes, log pipelines, backups, data warehouses, the support desk, email, chat tools, CI artefacts, and every laptop that can reach any of them. The proposed rule would make this inventory and a network map explicit standards; OCR already expects it as the foundation of the risk analysis.

Then draw the boundary and shrink it deliberately:

-   **Segregate.** Put PHI workloads in dedicated cloud accounts, subscriptions or projects. Everything else becomes out of scope, and your BAA-eligible-services rule becomes enforceable with an allow-list.
-   **De-identify where you can.** Data stripped of the 18 Safe Harbor identifiers, or certified by an expert, is not PHI ([164.514(b)](https://support.icompaas.com/compliance/hipaa/164-514-b-de-identification-of-protected-health-information)). Analytics and ML pipelines usually only need de-identified or limited data sets.
-   **Map the business associate chain.** Upstream: which customers are covered entities or business associates, and which BAA terms you signed. Downstream: every subprocessor that touches PHI (cloud provider, email, monitoring, error tracking, support desk, LLM APIs) needs its own BAA ([164.314(a)(2)(iii)](https://support.icompaas.com/compliance/hipaa/164-314-a-2-iii-business-associate-contracts-with-subcontractors)). If a vendor will not sign one, PHI cannot go there.
-   **Decide who is a workforce member.** Contractors whose work you directly control are workforce under 160.103 and need the same training, sanctions and termination procedures.

The scoping mistakes that cost the most: assuming PHI never reaches logs or error trackers (it does, through request bodies and stack traces); copying production data to staging without the same controls; treating the cloud provider's BAA as covering services it excludes; and leaving backups and snapshots out of the inventory, which is where most "we didn't know it was there" findings come from.

## Implementation roadmap

The order matters. OCR's enforcement actions almost always cite a missing or inadequate risk analysis first, so the risk analysis comes before the control build, not after it.

### Weeks 0 to 2: ownership, inventory, contracts

-   Name a [security official](https://support.icompaas.com/compliance/hipaa/164-308-a-2-assigned-security-responsibility) in writing. For a small SaaS this is usually the CTO or head of engineering; what matters is that one person owns the programme.
-   Complete the ePHI inventory and data-flow diagram described under scoping. Store it where it will be maintained (the repo, not a slide).
-   Execute the cloud BAAs: AWS through AWS Artifact, Microsoft through the Product Terms and Data Protection Addendum (no separate signature), Google Cloud through the console. Record the BAA-eligible service list you will enforce.
-   Inventory customer BAAs and subprocessor BAAs; close gaps or remove PHI from the gap.

### Weeks 2 to 6: risk analysis and policy set

-   Perform the [risk analysis](https://support.icompaas.com/compliance/hipaa/164-308-a-1-ii-a-security-management-process-risk-analysis) against the inventory: threats, vulnerabilities, likelihood, impact, existing controls, residual risk. Follow HHS's [risk analysis guidance](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html) and NIST SP 800-66 Rev. 2; the free HHS SRA Tool is adequate for a first pass. The output is a dated document plus a risk register with owners.
-   Write the [risk management plan](https://support.icompaas.com/compliance/hipaa/164-308-a-1-ii-b-security-management-process-risk-management): which risks you will treat, by whom, by when. This becomes the backlog for the next phase.
-   Issue the policy set required by 164.316: security management, workforce security and termination, access authorisation, awareness and training, incident response, contingency planning, device and media controls, sanctions, BAA management. Each policy needs an owner and a review date.
-   Run the first [workforce training](https://support.icompaas.com/compliance/hipaa/164-308-a-5-i-security-awareness-and-training) and keep the attendance record.

### Weeks 6 to 12: control build

-   Identity: SSO, unique IDs, MFA everywhere, least-privilege roles, break-glass procedure, automated deprovisioning.
-   Data protection: encryption at rest with customer-managed keys, TLS 1.2 or higher everywhere, PHI scrubbing in logs and error trackers.
-   Audit: centralised immutable logs, application-level access logs for PHI records, a written review cadence with tickets as evidence.
-   Resilience: backups with immutability, a tested restore, a [criticality analysis](https://support.icompaas.com/compliance/hipaa/164-308-a-7-ii-e-contingency-plan-application-and-data-criticality-analysis) and documented RTO/RPO.
-   Incident response and breach playbook: triage, four-factor breach risk assessment template, notification templates, the 60-day clock, HHS portal submission steps.
-   Endpoints: MDM with disk encryption, screen lock and remote wipe for every laptop that can reach PHI ([164.310(d)](https://support.icompaas.com/compliance/hipaa/164-310-d-1-device-and-media-controls)).

### Ongoing

-   Quarterly access reviews; annual risk analysis refresh and on any material change; annual contingency test; annual training; annual [evaluation](https://support.icompaas.com/compliance/hipaa/164-308-a-8-evaluation) of the whole programme.
-   Keep the under-500 breach log and file it with HHS within 60 days of the end of each calendar year.
-   Retain every policy, record and assessment for six years and track the Security Rule NPRM so that MFA, 72-hour restoration and annual audits are already in place if it is finalised.

## The hardest controls, in AWS, Azure and GCP terms

These are the requirements that consume engineering time and that OCR cites most often. "Done" means configured, evidenced and written into the risk analysis.

### 1\. Risk analysis and risk management

[164.308(a)(1)(ii)(A)](https://support.icompaas.com/compliance/hipaa/164-308-a-1-ii-a-security-management-process-risk-analysis) and [(B)](https://support.icompaas.com/compliance/hipaa/164-308-a-1-ii-b-security-management-process-risk-management). A vendor questionnaire or a cloud posture score is not a risk analysis. Done looks like: a written, enterprise-wide document that lists every ePHI asset, the threats and vulnerabilities to each, likelihood and impact, and a risk register with owners and dates, reviewed at least annually. Cloud posture tools feed it: AWS Security Hub CSPM and AWS Config conformance packs; Microsoft Defender for Cloud with the Azure Policy HIPAA/HITRUST initiative; Google Security Command Center. Export their findings into the register rather than treating the dashboard as the deliverable.

### 2\. Unique user identification, authentication and least privilege

[164.312(a)(1)](https://support.icompaas.com/compliance/hipaa/164-312-a-1-access-control), [(a)(2)(i)](https://support.icompaas.com/compliance/hipaa/164-312-a-2-i-access-control-unique-user-identification), [164.312(d)](https://support.icompaas.com/compliance/hipaa/164-312-d-person-or-entity-authentication) and [164.308(a)(4)(ii)(B)](https://support.icompaas.com/compliance/hipaa/164-308-a-4-ii-b-information-access-management-access-authorization). MFA is not yet mandated by the rule, but the proposed rule would require it on every technology asset, with limited exceptions, and OCR already expects it. AWS: IAM Identity Center with your IdP, no IAM users with long-lived keys, root account locked with hardware MFA, MFA enforced by policy condition. Azure: Entra ID Conditional Access requiring phishing-resistant MFA, Privileged Identity Management for just-in-time admin roles. GCP: Cloud Identity with enforced 2-Step Verification, IAM bindings on groups only, the organisation policy that disables service-account key creation. Done: zero shared accounts, every human and service identity traceable in logs, documented approval for each PHI access role.

### 3\. Encryption at rest and in transit

[164.312(a)(2)(iv)](https://support.icompaas.com/compliance/hipaa/164-312-a-2-iv-access-control-encryption-and-decryption) and [164.312(e)(2)(ii)](https://support.icompaas.com/compliance/hipaa/164-312-e-2-ii-transmission-security-encryption). Both are addressable, but encryption also decides whether an incident is a reportable breach: ePHI encrypted per NIST SP 800-111 (at rest) or SP 800-52 (in transit) with uncompromised keys is not "unsecured PHI" under HHS [guidance](https://www.hhs.gov/hipaa/for-professionals/breach-notification/guidance/index.html). AWS: KMS customer-managed keys with rotation, S3 default encryption plus bucket policies denying unencrypted puts, RDS and EBS encryption enabled at creation (it cannot be switched on in place later), TLS 1.2 or higher security policies on load balancers. Azure: storage encryption with customer-managed keys in Key Vault, "secure transfer required" on storage accounts, Transparent Data Encryption on SQL. GCP: encryption at rest is default; use Cloud KMS CMEK where customers require key control, and organisation policies to restrict TLS. Done: a key inventory, separation of keys from data, and no PHI store without encryption enforced by policy.

### 4\. Audit controls and information system activity review

[164.312(b)](https://support.icompaas.com/compliance/hipaa/164-312-b-audit-controls) and [164.308(a)(1)(ii)(D)](https://support.icompaas.com/compliance/hipaa/164-308-a-1-ii-d-security-management-process-information-system-activity-review). Infrastructure logs are necessary but not sufficient: you also need application-level records of who viewed or changed which patient record. AWS: an organisation CloudTrail trail to an S3 bucket with Object Lock, CloudWatch Logs for applications, GuardDuty for detection. Azure: Activity Log and diagnostic settings streamed to a Log Analytics workspace, with an archive copy in a storage account under an immutability policy, and Microsoft Sentinel for review. GCP: Cloud Audit Logs with Data Access logs enabled for PHI services, sinks to Cloud Storage with retention lock and BigQuery for analysis. The rule sets no log retention period; choose one in the risk analysis and defend it. Done: a written review cadence (weekly for alerts, monthly for access reports) with tickets showing it happened.

### 5\. Automatic logoff and session control

[164.312(a)(2)(iii)](https://support.icompaas.com/compliance/hipaa/164-312-a-2-iii-access-control-automatic-logoff). Your application needs an idle timeout and absolute session lifetime for PHI views, and so do the consoles. AWS: session duration on IAM Identity Center permission sets. Azure: Conditional Access sign-in frequency and persistent-browser controls. GCP: Google session length controls for Cloud Console and gcloud. Pair with MDM screen-lock policies on laptops. Done: timeouts documented per system and tested.

### 6\. Contingency plan: backup, disaster recovery and testing

[164.308(a)(7)(ii)(A)](https://support.icompaas.com/compliance/hipaa/164-308-a-7-ii-a-contingency-plan-data-backup-plan), [(B)](https://support.icompaas.com/compliance/hipaa/164-308-a-7-ii-b-contingency-plan-disaster-recovery-plan) and [(D)](https://support.icompaas.com/compliance/hipaa/164-308-a-7-ii-d-contingency-plan-testing-and-revision-procedure). [OCR says](https://www.hhs.gov/press-room/ocr-settles-four-ransomware-investigations.html) hacking and ransomware are the most frequent type of large breach reported to it, so this is where restoration speed is judged. AWS: AWS Backup with vault lock, cross-region copies, point-in-time recovery on RDS and DynamoDB. Azure: Azure Backup with immutable vaults and Site Recovery for compute. GCP: the Backup and DR service, multi-region buckets, Cloud SQL point-in-time recovery. Done: documented RTO/RPO per system from the criticality analysis, a restore test at least annually with results filed, and an emergency-mode runbook. Design to the proposed 72-hour restoration target now.

### 7\. Business associate chain and workforce termination

Two controls that are more process than product but fail audits constantly. [164.308(b)](https://support.icompaas.com/compliance/hipaa/164-308-b-1-business-associate-contracts-and-other-arrangements) requires a compliant BAA with every subcontractor before PHI flows; keep a register with dates and the services covered. [164.308(a)(3)(ii)(C)](https://support.icompaas.com/compliance/hipaa/164-308-a-3-ii-c-workforce-security-establish-termination-procedures) requires access to end when employment does: SCIM deprovisioning from the IdP into AWS, Entra ID and Google Workspace, with a ticket per leaver showing same-day removal.

## Evidence an investigator or customer will ask for

OCR data requests and customer due diligence overlap heavily. Keep the following organised by control, dated, and retained for **six years** from creation or from when the document was last in effect, whichever is later ([164.316(b)(2)(i)](https://support.icompaas.com/compliance/hipaa/164-316-b-2-i-documentation-time-limit)).

### Policies and plans

-   Security policy set with owners, approval dates and review history; sanction policy; incident response and breach notification procedure; contingency plan with criticality analysis; BAA template and subcontractor policy; device and media policy.

### Records

-   Risk analysis reports (every version), risk register and risk management plan with closure evidence.
-   Training records with dates and attendees; signed acknowledgements.
-   Access authorisation records, quarterly access reviews, leaver tickets.
-   Incident log, four-factor breach risk assessments, notification letters and HHS portal receipts, the under-500 annual log.
-   Contingency test results, restore test reports, evaluation reports.

### Technical exports

-   Identity reports: user list with MFA status, role assignments, service accounts and key age.
-   Encryption configuration: key inventory, storage and database encryption settings, TLS policies.
-   Logging configuration and samples of reviewed alerts; backup job reports and retention settings; vulnerability scan and patch reports.

### Contracts

-   BAAs with every covered-entity and business-associate customer, and with every subcontractor; the cloud BAAs and the eligible-services list you enforce.

The practical test: can you produce the risk analysis in force on any given date in the past six years, and the evidence that its findings were acted on? That question opens most OCR investigations.

## How HIPAA compliance is actually assessed

There is no HIPAA certificate. HHS approves no certification scheme, and AWS, Microsoft and Google all describe HIPAA on their platforms as a shared responsibility in which the customer's own configuration and compliance programme remain the customer's job. Your compliance is tested in four ways.

### 1\. Customer due diligence

This is the assessment most SaaS companies face first and most often. Expect BAA negotiation (notification windows shorter than 60 days are common), a security questionnaire and a request for an independent report. A SOC 2 Type II or a HITRUST assessment is accepted as a proxy because no HIPAA-specific attestation exists. Readiness for a cloud-native company with a SOC 2 typically takes three to six months; without one, the identity, logging and policy work adds time.

### 2\. OCR investigations

OCR opens investigations from complaints and from breach reports. Breaches affecting 500 or more individuals go to HHS within 60 days and are listed publicly; smaller ones are filed annually. An investigation starts with a data request for the risk analysis, policies and evidence above. Outcomes range from technical assistance to a **resolution agreement** with a payment and a corrective action plan monitored for two or three years, or a civil money penalty. Through 2025 and 2026 the [published actions](https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html) lean heavily on two initiatives: the Risk Analysis Initiative (13 completed investigations by April 2026, per [HHS](https://www.hhs.gov/press-room/ocr-settles-four-ransomware-investigations.html)) and ransomware investigations (OCR announced its 21st ransomware enforcement action in [July 2026](https://www.hhs.gov/press-room/hhs-ocr-settles-ransomware-investigation-with-healthcare-system.html)), alongside the long-running Right of Access initiative. Business associates are named in these actions, including a software company settling in March 2026 for failing to notify affected covered entities of a breach and failing to conduct an accurate and thorough risk analysis.

### 3\. OCR audits

HITECH requires periodic audits. The 2016 to 2017 round covered 166 covered entities and 41 business associates; the [2024 to 2025 round](https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/index.html) reviews 50 entities against the Security Rule provisions most relevant to hacking and ransomware. Audits use a published protocol, which is a useful self-assessment checklist.

### 4\. Mitigation credit

Since 2021, evidence that recognised security practices were in place for the prior 12 months must be considered when OCR sets penalties and audit scope. Aligning your programme to the NIST Cybersecurity Framework and documenting it is cheap insurance.

Cost drivers are scope breadth (how many systems hold PHI), the number of subprocessors needing BAAs, legacy components that cannot be encrypted or logged, and whether an existing SOC 2 or ISO 27001 programme already produces the evidence.

## Common mistakes in readiness reviews

1.  **A checklist instead of a risk analysis.** Entities present a vendor questionnaire or a cloud posture score. Fix: a written analysis of threats and vulnerabilities to each ePHI asset, with likelihood and impact, and a register of what you decided to do.
2.  **Treating "addressable" as optional.** No encryption on a legacy database "because it's addressable". Fix: either implement it or write the documented justification and compensating control that 164.306(d) requires. For encryption the justification almost never holds.
3.  **PHI in logs, error trackers and support tools.** Fix: scrub request bodies and identifiers at the logging library, route errors only to vendors under BAA, and block PHI uploads in the help desk.
4.  **Subprocessors without BAAs.** Monitoring, transactional email and LLM APIs are the usual gaps. Fix: a subprocessor register tied to the data-flow diagram; no PHI until the BAA is signed.
5.  **Misreading the breach clock.** 60 days is the outer limit, measured from discovery by anyone in your workforce, and "without unreasonable delay" is the actual standard. Fix: an incident procedure with the four-factor assessment template and the [business associate notification](https://support.icompaas.com/compliance/hipaa/164-410-notification-by-a-business-associate) step on day one, not day 50. Remember that the burden of proof is on you ([164.414(b)](https://support.icompaas.com/compliance/hipaa/164-414-b-burden-of-proof)).
6.  **Forgetting the under-500 annual report.** Small breaches must be logged and reported to HHS within 60 days of the calendar year end ([164.408(c)](https://support.icompaas.com/compliance/hipaa/164-408-notification-to-the-secretary)). Fix: a standing calendar entry and a log template.
7.  **Leavers who keep access.** OCR has settled cases that began with a former employee's live credentials. Fix: IdP-driven deprovisioning to every cloud and SaaS tool, verified by a leaver ticket.
8.  **Backups that were never restored.** Fix: an annual restore test with a written result, and immutability so ransomware cannot encrypt the backup too.
9.  **Stale documentation.** Policies written once, risk analysis from three years ago, no evidence of review. Fix: owners and review dates on every document, and a change trigger ("new system holding PHI") that forces a risk analysis update.
10.  **"We're HIPAA compliant because we're on AWS."** The provider's BAA covers its infrastructure, not your configuration or your application. Fix: enforce the eligible-services list and own the shared-responsibility line in writing.

## How iCompaas helps

iCompaas maps its technical control checks to the HIPAA Security Rule: access logging, encryption at rest and in transit, unique user identification, automatic logoff and integrity controls are checked continuously across your connected cloud accounts on AWS, Azure, GCP and other providers, so the evidence for [164.312(b)](https://support.icompaas.com/compliance/hipaa/164-312-b-audit-controls) or [164.312(a)(2)(iv)](https://support.icompaas.com/compliance/hipaa/164-312-a-2-iv-access-control-encryption-and-decryption) is collected as configuration changes rather than reconstructed before a customer review.

Templated Privacy and Security Rule policies come with owners and review cadences, which keeps the 164.316 documentation set current. A BAA tracker records which customers and subprocessors are under agreement and when those agreements were signed. The breach notification workflow walks responders through the 60-day clock, the HHS portal entry and the individual-notice template. Collected evidence can be exported as a pack for a customer questionnaire or an OCR data request, and the individual Security, Privacy and Breach Notification Rule provisions are explained in the control library on this site.

## Frequently asked questions

### Is HIPAA required for a SaaS company that never bills insurance?

Yes, if a covered entity or another business associate sends you protected health information to store, process or transmit on its behalf. That makes you a business associate under 45 CFR 160.103, directly liable for the Security Rule, your BAA obligations and breach notification. Billing status is irrelevant; the test is whether PHI touches your systems. HHS's cloud guidance confirms that even holding only encrypted data without the key keeps you in scope.

### Does signing the AWS, Azure or Google Cloud BAA make my product HIPAA compliant?

No. The provider's BAA covers its infrastructure and the services it lists as eligible. You remain responsible for using only those services for PHI, configuring them correctly (encryption, logging, identity), your application's own controls, your policies, your risk analysis and your people. All three providers describe HIPAA as a shared responsibility on their HIPAA pages. Treat the BAA as a prerequisite, not an outcome.

### How long do I have to report a HIPAA breach?

Notifications must go out without unreasonable delay and no later than 60 calendar days after discovery. A business associate notifies the affected covered entity within that window; the covered entity notifies individuals, HHS (at the same time as individuals for 500 or more people, otherwise in an annual report due within 60 days of year end) and, above 500 residents of a state, the media. Customer BAAs often shorten the business associate window to days, so check the contract.

### Is encryption required under HIPAA?

Today encryption is an addressable implementation specification: you must implement it if reasonable and appropriate, or document why not and apply an equivalent measure. In a cloud environment the justification for not encrypting rarely survives review. Encryption also matters for breach notification: ePHI encrypted per the NIST publications HHS cites, with keys intact, is not "unsecured" and a loss of it is not a reportable breach. The pending Security Rule update would make encryption at rest and in transit mandatory.

### Is there a HIPAA certification?

No. HHS does not approve any certification, and no certificate changes your legal exposure. Customers accept a SOC 2 Type II report or a HITRUST assessment as evidence that your controls work, and OCR expects your own risk analysis, policies and records. If a vendor offers a "HIPAA certified" badge, it is a marketing label, not a regulatory status.

### How often does a HIPAA risk analysis need to be done?

The current rule requires an accurate and thorough risk analysis and ongoing review in response to environmental or operational changes, without a fixed interval. OCR's guidance and enforcement treat an analysis that is years old or that predates a major system change as non-compliant. The January 2025 proposed rule would require review at least every 12 months. Practical answer: refresh it annually and whenever you add a system that holds PHI.

### What is the status of the 2025 HIPAA Security Rule update?

As of October 2026 it is still a proposal. HHS published the NPRM on 6 January 2025 and comments closed on 7 March 2025. HHS's NPRM page states that the current Security Rule remains in effect, and the 2026 Unified Agenda lists the rule under long-term actions with final action projected for July 2027. It has not been finalised or withdrawn. Build to its headline requirements (MFA, encryption, asset inventory, 72-hour restoration, annual audit) now; they are good practice regardless.

## Automate HIPAA with iCompaas

iCompaas connects to your cloud accounts, identity provider and version control, maps the evidence to every HIPAA requirement, runs the technical checks continuously, and keeps policies and reviews on schedule.

- [Get started](https://app.icompaas.com/signin?utm_source=support.icompaas.com&utm_medium=referral&utm_campaign=compliance-guides&utm_content=hipaa&utm_term=get-started)
- [Book a product tour](https://calendly.com/icompaas/product-tour?utm_source=support.icompaas.com&utm_medium=referral&utm_campaign=compliance-guides&utm_content=hipaa&utm_term=product-tour)

## Related compliance guides

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Most covered-entity customers accept a SOC 2 Type II report as the independent evidence that your HIPAA controls operate, since no HIPAA attestation exists.
- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): NIST publishes mappings of the Security Rule standards and implementation specifications to SP 800-53 Rev. 5 controls alongside SP 800-66 Rev. 2, so an 800-53 control set doubles as a HIPAA crosswalk.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): An ISO 27001 ISMS supplies the risk assessment, policy ownership and review cadence that the HIPAA Security Rule expects but does not spell out.

## HIPAA Security, Privacy & Breach-Notification Rules: control library

195 controls in 26 sections. Each control page has implementation guidance and the evidence to collect; append `.md` to any link for Markdown.

### Security Rule — §164.306

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.306(a) — General Requirements](https://support.icompaas.com/compliance/hipaa/164-306-a-general-requirements)
- [HIPAA (45 CFR Part 164) 164.306(b) — Flexibility of approach](https://support.icompaas.com/compliance/hipaa/164-306-b-flexibility-of-approach)

### Security Rule — §164.308

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.308(a) — Security Management Process](https://support.icompaas.com/compliance/hipaa/164-308-a-security-management-process)
- [HIPAA (45 CFR Part 164) 164.308(a)(1)(ii)(A) — Security Management Process - Risk Analysis](https://support.icompaas.com/compliance/hipaa/164-308-a-1-ii-a-security-management-process-risk-analysis)
- [HIPAA (45 CFR Part 164) 164.308(a)(1)(ii)(B) — Security Management Process - Risk Management](https://support.icompaas.com/compliance/hipaa/164-308-a-1-ii-b-security-management-process-risk-management)
- [HIPAA (45 CFR Part 164) 164.308(a)(1)(ii)(C) — Security Management Process - Sanction Policy](https://support.icompaas.com/compliance/hipaa/164-308-a-1-ii-c-security-management-process-sanction-policy)
- [HIPAA (45 CFR Part 164) 164.308(a)(1)(ii)(D) — Security Management Process -Information System Activity Review](https://support.icompaas.com/compliance/hipaa/164-308-a-1-ii-d-security-management-process-information-system-activity-review)
- [HIPAA (45 CFR Part 164) 164.308(a)(2) — Assigned Security Responsibility](https://support.icompaas.com/compliance/hipaa/164-308-a-2-assigned-security-responsibility)
- [HIPAA (45 CFR Part 164) 164.308(a)(3)(i) — Workforce Security](https://support.icompaas.com/compliance/hipaa/164-308-a-3-i-workforce-security)
- [HIPAA (45 CFR Part 164) 164.308(a)(3)(ii)(A) — Workforce security - Authorization and/or Supervision](https://support.icompaas.com/compliance/hipaa/164-308-a-3-ii-a-workforce-security-authorization-and-or-supervision)
- [HIPAA (45 CFR Part 164) 164.308(a)(3)(ii)(B) — Workforce security - Workforce Clearance Procedure](https://support.icompaas.com/compliance/hipaa/164-308-a-3-ii-b-workforce-security-workforce-clearance-procedure)
- [HIPAA (45 CFR Part 164) 164.308(a)(3)(ii)(C) — Workforce security - Establish Termination Procedures](https://support.icompaas.com/compliance/hipaa/164-308-a-3-ii-c-workforce-security-establish-termination-procedures)
- [HIPAA (45 CFR Part 164) 164.308(a)(4)(i) — Information Access Management](https://support.icompaas.com/compliance/hipaa/164-308-a-4-i-information-access-management)
- [HIPAA (45 CFR Part 164) 164.308(a)(4)(ii)(A) — Information Access Management - Isolating Healthcare Clearinghouse Functions](https://support.icompaas.com/compliance/hipaa/164-308-a-4-ii-a-information-access-management-isolating-healthcare-clearinghouse)
- [HIPAA (45 CFR Part 164) 164.308(a)(4)(ii)(B) — Information Access Management - Access Authorization](https://support.icompaas.com/compliance/hipaa/164-308-a-4-ii-b-information-access-management-access-authorization)
- [HIPAA (45 CFR Part 164) 164.308(a)(4)(ii)(C) — Information Access Management - Access Establishment and Modification](https://support.icompaas.com/compliance/hipaa/164-308-a-4-ii-c-information-access-management-access-establishment-and-modification)
- [HIPAA (45 CFR Part 164) 164.308(a)(5)(i) — Security Awareness and Training](https://support.icompaas.com/compliance/hipaa/164-308-a-5-i-security-awareness-and-training)
- [HIPAA (45 CFR Part 164) 164.308(a)(5)(ii)(A) — Security Awareness and Training - Security Reminders](https://support.icompaas.com/compliance/hipaa/164-308-a-5-ii-a-security-awareness-and-training-security-reminders)
- [HIPAA (45 CFR Part 164) 164.308(a)(5)(ii)(B) — Security Awareness, Training, and Tools - Protection from Malicious Software](https://support.icompaas.com/compliance/hipaa/164-308-a-5-ii-b-security-awareness-training-and-tools-protection-from-malicious-software)
- [HIPAA (45 CFR Part 164) 164.308(a)(5)(ii)(C) — Security Awareness, Training, and Tools - Log-in Monitoring](https://support.icompaas.com/compliance/hipaa/164-308-a-5-ii-c-security-awareness-training-and-tools-log-in-monitoring)
- [HIPAA (45 CFR Part 164) 164.308(a)(5)(ii)(D) — Security Awareness, Training, and Tools - Password Management](https://support.icompaas.com/compliance/hipaa/164-308-a-5-ii-d-security-awareness-training-and-tools-password-management)
- [HIPAA (45 CFR Part 164) 164.308(a)(6)(i) — Security Incident Procedures](https://support.icompaas.com/compliance/hipaa/164-308-a-6-i-security-incident-procedures)
- [HIPAA (45 CFR Part 164) 164.308(a)(6)(ii) — Security Incident Procedures - Response and Reporting](https://support.icompaas.com/compliance/hipaa/164-308-a-6-ii-security-incident-procedures-response-and-reporting)
- [HIPAA (45 CFR Part 164) 164.308(a)(7)(i) — Contingency Plan](https://support.icompaas.com/compliance/hipaa/164-308-a-7-i-contingency-plan)
- [HIPAA (45 CFR Part 164) 164.308(a)(7)(ii)(A) — Contingency Plan - Data Backup Plan](https://support.icompaas.com/compliance/hipaa/164-308-a-7-ii-a-contingency-plan-data-backup-plan)
- [HIPAA (45 CFR Part 164) 164.308(a)(7)(ii)(B) — Contingency Plan -Disaster Recovery Plan](https://support.icompaas.com/compliance/hipaa/164-308-a-7-ii-b-contingency-plan-disaster-recovery-plan)
- [HIPAA (45 CFR Part 164) 164.308(a)(7)(ii)(C) — Contingency Plan - Emergency Mode Operation Plan](https://support.icompaas.com/compliance/hipaa/164-308-a-7-ii-c-contingency-plan-emergency-mode-operation-plan)
- [HIPAA (45 CFR Part 164) 164.308(a)(7)(ii)(D) — Contingency Plan - Testing and Revision Procedure](https://support.icompaas.com/compliance/hipaa/164-308-a-7-ii-d-contingency-plan-testing-and-revision-procedure)
- [HIPAA (45 CFR Part 164) 164.308(a)(7)(ii)(E) — Contingency Plan -Application and Data Criticality Analysis](https://support.icompaas.com/compliance/hipaa/164-308-a-7-ii-e-contingency-plan-application-and-data-criticality-analysis)
- [HIPAA (45 CFR Part 164) 164.308(a)(8) — Evaluation](https://support.icompaas.com/compliance/hipaa/164-308-a-8-evaluation)
- [HIPAA (45 CFR Part 164) 164.308(b)(1) — Business Associate Contracts and Other Arrangements](https://support.icompaas.com/compliance/hipaa/164-308-b-1-business-associate-contracts-and-other-arrangements)
- [HIPAA (45 CFR Part 164) 164.308(b)(3) — Business Associate Contracts and Other Arrangements - Written Contract or Other Arrangement](https://support.icompaas.com/compliance/hipaa/164-308-b-3-business-associate-contracts-and-other-arrangements-written-contract-or-other)

### Security Rule — §164.310

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.310(a)(1) — Facility Access Controls](https://support.icompaas.com/compliance/hipaa/164-310-a-1-facility-access-controls)
- [HIPAA (45 CFR Part 164) 164.310(a)(2)(i) — Facility Access Controls - Contingency Operations](https://support.icompaas.com/compliance/hipaa/164-310-a-2-i-facility-access-controls-contingency-operations)
- [HIPAA (45 CFR Part 164) 164.310(a)(2)(ii) — Facility Access Controls - Facility Security Plan](https://support.icompaas.com/compliance/hipaa/164-310-a-2-ii-facility-access-controls-facility-security-plan)
- [HIPAA (45 CFR Part 164) 164.310(a)(2)(iv) — Facility Access Controls - Maintain Maintenance Records](https://support.icompaas.com/compliance/hipaa/164-310-a-2-iv-facility-access-controls-maintain-maintenance-records)
- [HIPAA (45 CFR Part 164) 164.310(a)(2)(iii) — Facility Access Controls - Access Control and Validation Procedures](https://support.icompaas.com/compliance/hipaa/164-310-a-2-iii-facility-access-controls-access-control-and-validation-procedures)
- [HIPAA (45 CFR Part 164) 164.310(b) — Workstation Use](https://support.icompaas.com/compliance/hipaa/164-310-b-workstation-use)
- [HIPAA (45 CFR Part 164) 164.310(c) — Workstation Security](https://support.icompaas.com/compliance/hipaa/164-310-c-workstation-security)
- [HIPAA (45 CFR Part 164) 164.310(d)(1) — Device and Media Controls](https://support.icompaas.com/compliance/hipaa/164-310-d-1-device-and-media-controls)
- [HIPAA (45 CFR Part 164) 164.310(d)(2)(i) — Device and Media Controls - Disposal](https://support.icompaas.com/compliance/hipaa/164-310-d-2-i-device-and-media-controls-disposal)
- [HIPAA (45 CFR Part 164) 164.310(d)(2)(ii) — Device and Media Controls - Media Re-use](https://support.icompaas.com/compliance/hipaa/164-310-d-2-ii-device-and-media-controls-media-re-use)
- [HIPAA (45 CFR Part 164) 164.310(d)(2)(iv) — Device and Media Controls - Data Backup and Storage Procedures](https://support.icompaas.com/compliance/hipaa/164-310-d-2-iv-device-and-media-controls-data-backup-and-storage-procedures)
- [HIPAA (45 CFR Part 164) 164.310(d)(2)(iii) — Device and Media Controls - Accountability](https://support.icompaas.com/compliance/hipaa/164-310-d-2-iii-device-and-media-controls-accountability)

### Security Rule — §164.312

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.312(a)(1) — Access Control](https://support.icompaas.com/compliance/hipaa/164-312-a-1-access-control)
- [HIPAA (45 CFR Part 164) 164.312(a)(2)(i) — Access Control - Unique User Identification](https://support.icompaas.com/compliance/hipaa/164-312-a-2-i-access-control-unique-user-identification)
- [HIPAA (45 CFR Part 164) 164.312(a)(2)(ii) — Access Control - Emergency Access Procedure](https://support.icompaas.com/compliance/hipaa/164-312-a-2-ii-access-control-emergency-access-procedure)
- [HIPAA (45 CFR Part 164) 164.312(a)(2)(iv) — Access Control - Encryption and Decryption](https://support.icompaas.com/compliance/hipaa/164-312-a-2-iv-access-control-encryption-and-decryption)
- [HIPAA (45 CFR Part 164) 164.312(a)(2)(iii) — Access Control - Automatic Logoff](https://support.icompaas.com/compliance/hipaa/164-312-a-2-iii-access-control-automatic-logoff)
- [HIPAA (45 CFR Part 164) 164.312(b) — Audit Controls](https://support.icompaas.com/compliance/hipaa/164-312-b-audit-controls)
- [HIPAA (45 CFR Part 164) 164.312(c)(1) — Integrity](https://support.icompaas.com/compliance/hipaa/164-312-c-1-integrity)
- [HIPAA (45 CFR Part 164) 164.312(c)(2) — Integrity - Mechanism to Authenticate ePHI](https://support.icompaas.com/compliance/hipaa/164-312-c-2-integrity-mechanism-to-authenticate-ephi)
- [HIPAA (45 CFR Part 164) 164.312(d) — Person or Entity Authentication](https://support.icompaas.com/compliance/hipaa/164-312-d-person-or-entity-authentication)
- [HIPAA (45 CFR Part 164) 164.312(e)(1) — Transmission](https://support.icompaas.com/compliance/hipaa/164-312-e-1-transmission)
- [HIPAA (45 CFR Part 164) 164.312(e)(2)(i) — Transmission Security - Integrity Controls](https://support.icompaas.com/compliance/hipaa/164-312-e-2-i-transmission-security-integrity-controls)
- [HIPAA (45 CFR Part 164) 164.312(e)(2)(ii) — Transmission Security - Encryption](https://support.icompaas.com/compliance/hipaa/164-312-e-2-ii-transmission-security-encryption)

### Security Rule — §164.314

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.314(a)(1) — Business Associate Contracts or Other Arrangements](https://support.icompaas.com/compliance/hipaa/164-314-a-1-business-associate-contracts-or-other-arrangements)
- [HIPAA (45 CFR Part 164) 164.314(a)(2)(i)(A) — Business associate contracts](https://support.icompaas.com/compliance/hipaa/164-314-a-2-i-a-business-associate-contracts)
- [HIPAA (45 CFR Part 164) 164.314(a)(2)(i)(B) — Business associate contracts.](https://support.icompaas.com/compliance/hipaa/164-314-a-2-i-b-business-associate-contracts)
- [HIPAA (45 CFR Part 164) 164.314(a)(2)(i)(C) — Business associate contracts.](https://support.icompaas.com/compliance/hipaa/164-314-a-2-i-c-business-associate-contracts)
- [HIPAA (45 CFR Part 164) 164.314(a)(2)(ii) — Other Arrangements](https://support.icompaas.com/compliance/hipaa/164-314-a-2-ii-other-arrangements)
- [HIPAA (45 CFR Part 164) 164.314(a)(2)(iii) — Business associate contracts with subcontractors](https://support.icompaas.com/compliance/hipaa/164-314-a-2-iii-business-associate-contracts-with-subcontractors)
- [HIPAA (45 CFR Part 164) 164.314(b)(1) — Requirements for Group Health Plans](https://support.icompaas.com/compliance/hipaa/164-314-b-1-requirements-for-group-health-plans)
- [HIPAA (45 CFR Part 164) 164.314(b)(2)(i) — Group Heath Plan Implementation Specification](https://support.icompaas.com/compliance/hipaa/164-314-b-2-i-group-heath-plan-implementation-specification)
- [HIPAA (45 CFR Part 164) 164.314(b)(2)(ii) — Group Heath Plan Implementation Specification](https://support.icompaas.com/compliance/hipaa/164-314-b-2-ii-group-heath-plan-implementation-specification)
- [HIPAA (45 CFR Part 164) 164.314(b)(2)(iv) — Group Heath Plan Implementation Specification](https://support.icompaas.com/compliance/hipaa/164-314-b-2-iv-group-heath-plan-implementation-specification)
- [HIPAA (45 CFR Part 164) 164.314(b)(2)(iii) — Group Heath Plan Implementation Specification](https://support.icompaas.com/compliance/hipaa/164-314-b-2-iii-group-heath-plan-implementation-specification)

### Security Rule — §164.316

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.316(a) — Policies and Procedures](https://support.icompaas.com/compliance/hipaa/164-316-a-policies-and-procedures)
- [HIPAA (45 CFR Part 164) 164.316(b)(1) — Documentation](https://support.icompaas.com/compliance/hipaa/164-316-b-1-documentation)
- [HIPAA (45 CFR Part 164) 164.316(b)(2)(i) — Documentation - Time Limit](https://support.icompaas.com/compliance/hipaa/164-316-b-2-i-documentation-time-limit)
- [HIPAA (45 CFR Part 164) 164.316(b)(2)(ii) — Documentation- Availability](https://support.icompaas.com/compliance/hipaa/164-316-b-2-ii-documentation-availability)
- [HIPAA (45 CFR Part 164) 164.316(b)(2)(iii) — Documentation - Updates](https://support.icompaas.com/compliance/hipaa/164-316-b-2-iii-documentation-updates)

### Breach Notification Rule — §164.402

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.402(a) — Definitions: Breach - Risk Assessment](https://support.icompaas.com/compliance/hipaa/164-402-a-definitions-breach-risk-assessment)
- [HIPAA (45 CFR Part 164) 164.402(b) — Definitions: Breach - exceptions (unsecured PHI)](https://support.icompaas.com/compliance/hipaa/164-402-b-definitions-breach-exceptions-unsecured-phi)

### Breach Notification Rule — §164.404

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.404(a) — Notice to Individuals](https://support.icompaas.com/compliance/hipaa/164-404-a-notice-to-individuals)
- [HIPAA (45 CFR Part 164) 164.404(b) — Timeliness of Notification](https://support.icompaas.com/compliance/hipaa/164-404-b-timeliness-of-notification)
- [HIPAA (45 CFR Part 164) 164.404(c)(1) — Content of Notification](https://support.icompaas.com/compliance/hipaa/164-404-c-1-content-of-notification)
- [HIPAA (45 CFR Part 164) 164.404(d) — Methods of Notification](https://support.icompaas.com/compliance/hipaa/164-404-d-methods-of-notification)

### Breach Notification Rule — §164.406

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.406 — Notification to the Media](https://support.icompaas.com/compliance/hipaa/164-406-notification-to-the-media)

### Breach Notification Rule — §164.408

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.408 — Notification to the Secretary](https://support.icompaas.com/compliance/hipaa/164-408-notification-to-the-secretary)

### Breach Notification Rule — §164.410

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.410 — Notification by a Business Associate](https://support.icompaas.com/compliance/hipaa/164-410-notification-by-a-business-associate)

### Breach Notification Rule — §164.412

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.412 — Law Enforcement Delay](https://support.icompaas.com/compliance/hipaa/164-412-law-enforcement-delay)

### Breach Notification Rule — §164.414

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.414(a) — Administrative Requirements](https://support.icompaas.com/compliance/hipaa/164-414-a-administrative-requirements)
- [HIPAA (45 CFR Part 164) 164.414(b) — Burden of Proof](https://support.icompaas.com/compliance/hipaa/164-414-b-burden-of-proof)

### Privacy Rule — §164.502

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.502(a)(5)(i) — Prohibited uses and disclosures - Use and disclosure of genetic information for underwriting purposes](https://support.icompaas.com/compliance/hipaa/164-502-a-5-i-prohibited-uses-and-disclosures-use-and-disclosure-of-genetic-information)
- [HIPAA (45 CFR Part 164) 164.502(f) — Deceased individuals](https://support.icompaas.com/compliance/hipaa/164-502-f-deceased-individuals)
- [HIPAA (45 CFR Part 164) 164.502(g) — Personal representatives](https://support.icompaas.com/compliance/hipaa/164-502-g-personal-representatives)
- [HIPAA (45 CFR Part 164) 164.502(h) — Confidential communications](https://support.icompaas.com/compliance/hipaa/164-502-h-confidential-communications)
- [HIPAA (45 CFR Part 164) 164.502(i) — Uses and disclosures consistent with notice](https://support.icompaas.com/compliance/hipaa/164-502-i-uses-and-disclosures-consistent-with-notice)
- [HIPAA (45 CFR Part 164) 164.502(j)(1) — Disclosures by whistleblowers](https://support.icompaas.com/compliance/hipaa/164-502-j-1-disclosures-by-whistleblowers)
- [HIPAA (45 CFR Part 164) 164.502(j)(2) — Disclosures by workforce members who are victims of a crime](https://support.icompaas.com/compliance/hipaa/164-502-j-2-disclosures-by-workforce-members-who-are-victims-of-a-crime)

### Privacy Rule — §164.504

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.504(e) — Business associate contracts](https://support.icompaas.com/compliance/hipaa/164-504-e-business-associate-contracts)
- [HIPAA (45 CFR Part 164) 164.504(f) — Requirements for group health plans](https://support.icompaas.com/compliance/hipaa/164-504-f-requirements-for-group-health-plans)
- [HIPAA (45 CFR Part 164) 164.504(g) — Requirements for a covered entity with multiple covered functions](https://support.icompaas.com/compliance/hipaa/164-504-g-requirements-for-a-covered-entity-with-multiple-covered-functions)

### Privacy Rule — §164.506

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.506(a) — Permitted uses and disclosures](https://support.icompaas.com/compliance/hipaa/164-506-a-permitted-uses-and-disclosures)
- [HIPAA (45 CFR Part 164) 164.506(b) — Consent for uses and disclosures](https://support.icompaas.com/compliance/hipaa/164-506-b-consent-for-uses-and-disclosures)
- [HIPAA (45 CFR Part 164) 164.506(b)(1) — Permitted uses and disclosures](https://support.icompaas.com/compliance/hipaa/164-506-b-1-permitted-uses-and-disclosures)
- [HIPAA (45 CFR Part 164) 164.506(b)(2) — Required provisions](https://support.icompaas.com/compliance/hipaa/164-506-b-2-required-provisions)

### Privacy Rule — §164.508

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.508(a)(1) — Authorization requirements - general rule](https://support.icompaas.com/compliance/hipaa/164-508-a-1-authorization-requirements-general-rule)
- [HIPAA (45 CFR Part 164) 164.508(a)(2) — Authorization requirements - psychotherapy notes](https://support.icompaas.com/compliance/hipaa/164-508-a-2-authorization-requirements-psychotherapy-notes)
- [HIPAA (45 CFR Part 164) 164.508(a)(3) — Authorization requirements - marketing](https://support.icompaas.com/compliance/hipaa/164-508-a-3-authorization-requirements-marketing)
- [HIPAA (45 CFR Part 164) 164.508(b)(1) — Authorization - defective authorizations](https://support.icompaas.com/compliance/hipaa/164-508-b-1-authorization-defective-authorizations)
- [HIPAA (45 CFR Part 164) 164.508(b)(2) — Authorization - compound authorizations](https://support.icompaas.com/compliance/hipaa/164-508-b-2-authorization-compound-authorizations)
- [HIPAA (45 CFR Part 164) 164.508(b)(3) — Compound authorizations - Exceptions](https://support.icompaas.com/compliance/hipaa/164-508-b-3-compound-authorizations-exceptions)
- [HIPAA (45 CFR Part 164) 164.508(b)(4) — Prohibition on conditioning of authorizations](https://support.icompaas.com/compliance/hipaa/164-508-b-4-prohibition-on-conditioning-of-authorizations)
- [HIPAA (45 CFR Part 164) 164.508(b)(6) — Fundraising communications with an authorization](https://support.icompaas.com/compliance/hipaa/164-508-b-6-fundraising-communications-with-an-authorization)
- [HIPAA (45 CFR Part 164) 164.508(c)(1) — Core elements of an authorization](https://support.icompaas.com/compliance/hipaa/164-508-c-1-core-elements-of-an-authorization)
- [HIPAA (45 CFR Part 164) 164.508(c)(2) — Plain language requirement](https://support.icompaas.com/compliance/hipaa/164-508-c-2-plain-language-requirement)
- [HIPAA (45 CFR Part 164) 164.508(c)(3) — Required statements](https://support.icompaas.com/compliance/hipaa/164-508-c-3-required-statements)
- [HIPAA (45 CFR Part 164) 164.508(c)(4) — Authorization for use or disclosure of psychotherapy notes](https://support.icompaas.com/compliance/hipaa/164-508-c-4-authorization-for-use-or-disclosure-of-psychotherapy-notes)

### Privacy Rule — §164.510

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.510(a)(1) — Use and disclosure for facility directories - general](https://support.icompaas.com/compliance/hipaa/164-510-a-1-use-and-disclosure-for-facility-directories-general)
- [HIPAA (45 CFR Part 164) 164.510(a)(2) — Use and disclosure for facility directories - opportunity to object](https://support.icompaas.com/compliance/hipaa/164-510-a-2-use-and-disclosure-for-facility-directories-opportunity-to-object)
- [HIPAA (45 CFR Part 164) 164.510(a)(3) — Uses and Disclosures for Facility Directories in Emergency Circumstances](https://support.icompaas.com/compliance/hipaa/164-510-a-3-uses-and-disclosures-for-facility-directories-in-emergency-circumstances)
- [HIPAA (45 CFR Part 164) 164.510(b)(1) — Permitted uses and disclosures](https://support.icompaas.com/compliance/hipaa/164-510-b-1-permitted-uses-and-disclosures)
- [HIPAA (45 CFR Part 164) 164.510(b)(2) — Uses and disclosures with the individual present](https://support.icompaas.com/compliance/hipaa/164-510-b-2-uses-and-disclosures-with-the-individual-present)
- [HIPAA (45 CFR Part 164) 164.510(b)(3) — Limited uses and disclosures when the individual is not present](https://support.icompaas.com/compliance/hipaa/164-510-b-3-limited-uses-and-disclosures-when-the-individual-is-not-present)
- [HIPAA (45 CFR Part 164) 164.510(b)(4) — Uses and disclosures for disaster relief purposes](https://support.icompaas.com/compliance/hipaa/164-510-b-4-uses-and-disclosures-for-disaster-relief-purposes)
- [HIPAA (45 CFR Part 164) 164.510(b)(5) — Uses and disclosures when the individual is deceased](https://support.icompaas.com/compliance/hipaa/164-510-b-5-uses-and-disclosures-when-the-individual-is-deceased)

### Privacy Rule — §164.512

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.512(a) — Uses and disclosures required by law](https://support.icompaas.com/compliance/hipaa/164-512-a-uses-and-disclosures-required-by-law)
- [HIPAA (45 CFR Part 164) 164.512(b) — Uses and disclosures for public health activities](https://support.icompaas.com/compliance/hipaa/164-512-b-uses-and-disclosures-for-public-health-activities)
- [HIPAA (45 CFR Part 164) 164.512(c) — Disclosures about victims of abuse, neglect or domestic violence](https://support.icompaas.com/compliance/hipaa/164-512-c-disclosures-about-victims-of-abuse-neglect-or-domestic-violence)
- [HIPAA (45 CFR Part 164) 164.512(d) — Uses and disclosures for health oversight activities](https://support.icompaas.com/compliance/hipaa/164-512-d-uses-and-disclosures-for-health-oversight-activities)
- [HIPAA (45 CFR Part 164) 164.512(e) — Disclosures for judicial and administrative proceedings](https://support.icompaas.com/compliance/hipaa/164-512-e-disclosures-for-judicial-and-administrative-proceedings)
- [HIPAA (45 CFR Part 164) 164.512(f)(1) — Disclosures for law enforcement purposes](https://support.icompaas.com/compliance/hipaa/164-512-f-1-disclosures-for-law-enforcement-purposes)
- [HIPAA (45 CFR Part 164) 164.512(f)(2) — Disclosures for law enforcement purposes - for identification and location -](https://support.icompaas.com/compliance/hipaa/164-512-f-2-disclosures-for-law-enforcement-purposes-for-identification-and-location)
- [HIPAA (45 CFR Part 164) 164.512(f)(3) — Disclosures for law enforcement purposes- PHI of a possible victim of a crime](https://support.icompaas.com/compliance/hipaa/164-512-f-3-disclosures-for-law-enforcement-purposes-phi-of-a-possible-victim-of-a-crime)
- [HIPAA (45 CFR Part 164) 164.512(f)(4) — Disclosures for law enforcement purposes- an individual who has died as a result of suspected criminal conduct](https://support.icompaas.com/compliance/hipaa/164-512-f-4-disclosures-for-law-enforcement-purposes-an-individual-who-has-died-as-a)
- [HIPAA (45 CFR Part 164) 164.512(f)(5) — Disclosures for law enforcement purposes: crime on premises](https://support.icompaas.com/compliance/hipaa/164-512-f-5-disclosures-for-law-enforcement-purposes-crime-on-premises)
- [HIPAA (45 CFR Part 164) 164.512(f)(6) — Disclosures for law enforcement purposes](https://support.icompaas.com/compliance/hipaa/164-512-f-6-disclosures-for-law-enforcement-purposes)
- [HIPAA (45 CFR Part 164) 164.512(g) — Uses and disclosures about decedents](https://support.icompaas.com/compliance/hipaa/164-512-g-uses-and-disclosures-about-decedents)
- [HIPAA (45 CFR Part 164) 164.512(h) — Uses and disclosures for cadaveric organ, eye or tissue donation](https://support.icompaas.com/compliance/hipaa/164-512-h-uses-and-disclosures-for-cadaveric-organ-eye-or-tissue-donation)
- [HIPAA (45 CFR Part 164) 164.512(i)(1) — Uses and disclosures for research purposes - Permitted Uses and Disclosures](https://support.icompaas.com/compliance/hipaa/164-512-i-1-uses-and-disclosures-for-research-purposes-permitted-uses-and-disclosures)
- [HIPAA (45 CFR Part 164) 164.512(i)(2) — Uses and disclosures for research purposes - Documentation of Waiver Approval](https://support.icompaas.com/compliance/hipaa/164-512-i-2-uses-and-disclosures-for-research-purposes-documentation-of-waiver-approval)
- [HIPAA (45 CFR Part 164) 164.512(k)(1) — Uses and disclosures for specialized government functions - Military](https://support.icompaas.com/compliance/hipaa/164-512-k-1-uses-and-disclosures-for-specialized-government-functions-military)
- [HIPAA (45 CFR Part 164) 164.512(k)(2) — Uses and disclosures for specialized government functions - National Security and intelligence activities](https://support.icompaas.com/compliance/hipaa/164-512-k-2-uses-and-disclosures-for-specialized-government-functions-national-security)
- [HIPAA (45 CFR Part 164) 164.512(k)(3) — Uses and disclosures for specialized government functions - Protective Services](https://support.icompaas.com/compliance/hipaa/164-512-k-3-uses-and-disclosures-for-specialized-government-functions-protective-services)
- [HIPAA (45 CFR Part 164) 164.512(k)(4) — Uses and disclosures for specialized government functions - Medical Suitability Determinations](https://support.icompaas.com/compliance/hipaa/164-512-k-4-uses-and-disclosures-for-specialized-government-functions-medical-suitability)
- [HIPAA (45 CFR Part 164) 164.512(k)(5) — Uses and disclosures for specialized government functions - Correctional institutions](https://support.icompaas.com/compliance/hipaa/164-512-k-5-uses-and-disclosures-for-specialized-government-functions-correctional)
- [HIPAA (45 CFR Part 164) 164.512(k)(6) — Uses and disclosures for specialized government functions - Providing public benefits](https://support.icompaas.com/compliance/hipaa/164-512-k-6-uses-and-disclosures-for-specialized-government-functions-providing-public)
- [HIPAA (45 CFR Part 164) 164.512(l) — Disclosures for workers' compensation](https://support.icompaas.com/compliance/hipaa/164-512-l-disclosures-for-workers-compensation)

### Privacy Rule — §164.514

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.514(b) — De-identification of protected health information](https://support.icompaas.com/compliance/hipaa/164-514-b-de-identification-of-protected-health-information)
- [HIPAA (45 CFR Part 164) 164.514(c) — Re-identification of protected health information](https://support.icompaas.com/compliance/hipaa/164-514-c-re-identification-of-protected-health-information)
- [HIPAA (45 CFR Part 164) 164.514(d)(1) — Minimum necessary requirements - standard](https://support.icompaas.com/compliance/hipaa/164-514-d-1-minimum-necessary-requirements-standard)
- [HIPAA (45 CFR Part 164) 164.514(d)(2) — Minimum necessary requirements - implementation specifications](https://support.icompaas.com/compliance/hipaa/164-514-d-2-minimum-necessary-requirements-implementation-specifications)
- [HIPAA (45 CFR Part 164) 164.514(d)(3) — Minimum Necessary - Disclosures of PHI](https://support.icompaas.com/compliance/hipaa/164-514-d-3-minimum-necessary-disclosures-of-phi)
- [HIPAA (45 CFR Part 164) 164.514(d)(4) — Minimum Necessary requests for protected health information](https://support.icompaas.com/compliance/hipaa/164-514-d-4-minimum-necessary-requests-for-protected-health-information)
- [HIPAA (45 CFR Part 164) 164.514(d)(5) — Minimum Necessary - Other content requirement](https://support.icompaas.com/compliance/hipaa/164-514-d-5-minimum-necessary-other-content-requirement)
- [HIPAA (45 CFR Part 164) 164.514(e) — Limited Data Sets and Data Use Agreements](https://support.icompaas.com/compliance/hipaa/164-514-e-limited-data-sets-and-data-use-agreements)
- [HIPAA (45 CFR Part 164) 164.514(f) — Uses and Disclosures for Fundraising](https://support.icompaas.com/compliance/hipaa/164-514-f-uses-and-disclosures-for-fundraising)
- [HIPAA (45 CFR Part 164) 164.514(g) — Uses and Disclosures for Underwriting and Related Purposes](https://support.icompaas.com/compliance/hipaa/164-514-g-uses-and-disclosures-for-underwriting-and-related-purposes)
- [HIPAA (45 CFR Part 164) 164.514(h) — Verification Requirements](https://support.icompaas.com/compliance/hipaa/164-514-h-verification-requirements)

### Privacy Rule — §164.520

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.520(a)(1) — Notice of privacy practices for covered health care providers](https://support.icompaas.com/compliance/hipaa/164-520-a-1-notice-of-privacy-practices-for-covered-health-care-providers)
- [HIPAA (45 CFR Part 164) 164.520(b)(1) — Notice of privacy practices for health plans](https://support.icompaas.com/compliance/hipaa/164-520-b-1-notice-of-privacy-practices-for-health-plans)
- [HIPAA (45 CFR Part 164) 164.520(c)(1) — Provisions of Notice - Health Plans](https://support.icompaas.com/compliance/hipaa/164-520-c-1-provisions-of-notice-health-plans)
- [HIPAA (45 CFR Part 164) 164.520(c)(2) — Provisions of Notice - Certain Covered Health Care Providers](https://support.icompaas.com/compliance/hipaa/164-520-c-2-provisions-of-notice-certain-covered-health-care-providers)
- [HIPAA (45 CFR Part 164) 164.520(c)(3) — Provision of Notice - Electronic Notice](https://support.icompaas.com/compliance/hipaa/164-520-c-3-provision-of-notice-electronic-notice)
- [HIPAA (45 CFR Part 164) 164.520(d) — Joint Notice by Separate Covered Entities](https://support.icompaas.com/compliance/hipaa/164-520-d-joint-notice-by-separate-covered-entities)
- [HIPAA (45 CFR Part 164) 164.520(e) — Documentation](https://support.icompaas.com/compliance/hipaa/164-520-e-documentation)

### Privacy Rule — §164.522

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.522(a)(1) — Right of an Individual to Request Restriction of Uses and Disclosures](https://support.icompaas.com/compliance/hipaa/164-522-a-1-right-of-an-individual-to-request-restriction-of-uses-and-disclosures)
- [HIPAA (45 CFR Part 164) 164.522(a)(2) — Terminating a Restriction](https://support.icompaas.com/compliance/hipaa/164-522-a-2-terminating-a-restriction)
- [HIPAA (45 CFR Part 164) 164.522(a)(3) — Documentation](https://support.icompaas.com/compliance/hipaa/164-522-a-3-documentation)
- [HIPAA (45 CFR Part 164) 164.522(b)(1) — Confidential Communications Requirements](https://support.icompaas.com/compliance/hipaa/164-522-b-1-confidential-communications-requirements)

### Privacy Rule — §164.524

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.524(a)(1) — Right of access](https://support.icompaas.com/compliance/hipaa/164-524-a-1-right-of-access)
- [HIPAA (45 CFR Part 164) 164.524(a)(2) — Unreviewable grounds for denial](https://support.icompaas.com/compliance/hipaa/164-524-a-2-unreviewable-grounds-for-denial)
- [HIPAA (45 CFR Part 164) 164.524(a)(3) — Reviewable grounds for denial](https://support.icompaas.com/compliance/hipaa/164-524-a-3-reviewable-grounds-for-denial)
- [HIPAA (45 CFR Part 164) 164.524(a)(4) — Review of denial of access](https://support.icompaas.com/compliance/hipaa/164-524-a-4-review-of-denial-of-access)
- [HIPAA (45 CFR Part 164) 164.524(b)(1) — Individual request for access](https://support.icompaas.com/compliance/hipaa/164-524-b-1-individual-request-for-access)
- [HIPAA (45 CFR Part 164) 164.524(b)(2) — Timely action](https://support.icompaas.com/compliance/hipaa/164-524-b-2-timely-action)
- [HIPAA (45 CFR Part 164) 164.524(c)(2) — Form of access requested](https://support.icompaas.com/compliance/hipaa/164-524-c-2-form-of-access-requested)
- [HIPAA (45 CFR Part 164) 164.524(c)(3) — Time and manner of access](https://support.icompaas.com/compliance/hipaa/164-524-c-3-time-and-manner-of-access)
- [HIPAA (45 CFR Part 164) 164.524(c)(4) — Fees](https://support.icompaas.com/compliance/hipaa/164-524-c-4-fees)
- [HIPAA (45 CFR Part 164) 164.524(d)(1) — Making other information accessible](https://support.icompaas.com/compliance/hipaa/164-524-d-1-making-other-information-accessible)
- [HIPAA (45 CFR Part 164) 164.524(d)(2) — Denial of Access](https://support.icompaas.com/compliance/hipaa/164-524-d-2-denial-of-access)
- [HIPAA (45 CFR Part 164) 164.524(d)(3) — Other responsibility](https://support.icompaas.com/compliance/hipaa/164-524-d-3-other-responsibility)
- [HIPAA (45 CFR Part 164) 164.524(d)(4) — Review of denial requested](https://support.icompaas.com/compliance/hipaa/164-524-d-4-review-of-denial-requested)
- [HIPAA (45 CFR Part 164) 164.524(e) — Documentation](https://support.icompaas.com/compliance/hipaa/164-524-e-documentation)

### Privacy Rule — §164.526

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.526(a)(1) — Right to Amend](https://support.icompaas.com/compliance/hipaa/164-526-a-1-right-to-amend)
- [HIPAA (45 CFR Part 164) 164.526(a)(2) — Denying the Amendment](https://support.icompaas.com/compliance/hipaa/164-526-a-2-denying-the-amendment)
- [HIPAA (45 CFR Part 164) 164.526(c) — Accepting the Amendment](https://support.icompaas.com/compliance/hipaa/164-526-c-accepting-the-amendment)
- [HIPAA (45 CFR Part 164) 164.526(d) — Denying the Amendment](https://support.icompaas.com/compliance/hipaa/164-526-d-denying-the-amendment)

### Privacy Rule — §164.528

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.528(a) — Right to an Accounting of Disclosures of PHI](https://support.icompaas.com/compliance/hipaa/164-528-a-right-to-an-accounting-of-disclosures-of-phi)
- [HIPAA (45 CFR Part 164) 164.528(b) — Content of the Accounting](https://support.icompaas.com/compliance/hipaa/164-528-b-content-of-the-accounting)
- [HIPAA (45 CFR Part 164) 164.528(c) — Provision of the Accounting](https://support.icompaas.com/compliance/hipaa/164-528-c-provision-of-the-accounting)
- [HIPAA (45 CFR Part 164) 164.528(d) — Documentation](https://support.icompaas.com/compliance/hipaa/164-528-d-documentation)

### Privacy Rule — §164.530

HIPAA Security, Privacy & Breach-Notification Rules

- [HIPAA (45 CFR Part 164) 164.530(a) — Personnel designations](https://support.icompaas.com/compliance/hipaa/164-530-a-personnel-designations)
- [HIPAA (45 CFR Part 164) 164.530(b) — Training](https://support.icompaas.com/compliance/hipaa/164-530-b-training)
- [HIPAA (45 CFR Part 164) 164.530(c) — Safeguards](https://support.icompaas.com/compliance/hipaa/164-530-c-safeguards)
- [HIPAA (45 CFR Part 164) 164.530(d)(1) — Complaints to the Covered Entity](https://support.icompaas.com/compliance/hipaa/164-530-d-1-complaints-to-the-covered-entity)
- [HIPAA (45 CFR Part 164) 164.530(d)(2) — Complaints to the Covered Entity](https://support.icompaas.com/compliance/hipaa/164-530-d-2-complaints-to-the-covered-entity)
- [HIPAA (45 CFR Part 164) 164.530(e)(1) — Sanctions](https://support.icompaas.com/compliance/hipaa/164-530-e-1-sanctions)
- [HIPAA (45 CFR Part 164) 164.530(f) — Mitigation](https://support.icompaas.com/compliance/hipaa/164-530-f-mitigation)
- [HIPAA (45 CFR Part 164) 164.530(g) — Refraining from Intimidating or Retaliatory Acts](https://support.icompaas.com/compliance/hipaa/164-530-g-refraining-from-intimidating-or-retaliatory-acts)
- [HIPAA (45 CFR Part 164) 164.530(h) — Waiver of rights](https://support.icompaas.com/compliance/hipaa/164-530-h-waiver-of-rights)
- [HIPAA (45 CFR Part 164) 164.530(i) — Policies and Procedures](https://support.icompaas.com/compliance/hipaa/164-530-i-policies-and-procedures)
- [HIPAA (45 CFR Part 164) 164.530(j) — Documentation](https://support.icompaas.com/compliance/hipaa/164-530-j-documentation)