What is it?
The Health Insurance Portability and Accountability Act regulates how Protected Health Information (PHI) is created, used, disclosed and protected by:
- Covered entities — health plans, healthcare providers and healthcare clearinghouses.
- Business associates — anyone who handles PHI on their behalf (SaaS, infra, analytics, BPO). If you're a B2B SaaS and your customer is a covered entity, you are almost certainly a Business Associate.
Three rules you must satisfy
- Privacy Rule — when PHI may be used or disclosed; minimum necessary; patient rights (access, amend, accounting of disclosures).
- Security Rule — administrative, physical and technical safeguards for electronic PHI. Each safeguard is "required" or "addressable" (addressable still has to be addressed — documented if you chose an alternative).
- Breach Notification Rule — within 60 days of discovery, notify affected individuals; the HHS Secretary (immediately for ≥ 500 individuals, annual roll-up otherwise); and media for ≥ 500 in a state/jurisdiction.
Business Associate Agreements (BAAs)
A BAA is a contract that flows HIPAA obligations down. Cloud platforms publish standard BAAs for in-scope services: AWS, Azure, GCP, Google Workspace. You're responsible for restricting your usage to BAA-eligible services and configurations.
Audits and enforcement
HHS-OCR investigates complaints and runs periodic audits. Fines scale with culpability tier (unaware → wilful neglect) — up to $2M+ per category, per year. Most enforcement actions hinge on three things: a missing or stale risk analysis, missing BAAs, and inadequate access controls/audit logs.
How iCompaas helps
iCompaas ships HIPAA-mapped technical controls (access logging, encryption at rest/transit, unique user IDs, automatic logoff, integrity controls), templated Privacy/Security Rule policies, BAA tracker, and a Breach Notification workflow that walks responders through the 60-day clock, HHS portal entry, and individual-notice template.