# HIPAA Security & Privacy Rules — overview

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_overview_hipaa-hipaa-security-privacy-rules-overview
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [HIPAA Readiness](https://support.icompaas.com/support/solutions/62000039493) › [Overview](https://support.icompaas.com/support/solutions/folders/f_gen_62000039493_overview)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

HIPAA · 45 CFR §§ 160 & 164 — Privacy, Security and Breach Notification Rules

### What is it?

The **Health Insurance Portability and Accountability Act** regulates how **Protected Health Information (PHI)** is created, used, disclosed and protected by:

-   **Covered entities** — health plans, healthcare providers and healthcare clearinghouses.
-   **Business associates** — anyone who handles PHI on their behalf (SaaS, infra, analytics, BPO). If you're a B2B SaaS and your customer is a covered entity, you are almost certainly a Business Associate.

### Three rules you must satisfy

1.  **Privacy Rule** — when PHI may be used or disclosed; minimum necessary; patient rights (access, amend, accounting of disclosures).
2.  **Security Rule** — administrative, physical and technical safeguards for _electronic_ PHI. Each safeguard is "required" or "addressable" (addressable still has to be addressed — documented if you chose an alternative).
3.  **Breach Notification Rule** — within 60 days of discovery, notify affected individuals; the HHS Secretary (immediately for ≥ 500 individuals, annual roll-up otherwise); and media for ≥ 500 in a state/jurisdiction.

### Business Associate Agreements (BAAs)

A BAA is a contract that flows HIPAA obligations down. Cloud platforms publish standard BAAs for in-scope services: [AWS](https://aws.amazon.com/compliance/hipaa-compliance/), [Azure](https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech), [GCP](https://cloud.google.com/security/compliance/hipaa), [Google Workspace](https://workspace.google.com/learn-more/security/security-whitepaper/page-8/). You're responsible for restricting your usage to BAA-eligible services and configurations.

### Audits and enforcement

HHS-OCR investigates complaints and runs periodic audits. Fines scale with _culpability tier_ (unaware → wilful neglect) — up to **$2M+ per category, per year**. Most enforcement actions hinge on three things: a missing or stale **risk analysis**, missing **BAAs**, and inadequate **access controls/audit logs**.

### How iCompaas helps

iCompaas ships HIPAA-mapped technical controls (access logging, encryption at rest/transit, unique user IDs, automatic logoff, integrity controls), templated Privacy/Security Rule policies, BAA tracker, and a Breach Notification workflow that walks responders through the 60-day clock, HHS portal entry, and individual-notice template.

## Related compliance guidance

- [HIPAA compliance for SaaS: a practical implementation guide](https://support.icompaas.com/compliance/hipaa): The Security Rule safeguards this readiness item belongs to, with a phased implementation roadmap and the evidence OCR expects.
- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Most healthcare customers ask for a SOC 2 report alongside HIPAA assurances; the two share most technical controls.