Build trust with a HIPAA attestation

The Health Insurance Portability Accountability Act (HIPAA) is U.S. law establishing privacy, security and breach notification standards for protected health information (PHI). It demonstrates your secure and reliable handling of electronically protected healthcare information (ePHI).

Regulations like HIPAA are mandatory obligations that apply if your data processing activities meet the criteria of the regulation. The regulation sets out the detailed compliance requirements. If you operate in accordance with those requirements, you are compliant, regardless of whether you issue an attestation report. 

An attestation report is used to provide third parties with evidence of your compliance activities with an independent audit that earns and maintains trust in your compliance. That’s especially important when your customers rely on your compliance for their own, eg. if they are using your software or services with the sensitive data of their customers.

HIPAA is a mandatory regulation that applies to healthcare providers, health plans, healthcare clearinghouses and business associates, eg. technology companies, that transmit electronic protected healthcare information (ePHI).

It is a federal law in the United States of America, but it is also viewed globally as the de facto leading standard of expectation for handling ePHI, commonly relied upon and referenced by global healthcare companies.

A Type 1 report attests to your compliance by design. It’s a snapshot in time that can be achieved by showing you have the right systems and processes in place to satisfy the HIPAA regulatory clauses.

A Type 2 report attests to your compliance by both design and operation over a set period of time, usually between 3-12 months, to show your systems and processes have been operating consistently to satisfy the HIPAA regulatory clauses.

Usually, a Type 1 report is issued first to baseline compliance. That marks the start of the live and recurring Type 2 audit periods for reports issued annually.

The HIPAA regulation specifies detailed clauses or criteria for what control activities are required to satisfy the requirements. These are broken down into the following areas:

• Organisational Safeguards
  
• Administrative Safeguards
  
• Physical Safeguards
  
• Technical Safeguards
  
• Breach Safeguards