🔒 HIPAA Privacy & Security

HIPAA Privacy & Security Compliance

Administrative, physical and technical safeguards — HIPAA Privacy Rule and Security Rule compliance tracking

HIPAA Status Dashboard

Current compliance posture across all HIPAA rule areas

Privacy Rule
Last assessment: Jan 2026
Next due: Jan 2027
Compliant
Security Rule
Security Officer: Assigned
Last assessment: Mar 2026
Compliant
Breach Notification
Open incidents: 0
Last 12 months: 0 breaches
No incidents
Workforce Training
Staff trained: 94%
Last training: Apr 2026
1 overdue
Annual HIPAA Risk Analysis

Upload security documentation for AI-powered risk analysis per 45 CFR 164.308(a)(1)

🔍 Annual HIPAA Risk Analysis
AI-powered assessment of ePHI scope, threats, vulnerabilities, and control gaps against HIPAA Security Rule requirements
📄
Upload security policies, system inventory, and current risk documentation
Drag & drop or click — PDF, DOCX, XLSX, TXT supported
🤖 AI Risk Analysis — Results
Business Associate Agreement Tracker

Track BAAs with all vendors who access, process, or transmit PHI on your behalf

BAA Tracker
45 CFR 164.308(b) — Business Associate Agreements
⚠️ 1 BAA expiring within 90 days — Billing Services LLC BAA expired Sep 2024. Renew immediately to maintain compliance.
Vendor BAA Status Signed Date Expiry PHI Type Risk Level Actions
EHR Vendor Inc Active 2024-01-15 2027-01-15 ePHI - Full High
Cloud Storage Co Active 2024-06-01 2027-06-01 ePHI - Stored Medium
Billing Services LLC Expiring Soon 2021-09-01 2024-09-01 Billing data Medium
Breach Notification Workflow

45 CFR 164.400–414 — HIPAA Breach Notification Rule requirements and timeline calculator

🚨 Breach Notification Workflow
Assess notification obligations and generate required communications
⚡ Breach Impact Calculator
✅ Notification Requirements
HIPAA Notification Rules Reference
🔴
>500 individuals in a state: Notify HHS Secretary AND prominent media outlets in affected state within 60 days of discovery
🟡
<500 individuals: Notify HHS Secretary by March 1 of the following calendar year; maintain log of all such breaches
🔒
All breaches: Notify affected individuals in writing within 60 days of discovery. If contact information unavailable, substitute notice (website or major print/broadcast media)
📋
Business Associate breach: BA must notify covered entity within 60 days of discovery. 60-day CE notification clock begins upon BA discovery
Workforce Training Tracker

45 CFR 164.530(b) — Workforce training on HIPAA policies and procedures

Staff Training Completion
Annual HIPAA training completion by role
Role Staff Count Trained % Complete Progress Last Training Next Due Status
Physicians 45 43 96%
Apr 2026 Apr 2027 On track
Nurses 120 117 98%
Apr 2026 Apr 2027 On track
Admin Staff 80 72 90%
Apr 2026 Apr 2027 In progress
Contractors 25 18 72%
Mar 2026 Mar 2027 Overdue
💡 Training Note: All workforce members who access PHI must complete HIPAA training at hire and annually thereafter. Contractors with PHI access must be covered under BAA or workforce training requirements.