HIPAA compliance software
What it is
HIPAA is the Health Insurance Portability and Accountability Act of 1996, a US federal law. It governs protected health information (PHI), which is health data that can identify a person. Three rules do most of the work. The Privacy Rule sets limits on how PHI is used and shared. The Security Rule requires administrative, physical and technical safeguards for electronic PHI. The Breach Notification Rule requires notice after a breach of unsecured PHI. The HHS Office for Civil Rights (OCR) enforces HIPAA.
Who needs it
HIPAA applies to covered entities and business associates. Covered entities are health plans, health care clearinghouses and providers that send health information electronically in standard transactions. Business associates are vendors and partners that create, receive, store or transmit PHI for a covered entity. Each business associate needs a written business associate agreement with every covered entity it serves. Clinics, insurers, billing firms, cloud hosts and software vendors that touch PHI often fall into one of these groups.
What auditors check
- A documented risk analysis that maps where electronic PHI lives and how it moves, with a plan to reduce each risk.
- Access rules that give each person a unique user ID and only the access their job needs, removed when they leave.
- Audit logs that record who viewed or changed PHI and when, with regular review.
- Encryption of PHI in transit and at rest where the risk analysis calls for it, plus a written reason for any addressable safeguard left out.
- Written Security Rule policies and procedures, reviewed on a regular schedule.
- Workforce training on privacy and security, with records that show who completed it.
- Incident response and breach notification steps that meet the Breach Notification Rule deadlines.
- Backup, disaster recovery and emergency plans for PHI, with records that show they were tested.
- Signed business associate agreements with every vendor that handles PHI.
- Sanctions for staff who break privacy or security rules.
How Oncrypt gets you ready
Oncrypt builds your HIPAA readiness from the controls auditors check first. Our scans cover your website and its trackers, including pages that collect health information, plus the forms patients fill in. We also check your email and domain settings, the cloud accounts and the devices where PHI lives. Each finding lands in your score with a clear fix. Our in house pentest team tests the systems that matter most. Our compliance lead checks the evidence. The evidence vault keeps it ready for your next review. An independent auditor still issues any formal audit stamp. Oncrypt gets you audit ready for that review.
Overlap with other frameworks
Questions
Does Oncrypt make us HIPAA compliant?
HHS does not offer a HIPAA certification. Oncrypt does not issue one either. Oncrypt builds HIPAA readiness: we scan, fix and document the controls the Security Rule asks for, so you stay audit ready.
Is HIPAA a law or a standard?
HIPAA is a federal law. The HHS rules under the law set the detailed standards that auditors and OCR investigators check against.
Are we a covered entity or a business associate?
Health plans, clearinghouses and providers that send health claims electronically are covered entities. Vendors that handle PHI for them are business associates. Some businesses are both. Ask your legal counsel to confirm your role.
How long does HIPAA readiness take?
It depends on how many systems hold PHI and how mature your controls are. Your score shows each step and the order to take them. Your first scan gives you a realistic timeline.
What happens after a breach?
The Breach Notification Rule requires notice to affected people without unreasonable delay. The outer limit is 60 days after discovery. Notices also go to HHS and, in some cases, to the media. Keep a written incident plan ready before you need it.
Start with the gaps that matter most
Talk to us about your framework. We will show you what to fix first and what your auditor will ask for.