HIPAA Compliance
Safeguard protected health information
HIPAA is the US law protecting patient health information, covering privacy, security, and breach notification for covered entities and their business associates. Violations can bring civil penalties up to $1.5 million per year per violation category, plus potential criminal penalties.
What is HIPAA?
protects sensitive patient health information in the United States
through its Privacy Rule, Security Rule, and Breach Notification
Rule, enforced by the HHS Office for Civil Rights.
Who needs to comply with HIPAA?
clearinghouses) and their business associates - any vendor that
creates, receives, maintains, or transmits protected health
information (PHI) on their behalf.
What are the key requirements
of HIPAA?
Administrative, physical, and technical safeguards to protect PHI
The minimum necessary standard when using or disclosing PHI
Signed Business Associate Agreements (BAAs) with all vendors handling PHI
Regular security risk analyses and remediation plans
Patient rights to access and amend their records
Breach notification to affected individuals, HHS, and - for breaches over 500 records - the media
What are the penalties for HIPAA non-compliance?
Tiered civil penalties from $100 to over $50,000 per violation, capped at $1.5 million per year per violation category, plus potential criminal penalties for serious violations.
Contact us$100 - $50,000
Fine per violation$1.5m
Yearly violation fineHow does GDPRLocal help with HIPAA?
GDPRLocal supports you with everything HIPAA requires: policy development, risk assessments, Business Associate Agreements, workforce training, and breach-response support that meets HIPAA's tight notification windows - for covered entities and business associates alike.
Get started free