HIPAA Compliance Roadmap: Building a Defensible Program

Scope, analyze, remediate, paper, train, drill. (1) Scope: determine covered entity vs business associate status per function, inventory systems containing PHI (ePHI flows, vendors, devices). (2) Risk analysis: the 164.308(a)(1) enterprise-wide assessment of threats and vulnerabilities to all ePHI. (3) Remediate: a risk management plan with dated milestones for the gaps found. (4) Paper: Privacy and Security Rule policies, BAAs with every vendor touching PHI, notices of privacy practices. (5) Train: workforce training with sanctions policy, documented. (6) Drill: incident response and breach-notification runbooks exercised before a real event. OCR investigations ask for these artifacts in almost exactly this order.

Enterprise-wide, asset-based, and current. It inventories every system creating, receiving, maintaining, or transmitting ePHI (including cloud services, medical devices, and remote endpoints), identifies threats and vulnerabilities per asset, rates likelihood and impact, and documents existing controls and residual risk. It is not a checklist, a penetration test, or a gap assessment against the Security Rule alone, OCR's guidance and its settlement pattern make clear those substitutes fail. It must be updated on material change (new EHR, acquisition, major incident) and reviewed periodically. OCR's Risk Analysis Initiative has produced a series of settlements against entities whose analyses were missing, partial, or years stale.

Privacy Rule: uses and disclosures, minimum necessary, individual rights (access on a 30-day clock, amendment, accounting of disclosures), notice of privacy practices, complaints. Security Rule: risk analysis and risk management, sanctions, information system activity review, workforce security, access management, security awareness, incident response, contingency (backup, disaster recovery, emergency mode), evaluation, and the physical/technical safeguard policies (facility, workstation, device and media, access control, audit controls, integrity, authentication, transmission security). Plus BAAs, training records, and breach risk assessments. Everything on a six-year retention. The volume is real but the structure is fixed, which is why template-plus-tailoring works if the tailoring actually happens.

An impermissible acquisition, access, use, or disclosure of unsecured PHI is presumed a breach unless a documented risk assessment shows a low probability of compromise across four factors: nature and extent of the PHI, the unauthorized recipient, whether PHI was actually acquired or viewed, and mitigation. If notifiable: individuals without unreasonable delay and within 60 calendar days; HHS contemporaneously for breaches affecting 500+ individuals (which also triggers media notice and the public 'wall of shame' posting) or via the annual log for smaller ones; business associates notify the covered entity within 60 days. Encryption to NIST standards makes PHI 'secured' and takes the loss out of notification entirely, the cheapest breach you will ever handle.

The pattern across its published settlements is consistent: no or stale risk analysis (the most-cited failure), missing BAAs, no encryption where the risk analysis said to encrypt, insufficient access controls and audit review, and right-of-access violations (a standing initiative with dozens of settlements over delayed or denied patient record requests). Penalties run in four culpability tiers from unknowing to willful neglect uncorrected, with annual caps around $2.1 million per violation category, and resolution agreements impose multi-year corrective action plans with OCR monitoring. State attorneys general can sue under HITECH as well. The defense is boring and documentary: current risk analysis, executed BAAs, training logs, and breach files that show the four-factor analysis.