Frameworks · Global standards
HIPAA compliance, run as a living system
The Health Insurance Portability and Accountability Act sets US requirements for protecting health information, through the Security Rule's administrative, physical and technical safeguards, the Privacy Rule and the Breach Notification Rule.
Who it applies to
Covered entities and business associates that create, receive, maintain or transmit protected health information, including health technology vendors serving US providers and payers.
What it demands
Administrative safeguards
Risk analysis, workforce training, sanction policy and contingency planning.
Technical safeguards
Access control, audit controls, integrity and transmission security.
Breach notification
Assessment, documentation and notification within the prescribed windows.
How Compli-Once runs it
- 1
Safeguards modelled as controls with owners, evidence requirements and a computed compliance rate.
- 2
Breach notification timelines run inside the incident workflow, timestamped from discovery.
- 3
Business associate assessments run through the vendor module against the same evidence library.
What you already satisfy
HIPAA overlaps with frameworks you may already run. The crosswalk quantifies existing coverage on day one, before you plan a single task.
Implement once, satisfy many
In a representative demonstration environment, 61% of a newly adopted regulatory framework was already satisfied by the existing ISO 27001 programme.
Illustrative, computed live per tenant in the platform.
Frequently asked questions
Who must comply with HIPAA?
Covered entities such as providers, plans and clearinghouses, plus business associates that handle protected health information on their behalf.
Does HIPAA reuse ISO 27001 evidence?
Yes. The crosswalk maps overlapping safeguards, so one implementation satisfies both, and only genuinely new requirements appear as gaps.