Tag
Healthcare
21 articles
Compliance frameworks
Mapping HIPAA to SOC 2 controls
A working map from HIPAA Security Rule standards to SOC 2 criteria, where the two diverge, and how to run one control set that serves both obligations.
5 min read
Compliance frameworks
HIPAA workforce training that counts as evidence
The two HIPAA training requirements, who counts as workforce, the records an investigator or customer asks for, and how to prove that no one was missed.
6 min read
Compliance frameworks
Part 11 audit trails and electronic signatures
What 21 CFR 11.10(e), 11.50, 11.70 and Subpart C ask of audit trails and e-signatures, how they meet SSO and MFA, and the design errors that fail review.
7 min read
Compliance frameworks
Addressable vs required: HIPAA encryption explained
What addressable means in the HIPAA Security Rule, where encryption sits in it, how it links to breach notification, and how to document each decision.
6 min read
Compliance frameworks
21 CFR Part 11 explained
What FDA's Part 11 covers, how predicate rules decide whether it applies to your records, and which controls the FDA's 2003 scope guidance still enforces.
7 min read
Compliance frameworks
HIPAA audit logs: what to record and keep
What the Security Rule requires of audit controls, which events to log in systems holding ePHI, how to review them, and what it leaves to you on retention.
6 min read
Compliance frameworks
HIPAA for SaaS companies selling to healthcare
How a SaaS company works out whether it is a HIPAA business associate, what that role obligates it to do, and what healthcare buyers expect to see first.
6 min read
Compliance frameworks
HITRUST corrective action plans
When HITRUST requires a corrective action plan, what a good CAP contains, how to set dates you can meet, and how CAP progress is checked through the cycle.
6 min read
Compliance frameworks
The HIPAA minimum necessary standard
What HIPAA's minimum necessary standard requires for uses, disclosures and requests of PHI, where it does not apply, and how a SaaS vendor designs for it.
6 min read
Compliance frameworks
The HITRUST r2 interim assessment
What the HITRUST r2 interim assessment covers, when it falls, what your assessor tests, and how to keep year one of your certification from slipping.
6 min read
Compliance frameworks
PHI vs ePHI: what counts as protected health information
How HIPAA defines PHI and ePHI, why the holder matters as much as the data, what the definitions exclude, and how to classify the edge cases SaaS teams hit.
6 min read
Compliance frameworks
HITRUST vs SOC 2 for healthcare buyers
How a HITRUST certification and a SOC 2 report differ in who issues them, what they test and how long they last, and how to tell which your buyer needs.
6 min read
Compliance frameworks
HIPAA breach notification: timelines and thresholds
When an incident is a HIPAA breach, when the 60-day clock starts, who must be told at the 500-person thresholds, and what business associates owe customers.
6 min read
Compliance frameworks
The HIPAA risk analysis requirement
What the HIPAA Security Rule's risk analysis must cover, the elements HHS guidance expects, how to scope all ePHI, and what is often mistaken for one.
6 min read
Compliance frameworks
HITRUST inheritance from cloud providers
How HITRUST inheritance works, what you can and cannot inherit from a cloud provider, full versus shared requirements, and the mistakes that cost scores.
6 min read
Compliance frameworks
Business associate agreements: what to check before signing
What HIPAA requires every business associate agreement to contain, the clauses customers add on top, and how to test whether you can perform each.
6 min read
Compliance frameworks
HIPAA technical safeguards for SaaS teams
What each HIPAA technical safeguard means inside a multi-tenant SaaS product, where ePHI escapes your controls, and the evidence a healthcare buyer expects.
6 min read
Compliance frameworks
Preparing for a HITRUST validated assessment
The steps before HITRUST fieldwork: fixing scope, choosing an assessor, running a readiness assessment, building evidence, and what happens at QA.
6 min read
Compliance frameworks
HIPAA administrative safeguards in practice
How to run each HIPAA administrative safeguard as a working process: who owns it, what it produces, and the dated records that show it operated all year.
6 min read
Compliance frameworks
HITRUST e1, i1 and r2 compared
What the HITRUST e1, i1 and r2 assessments each test, how they are scored, how long each certification lasts, and how to pick the one your buyers accept.
6 min read
Compliance frameworks
The HIPAA Security Rule's three safeguard types
What the HIPAA Security Rule's administrative, physical and technical safeguards each cover, how addressable specs work, and where the work starts.
7 min read