HIPAA compliance
Handle protected health information properly
Scope which systems touch PHI, apply the safeguards that apply to them, and keep the evidence current.
What HIPAA is
HIPAA is US law governing protected health information. The Security Rule sets administrative, physical, and technical safeguards; the Privacy Rule governs use and disclosure; the Breach Notification Rule sets what happens when something goes wrong.
If you handle PHI on behalf of a covered entity, you are a business associate and need a Business Associate Agreement with them.
Who needs HIPAA
You build software touching patient data: a digital health product, a provider tool, or infrastructure a healthcare company runs on. Your customer has sent you a BAA.
How TrustLynce helps with HIPAA
PHI scoping
Identify which systems touch PHI so safeguards apply where they matter.
Required risk analysis
The Security Rule requires it explicitly, and it's the most common finding when missing.
BAA tracking
Agreements tracked against vendor records with renewal dates.
Access evidence
Who accessed PHI and whether their access was reviewed.
HIPAA questions
No. No certification exists. You demonstrate compliance through documented safeguards and evidence. Treat any vendor selling "HIPAA certification" with caution.
Covered entities are providers, plans, and clearinghouses. If you handle PHI for one, you are a business associate, most software companies are.
No, but they overlap substantially in access control, encryption, and audit logging.
A documented assessment of risks to PHI. Explicitly required, and frequently missing.
With every vendor that may access PHI on your behalf.
Other frameworks
Evidence collected for one framework carries into the next.
SOC 2
The one your buyers ask for
ISO 27001
Recognised worldwide
GDPR
Handle EU personal data
PCI DSS
Take card payments safely
ISO 42001
Govern how you use AI
NIST CSF
A common security language
CMMC
Work with the DoD
Custom
Your own control set
ISO 27701
Privacy extension to ISO 27001
DORA
EU financial operational resilience
NIS 2
EU critical infrastructure cybersecurity
CCPA / CPRA
California comprehensive privacy
FERPA
Student education privacy standard
FDA 21 CFR Part 11
FDA electronic records & signatures
HDS Certification
French health data hosting certification
SOX ITGC
IT controls for public companies
HITRUST CSF
Assurance healthcare buyers ask for
FedRAMP
Sell cloud services to US agencies
NIST SP 800-53
The federal security control catalog
NIST SP 800-171
Protect CUI on federal contracts
Find out what your compliance program actually looks like
Thirty minutes, your real systems, no slideware. We'll show you what we'd automate first, and what you don't need us for.