HIPAA work starts with a status question rather than a control list. Are you a covered entity or a business associate? The answer decides which rules reach you and who has to sign a business associate agreement with you. Once status is settled, the Security Rule risk analysis shapes everything else. Safeguards, policies and evidence follow from what it finds, and a missing analysis is the finding OCR cites most often. Only then is it worth choosing software, and the choice should turn on whether a platform carries the risk analysis and safeguards through to evidence, and on where the data sits if you also answer to GDPR.
4 pages on HIPAA, in the order the work happens. Jump to the stage you are at, or read straight through.
Decide whether you are a covered entity or a business associate and which business associate agreements that requires, then run the Security Rule risk analysis against 45 CFR 164.308 to 164.312 using the template.
Judge platforms on whether they produce Security Rule evidence, and see where Venvera and Vanta differ on HIPAA, data residency and pricing.
The free compliance check runs the HIPAA gap assessment in about five minutes and gives you a scored report you can take to a board meeting.
14-day free trial · no credit card · unlimited users