The HIPAA tool to analyze risk on health data

The law reaches two groups. Covered entities first: health plans, health care clearinghouses and health care providers that transmit health information electronically in connection with standard transactions. Business associates second: any organisation handling protected health information (PHI) on behalf of a covered entity, from hosting providers and software vendors to managed service and consulting firms. Since the HITECH Act, business associates are directly liable for part of the rules, and they have to put written agreements in place with their own subcontractors.

Yes, through the contract more than through territory. The law carries no extraterritorial clause comparable to the GDPR's, but a US covered entity may only pass PHI to a service provider once a business associate agreement is signed. Signing one turns a European vendor or hosting provider into a business associate: permitted uses, security safeguards, reporting incidents to the client, returning or destroying data at the end of the contract, the same requirements passed down to its own subcontractors. Part of the rules then applies directly, with exposure that is first of all contractual and commercial.

No. No US authority issues or recognises a HIPAA certificate: the regulator, the Office for Civil Rights at the Department of Health and Human Services, accredits no scheme of that kind. A supplier advertising itself as HIPAA certified is selling a private attestation, not an official label. What counts in an investigation or after a complaint is documentation: the risk analysis, the policies, evidence that the controls actually run, the incident log. An ISO 27001 certificate or a SOC 2 report reassures a US client without replacing that demonstration.

The rule asks for an accurate and thorough assessment of the risks to the confidentiality, integrity and availability of electronic protected health information. In practice that means mapping where this data is created, received, stored and transmitted, identifying threats and vulnerabilities, estimating likelihood and impact, deriving a risk level, then deciding on measures and keeping the reasoning. No methodology is imposed: what is expected is that the analysis holds up and that it is refreshed whenever the information system changes.

As things stand, the Security Rule separates required implementation specifications, which apply as written, from addressable ones, encryption among them. Addressable does not mean optional: you assess whether the measure is reasonable and appropriate in your environment, apply it if it is, and otherwise document why not and put an equivalent alternative in place where that is reasonable and appropriate. That written trail is the first thing asked for in an investigation. A revision of the Security Rule proposed in early 2025, still under review, would remove the category.

No, the two overlap only in part. The GDPR governs any processing of personal data and treats health data as a special category; HIPAA covers only protected health information held by covered entities and their business associates. The notification regimes differ as well: seventy-two hours to the supervisory authority under the GDPR, against notice to affected individuals without unreasonable delay and no later than sixty days from discovery under HIPAA, with the US regulator informed according to the scale of the breach. Serving the US market means running both on one shared set of controls.

Automation belongs to whatever repeats: the inventory of where PHI is created, stored and transmitted, the evidence that administrative, physical and technical safeguards are operating, the tracking of business associate agreements and their renewal dates. A spreadsheet holds the list but not the tie between a safeguard, the risk that justifies it and the decision taken on an addressable measure, and it flags no risk analysis that has gone stale. Judgement stays manual: signing an agreement, justifying an addressable measure, training the workforce. In Vailor, the AI prefills the risk analysis from your documents, and your experts keep the decision.