Keep your HIPAA Security Rule evidence in one record.
The HIPAA Security Rule sets the safeguards for electronic protected health information. Install it in Alvor and each standard and implementation specification gets an owner, an applicability decision and evidence, with scheduled checks on your cloud and identity settings.
HIPAA overview
The standard for healthcare data protection
$2.1M
Max penalty per violation category
3
Safeguard categories
60 days
Outer limit to notify individuals of a breach
HIPAA's Security Rule establishes national standards for protecting electronic protected health information (ePHI). It applies to covered entities and business associates, so if you build software for healthcare, process claims, store patient records, or provide services to healthcare organizations, HIPAA compliance is not optional. Violations carry fines up to $2.1M per violation category per year.
Domain coverage
Three safeguard categories
HIPAA's Security Rule organizes requirements into three categories of safeguards, each with required and addressable implementation specifications.
Administrative Safeguards
Security management processes, assigned security responsibility, workforce security, information access management, security awareness training, security incident procedures, contingency planning, and evaluation.
Physical Safeguards
Facility access controls, workstation use and security, device and media controls. Covers how you protect the physical systems and facilities that access ePHI.
Technical Safeguards
Access control, audit controls, integrity controls, person/entity authentication, and transmission security. Covers the technology protecting ePHI.
Breach Notification Rule
Requirements for notifying affected individuals, HHS, and media in the event of a breach of unsecured ePHI. Timelines, methods, and content requirements.
Privacy Rule
Establishes standards for how PHI, in any form, may be used and disclosed. Covers minimum necessary, patient rights, authorizations, and permitted uses.
Business Associate Agreements
Contractual requirements ensuring business associates implement appropriate safeguards. Covers required provisions, breach responsibilities, and subcontractor obligations.
Common challenges
Where HIPAA programs fall short, and how Alvor helps
The problem
Maintaining a risk analysis in a spreadsheet that was last updated when you onboarded your compliance officer
How Alvor helps
Each risk has a named owner, a likelihood and impact score on scales you define, a treatment and a review date, and every change lands in a hash-chained audit log.
The problem
No clear mapping between your technical controls and the specific HIPAA safeguard requirements they satisfy
How Alvor helps
Each safeguard requirement carries a named owner, an applicability decision with its rationale (including for addressable specifications) and the evidence behind it.
The problem
Business associate agreements scattered across email threads, shared drives, and contract management tools
How Alvor helps
Run business associates through Third-Party Risk Management: intake records the data they will hold, each contract sits on the vendor record with its incident-notification window and a warning before it expires, and the tier sets how often each is reassessed.
The problem
OCR investigation requests 3 years of access logs and you can't produce them within the required timeframe
How Alvor helps
Alvor's own audit log is hash-chained and exports to CSV. Keep the access-log exports your systems produce as evidence on the safeguards they support, each with a valid-until date.
What you get
HIPAA safeguards in one record
The Security Rule, installed
Install the HIPAA Security Rule and each standard and implementation specification becomes a control with an owner, an applicability decision, evidence and a status set by an assessment, a check or a recorded override.
Risk analysis workflow
Record each risk to ePHI with its scenario, the assets it affects and how it was identified, score likelihood and impact on scales you define, and record the treatment and any acceptance with a name and an expiry. The register exports to XLSX with its scoring criteria.
Business associates in Third-Party Risk Management
A requester files the business associate before it is engaged, an analyst assesses it through the vendor portal, contracts sit on the vendor record with a warning before they expire, and the tier sets the reassessment schedule.
Scheduled access checks
Checks on AWS, Okta, Microsoft Entra ID, GitHub and GitLab test MFA, admin accounts, password policy and CloudTrail logging on a schedule you set, and set the status of the controls they are bound to.
A breach procedure people have read
Write the incident and breach-notification procedure in Policy Management, route it through ordered approvals, publish it, and record each person's acknowledgement with time, IP address and session.
Policy acknowledgement
Acknowledgement campaigns send each security policy to everyone, named people or a department, with reminders and an optional recurring schedule, and record each acknowledgement with time, IP address and session.
Frequently asked
Common questions about HIPAA
Answers to the most common questions about covered entities, business associates, and maintaining HIPAA compliance.
HIPAA applies to covered entities (health plans, health care clearinghouses, and most health care providers) and to their business associates, which are any third parties that create, receive, maintain, or transmit protected health information on behalf of a covered entity. SaaS vendors, cloud providers, billing services, medical transcription companies, and analytics platforms serving healthcare clients are typically business associates.
Get started
See how Alvor works for your role
Whether you lead security, run IT, manage compliance, or sit in the C-suite - we'll show you your view.