HIPAA requirements, mapped to the evidence that supports them
SmartAssessor maps 81 HIPAA Security Rule and Breach Notification Rule requirements to the evidence that supports them. HIPAA assessments are in development.
Each requirement is mapped to the evidence artefacts that show it is met, such as policies, procedures, records and technical evidence across administrative, physical and technical safeguards.
SmartAssessor provides digital tools to support HIPAA-aligned compliance workflows. SmartAssessor does not provide certification, legal advice or regulatory approval.
What is HIPAA?
The Health Insurance Portability and Accountability Act (HIPAA) is a United States federal law that establishes requirements for protecting the privacy and security of protected health information (PHI).
HIPAA is supported by four key regulatory rules, namely the Privacy Rule, the Security Rule, the Breach Notification Rule and the Enforcement Rule. Together, these define how covered entities and business associates must safeguard patient information, manage access, respond to incidents, and demonstrate compliance to regulators.
HOW IT’S STRUCTURED
The rules we map, section by section
81 requirements across the Security Rule and the Breach Notification Rule. The Privacy Rule and the Enforcement Rule are not mapped.
Security Rule
45 CFR 164.306–164.316164.306General rules
164.308Administrative safeguards
164.310Physical safeguards
164.312Technical safeguards
164.314Organizational requirements
164.316Policies, procedures and documentation
Breach Notification Rule
45 CFR 164.402–164.414164.402–414Breach notification
Common HIPAA compliance challenges
Fragmented compliance records
Risk assessments, training records, access controls and incident documentation are frequently spread across disconnected systems.
Incident response documentation
Regulatory scrutiny requires fast, accurate access to evidence showing how data is protected and how incidents were correctly managed.
Ongoing risk management
HIPAA is continuous, not point-in-time. Maintaining oversight of safeguards, actions and accountability is operationally difficult.
Executive exposure
Non-compliance carries financial penalties, legal risk and reputational impact, increasing the need for defensible audit trails.
Talk to us about HIPAA
HIPAA assessments are in development. Book a demo to see how SmartAssessor assesses evidence today, or contact us about HIPAA.