Build your foundation
Starter
A guided starting point for teams organizing their HIPAA readiness work.
Starting at $99 / month
Monthly workspace subscription
- Readiness.view
- Workspace.view
- Sra.basic
- Policies.library
- Calendar.view
- Calendar.basic
HIPAA compliance operations in one workspace
Move from uncertainty to an evidence-backed compliance program.
Assess risk, assign remediation, train your workforce, manage vendors and BAAs, collect evidence, prepare for incidents, and report progress from one secure operating workspace.
Simple commercial packaging
Choose the operating model that fits your organization.
Plans control capabilities on the server. Displayed access cannot unlock a paid module by itself.
Run compliance as a program
Professional
The complete operating workspace for recurring assessments, evidence, training, and vendor governance.
Starting at $299 / month
Monthly workspace subscription
- Readiness.view
- Workspace.view
- Sra.basic
- Sra.full
- Calendar.view
- Calendar.basic
Govern across every entity
Enterprise
Advanced governance for multi-entity organizations with delegated administration and integrations.
Custom pricing
Annual agreement available
- Readiness.view
- Workspace.view
- Sra.basic
- Sra.full
- Calendar.view
- Calendar.basic
Operate with expert support
Managed
Enterprise platform capabilities with a recurring human-assisted compliance work queue.
Custom pricing
Managed service agreement
- Readiness.view
- Workspace.view
- Sra.basic
- Sra.full
- Calendar.view
- Calendar.basic
Paid online services
A complete compliance operating system—not a static checklist.
Each service connects to a recurring activity, accountable owner, evidence trail, or professional review.
HIPAA Security Risk Assessment
A guided, versioned assessment of administrative, physical, and technical safeguards with a risk register and remediation plan.
Subscription + annual assessmentHIPAA Compliance Workspace
A central dashboard for controls, owners, evidence, due dates, approvals, readiness signals, and executive reporting.
Core SaaS subscriptionPolicy & Procedure Management
Versioned policy templates, organization variables, approvals, review dates, acknowledgments, and evidence history.
Tiered add-onWorkforce HIPAA Training
Role-based training assignments, quizzes, certificates, reminders, annual renewal, and completion reporting.
Per learner / subscriptionBusiness Associate & BAA Management
Track BA determinations, agreements, subcontractors, expiration dates, reviews, and supporting evidence.
Subscription / add-onVendor Risk Management
Questionnaires, due diligence, risk scoring, document requests, findings, and recurring reassessments.
Premium SaaSBreach & Incident Response Center
Incident intake, investigation timelines, four-factor assessment support, deadlines, approvals, and corrective actions.
Premium / enterpriseCompliance Evidence Vault
Private evidence records with control mapping, versions, retention, expiration reminders, and access history.
Core / premiumHIPAA Gap Assessment
A focused maturity and control-gap review that produces prioritized remediation work and an executive summary.
One-time + recurringRemediation Project Manager
Turn findings into owned tasks with severity, dependencies, due dates, evidence requirements, and reporting.
Core SaaSHIPAA Readiness Review
A human-assisted review of submitted evidence and workflows, clearly labeled as readiness and advisory support.
Professional serviceVirtual HIPAA Compliance Officer
Recurring oversight for policy reviews, risk reviews, training, vendor governance, evidence, and management reporting.
Monthly managed serviceHIPAA Compliance Calendar
Recurring obligations, review cycles, reminders, assignments, escalations, and completion evidence.
Core SaaSSecurity Incident Tabletop Exercises
Guided ransomware and breach scenarios with role assignments, decisions, lessons learned, and corrective actions.
One-time / enterpriseHIPAA Documentation Package Builder
Generate organization-specific policy packs, registers, forms, training records, BAA records, and readiness packages.
Paid export / add-onHealthcare Website Privacy & Tracking Review
Inventory tracking technologies and data flows, document safeguards, and create privacy and security remediation work.
Assessment / add-onHIPAA Help Desk & Expert Consultation
Book advisory sessions, submit questions, retain case history, attach evidence, and track recommendations.
Per session / subscriptionMulti-Entity & Multi-Location Compliance
Parent-child organizations, delegated administrators, shared controls, local evidence, and roll-up reporting.
EnterpriseCompliance API & Integrations
Auditable APIs and webhooks for HRIS, identity, ticketing, documents, security tools, LMS, and customer systems.
Enterprise / API planCommon questions
Understand what HIPAAmart provides.
Who is a HIPAA covered entity?
Detailed explanation
Coverage turns on the regulatory definitions and the organization’s actual activities. A provider is not automatically a covered entity solely because it provides health care.
What the organization should do
Document the organization’s functions, transaction types, legal entities, and hybrid-entity designations before making an applicability determination.
Important exceptions and context
Corporate structure and designated health care components can affect scope. Obtain qualified advice for entity-specific conclusions.
This HIPAAmart explanation is educational and operational guidance. It does not determine an organization’s legal status, replace the cited authority, or guarantee HIPAA compliance.
Coverage turns on the regulatory definitions and the organization’s actual activities. A provider is not automatically a covered entity solely because it provides health care.
What the organization should do
Document the organization’s functions, transaction types, legal entities, and hybrid-entity designations before making an applicability determination.
Important exceptions and context
Corporate structure and designated health care components can affect scope. Obtain qualified advice for entity-specific conclusions.
This HIPAAmart explanation is educational and operational guidance. It does not determine an organization’s legal status, replace the cited authority, or guarantee HIPAA compliance.
What are administrative, physical, and technical safeguards?
Detailed explanation
Administrative safeguards address governance and processes; physical safeguards address facilities, workstations, and devices; technical safeguards address access, audit, integrity, authentication, and transmission controls.
What the organization should do
Map each applicable Security Rule standard and implementation specification to current controls, owners, evidence, risks, and remediation plans.
Important exceptions and context
Safeguards are interdependent and must be reasonable and appropriate for the regulated entity’s environment and risks.
This HIPAAmart explanation is educational and operational guidance. It does not determine an organization’s legal status, replace the cited authority, or guarantee HIPAA compliance.
Administrative safeguards address governance and processes; physical safeguards address facilities, workstations, and devices; technical safeguards address access, audit, integrity, authentication, and transmission controls.
What the organization should do
Map each applicable Security Rule standard and implementation specification to current controls, owners, evidence, risks, and remediation plans.
Important exceptions and context
Safeguards are interdependent and must be reasonable and appropriate for the regulated entity’s environment and risks.
This HIPAAmart explanation is educational and operational guidance. It does not determine an organization’s legal status, replace the cited authority, or guarantee HIPAA compliance.
What is PHI, and how is it different from ePHI?
Detailed explanation
PHI depends on the information, identifiers, and the regulated context—not merely on whether a medical term appears. Electronic PHI is the subset created, received, maintained, or transmitted in electronic form.
What the organization should do
Inventory where PHI and ePHI are created, received, maintained, and transmitted. Classify systems and workflows so Privacy Rule and Security Rule obligations can be evaluated.
Important exceptions and context
De-identified information and certain employment or education records may be outside the HIPAA definition. Evaluate the specific regulatory exclusions and facts.
This HIPAAmart explanation is educational and operational guidance. It does not determine an organization’s legal status, replace the cited authority, or guarantee HIPAA compliance.
PHI depends on the information, identifiers, and the regulated context—not merely on whether a medical term appears. Electronic PHI is the subset created, received, maintained, or transmitted in electronic form.
What the organization should do
Inventory where PHI and ePHI are created, received, maintained, and transmitted. Classify systems and workflows so Privacy Rule and Security Rule obligations can be evaluated.
Important exceptions and context
De-identified information and certain employment or education records may be outside the HIPAA definition. Evaluate the specific regulatory exclusions and facts.
This HIPAAmart explanation is educational and operational guidance. It does not determine an organization’s legal status, replace the cited authority, or guarantee HIPAA compliance.
Can email contain PHI, and what safeguards should be evaluated?
Detailed explanation
Relevant safeguards can include recipient verification, minimum necessary, secure transport, encryption decisions, account security, retention, approved platforms, warnings, and incident procedures.
What the organization should do
Define approved email and messaging channels, configure protections, train users to verify recipients, restrict sensitive content where appropriate, and document patient communication workflows.
Important exceptions and context
Communications requested by individuals and communications among regulated entities can involve different considerations. Do not assume all “secure email” products are configured appropriately.
This HIPAAmart explanation is educational and operational guidance. It does not determine an organization’s legal status, replace the cited authority, or guarantee HIPAA compliance.
Relevant safeguards can include recipient verification, minimum necessary, secure transport, encryption decisions, account security, retention, approved platforms, warnings, and incident procedures.
What the organization should do
Define approved email and messaging channels, configure protections, train users to verify recipients, restrict sensitive content where appropriate, and document patient communication workflows.
Important exceptions and context
Communications requested by individuals and communications among regulated entities can involve different considerations. Do not assume all “secure email” products are configured appropriately.
This HIPAAmart explanation is educational and operational guidance. It does not determine an organization’s legal status, replace the cited authority, or guarantee HIPAA compliance.
What is a security incident?
Detailed explanation
The definition includes attempted events. The Security Rule requires policies and procedures to identify and respond to suspected or known incidents, mitigate harmful effects, and document outcomes.
What the organization should do
Define detection channels, severity criteria, response roles, evidence preservation, containment, investigation, mitigation, documentation, and escalation into breach evaluation.
Important exceptions and context
Not every security incident is a reportable breach, but every potential incident should be handled through a documented process.
This HIPAAmart explanation is educational and operational guidance. It does not determine an organization’s legal status, replace the cited authority, or guarantee HIPAA compliance.
The definition includes attempted events. The Security Rule requires policies and procedures to identify and respond to suspected or known incidents, mitigate harmful effects, and document outcomes.
What the organization should do
Define detection channels, severity criteria, response roles, evidence preservation, containment, investigation, mitigation, documentation, and escalation into breach evaluation.
Important exceptions and context
Not every security incident is a reportable breach, but every potential incident should be handled through a documented process.
This HIPAAmart explanation is educational and operational guidance. It does not determine an organization’s legal status, replace the cited authority, or guarantee HIPAA compliance.
What is the minimum necessary standard?
Detailed explanation
The Privacy Rule uses role-based and request-based implementation approaches rather than requiring a single data-field limit for every situation.
What the organization should do
Define workforce roles, access categories, routine disclosure protocols, and criteria for reviewing non-routine requests. Preserve the rationale for access decisions.
Important exceptions and context
The standard does not apply to every use or disclosure, including certain treatment disclosures and disclosures authorized by the individual. Confirm the applicable exception.
This HIPAAmart explanation is educational and operational guidance. It does not determine an organization’s legal status, replace the cited authority, or guarantee HIPAA compliance.
The Privacy Rule uses role-based and request-based implementation approaches rather than requiring a single data-field limit for every situation.
What the organization should do
Define workforce roles, access categories, routine disclosure protocols, and criteria for reviewing non-routine requests. Preserve the rationale for access decisions.
Important exceptions and context
The standard does not apply to every use or disclosure, including certain treatment disclosures and disclosures authorized by the individual. Confirm the applicable exception.
This HIPAAmart explanation is educational and operational guidance. It does not determine an organization’s legal status, replace the cited authority, or guarantee HIPAA compliance.
When does the minimum necessary standard not apply?
Detailed explanation
An exception to minimum necessary does not eliminate other Privacy Rule conditions or an organization’s Security Rule responsibilities for ePHI.
What the organization should do
Map each exception to the relevant workflow and train staff not to treat an exception as unrestricted permission to use or disclose PHI.
Important exceptions and context
The facts and purpose control. Verify the exact provision before relying on an exception.
This HIPAAmart explanation is educational and operational guidance. It does not determine an organization’s legal status, replace the cited authority, or guarantee HIPAA compliance.
An exception to minimum necessary does not eliminate other Privacy Rule conditions or an organization’s Security Rule responsibilities for ePHI.
What the organization should do
Map each exception to the relevant workflow and train staff not to treat an exception as unrestricted permission to use or disclose PHI.
Important exceptions and context
The facts and purpose control. Verify the exact provision before relying on an exception.
This HIPAAmart explanation is educational and operational guidance. It does not determine an organization’s legal status, replace the cited authority, or guarantee HIPAA compliance.
Does HIPAA require encryption in every circumstance?
Detailed explanation
Addressable specifications are not automatically optional. Risk, environment, data movement, available controls, and the consequences of unauthorized access should inform the decision.
What the organization should do
Document encryption decisions for data at rest and in transit, including scope, algorithms and key management, exceptions, compensating measures, owners, and review triggers.
Important exceptions and context
Encryption can also affect breach-notification analysis for unsecured PHI when HHS standards are met. Do not assume encryption alone resolves all safeguards.
This HIPAAmart explanation is educational and operational guidance. It does not determine an organization’s legal status, replace the cited authority, or guarantee HIPAA compliance.
Addressable specifications are not automatically optional. Risk, environment, data movement, available controls, and the consequences of unauthorized access should inform the decision.
What the organization should do
Document encryption decisions for data at rest and in transit, including scope, algorithms and key management, exceptions, compensating measures, owners, and review triggers.
Important exceptions and context
Encryption can also affect breach-notification analysis for unsecured PHI when HHS standards are met. Do not assume encryption alone resolves all safeguards.
This HIPAAmart explanation is educational and operational guidance. It does not determine an organization’s legal status, replace the cited authority, or guarantee HIPAA compliance.
HIPAAmart helps organizations operationalize, document, monitor, and improve HIPAA compliance activities.
Software output is readiness guidance and is not a government certification, legal opinion, or guarantee of compliance.
Catalog version 2026.08.