Framework

HIPAA Security Rule (45 CFR 164): what it anchors in a questionnaire

Asked by hospitals, clinics and health plans that will share protected health information. A business associate question reaches past an ISO 27001 certificate.

The requirement lines are our statement of each clause, read against the copy we hold and cited to it. Ticked by default for hospital or health plan customers.

Families anchored here

10 families, 11 clauses cited

Family	Clause
Risk assessment	164.308(a)(1)(ii)(A)
Multi-factor authentication	164.312(d)
Encryption at rest	164.312(a)(2)(iv)
Encryption in transit	164.312(e)(1)
Logging and monitoring	164.312(b)
Incident response plan	164.308(a)(6)(i)
Notifying the customer of an incident	164.308(a)(6)(ii)
Business continuity plan	164.308(a)(7)(i)
Backup and disaster recovery	164.308(a)(7)(ii)(A)
Health information and business associate terms	164.308(b)(1) · 164.314(a)(1)

Every HIPAA clause the register cites, with its text and evidence