Administrative
Risk analysis, a named security official, workforce access, training, incident and contingency, evaluation.
Frameworks · HIPAA
Safeguards you can show. Not an OCR stamp.
If you are a covered entity or a business associate, the Security Rule asks for administrative, physical, and technical safeguards around ePHI. ReadyComply instantiates those families. It does not make you HIPAA authorized, and it does not sign the BAA.
What HIPAA is
The Security Rule is required. Addressable is not optional theater.
Required implementation specifications must be done. Addressable ones must be implemented, or replaced with an equivalent, or documented as not reasonable. A blank status is not a decision. ReadyComply is where you write that decision down.
In the workspace
Starter families we instantiate.
Organizational
Business associate agreements with anyone who creates, receives, maintains, or transmits ePHI for you.
Physical and device
Facilities if you have them. Laptops and media even if the product is cloud-only.
Technical
Unique IDs, audit logs, integrity, authentication, transmission protection. File the config, not the slogan.
The cycle
What ReadyComply holds for HIPAA readiness.
- 01
Decide if ePHI is in scope.
Auth metadata can be PHI when it is tied to health access. Write the classification.
- 02
Name the security official.
A person. Recorded on the control.
- 03
Run the risk analysis.
Treatments become tasks. This is not a one-time PDF.
- 04
File BAAs and safeguard evidence.
Vendors who touch ePHI need more than a logo in the footer.
- 05
Evaluate on a schedule.
OCR is not ReadyComply. Keep the evaluation dated.
Also in the catalog
The other frameworks on this system.
Also in ReadyComply
The register around the safeguards.
Controls
Scope SOC 2, ISO 27001, HIPAA, and GDPR families to each system. Track status, owner, and why something is out of scope.
Evidence
File what you have against a control. Manual upload or a read-only connector.
Policies
Versioned drafts next to the controls they support. Know which text is current.
Read
Guide and checklist.
Write the risk analysis before you sign another BAA.
Sign in. HIPAA families instantiate with the system. Fill them in.
Sign in