<- Back to Blog
Healthcare IT Compliance Guide: HIPAA, HITRUST & Security Templates
Healthcare organizations face the most stringent data protection requirements of any industry. A single HIPAA violation can result in millions in fines, criminal charges, and irreparable reputation damage. Yet many healthcare IT teams struggle to translate regulatory requirements into practical security controls.
This guide bridges that gap, providing actionable templates for HIPAA compliance, HITRUST certification preparation, and healthcare IT security management. Whether you're a hospital system, health tech startup, or business associate, these resources help you build and maintain a compliant security program.
For related compliance resources, explore our IT Management Hub, Security & Compliance Center, and IT Governance Framework Guide. For policy templates, see our IT Policy Templates.
Healthcare Regulatory Landscape
Key Regulations Overview
| Regulation | Scope | Enforcer | Maximum Penalty |
|---|---|---|---|
| HIPAA Privacy Rule | PHI use and disclosure | HHS OCR | $1.9M per violation category |
| HIPAA Security Rule | ePHI safeguards | HHS OCR | $1.9M per violation category |
| HIPAA Breach Notification | Breach reporting | HHS OCR | $1.9M per violation category |
| HITECH Act | Breach penalties, EHR incentives | HHS | Increased criminal penalties |
| 21st Century Cures | Information blocking | ONC | $1M per violation |
| State Laws | Varies by state | State AGs | Varies |
HIPAA Penalty Tiers
| Tier | Knowledge Level | Per Violation | Annual Maximum |
|---|---|---|---|
| 1 | Did not know | $100 - $50,000 | $1,900,000 |
| 2 | Reasonable cause | $1,000 - $50,000 | $1,900,000 |
| 3 | Willful neglect (corrected) | $10,000 - $50,000 | $1,900,000 |
| 4 | Willful neglect (not corrected) | $50,000+ | $1,900,000 |
Who Must Comply
Covered Entities:
- Healthcare providers (hospitals, physicians, pharmacies)
- Health plans (insurers, HMOs, employer health plans)
- Healthcare clearinghouses
Business Associates:
- IT vendors handling PHI
- Cloud service providers
- EHR vendors
- Billing companies
- Consultants with PHI access
- Shredding companies
HIPAA Security Rule Framework
Administrative Safeguards
| Standard | Implementation Specifications | Required/Addressable |
|---|---|---|
| Security Management Process | ||
| Risk analysis | Required | |
| Risk management | Required | |
| Sanction policy | Required | |
| Information system activity review | Required | |
| Assigned Security Responsibility | ||
| Designate security official | Required | |
| Workforce Security | ||
| Authorization procedures | Addressable | |
| Workforce clearance | Addressable | |
| Termination procedures | Addressable | |
| Information Access Management | ||
| Access authorization | Addressable | |
| Access establishment and modification | Addressable | |
| Security Awareness Training | ||
| Security reminders | Addressable | |
| Protection from malware | Addressable | |
| Log-in monitoring | Addressable | |
| Password management | Addressable | |
| Security Incident Procedures | ||
| Response and reporting | Required | |
| Contingency Plan | ||
| Data backup plan | Required | |
| Disaster recovery plan | Required | |
| Emergency mode operation | Required | |
| Testing and revision | Addressable | |
| Applications and data criticality | Addressable | |
| Evaluation | ||
| Periodic evaluation | Required | |
| Business Associate Contracts | ||
| Written contracts | Required |
Physical Safeguards
| Standard | Implementation Specifications | Required/Addressable |
|---|---|---|
| Facility Access Controls | ||
| Contingency operations | Addressable | |
| Facility security plan | Addressable | |
| Access control and validation | Addressable | |
| Maintenance records | Addressable | |
| Workstation Use | ||
| Policies and procedures | Required | |
| Workstation Security | ||
| Physical safeguards | Required | |
| Device and Media Controls | ||
| Disposal | Required | |
| Media re-use | Required | |
| Accountability | Addressable | |
| Data backup and storage | Addressable |
Technical Safeguards
| Standard | Implementation Specifications | Required/Addressable |
|---|---|---|
| Access Control | ||
| Unique user identification | Required | |
| Emergency access procedure | Required | |
| Automatic logoff | Addressable | |
| Encryption and decryption | Addressable | |
| Audit Controls | ||
| Hardware, software, procedural mechanisms | Required | |
| Integrity | ||
| Mechanism to authenticate ePHI | Addressable | |
| Person or Entity Authentication | ||
| Verification procedures | Required | |
| Transmission Security | ||
| Integrity controls | Addressable | |
| Encryption | Addressable |
Risk Assessment Template
Risk Analysis Worksheet
Step 1: Inventory ePHI Systems
| System Name | Description | PHI Types | Users | Location | Owner |
|---|---|---|---|---|---|
| Epic EHR | Electronic health records | All PHI | 500 | On-prem | CIO |
| Patient Portal | Patient access | Demographics, records | 10,000 | Cloud | IT Director |
| Lab System | Laboratory information | Lab results | 50 | On-prem | Lab Director |
| Billing System | Claims processing | Billing data | 25 | Hosted | CFO |
| Staff communication | Incidental PHI | 800 | Cloud | IT Director |
Step 2: Identify Threats and Vulnerabilities
| Threat Category | Specific Threats | Likelihood | Impact |
|---|---|---|---|
| External Attacks | |||
| Ransomware | High | Critical | |
| Phishing | High | High | |
| SQL injection | Medium | High | |
| DDoS | Medium | Medium | |
| Insider Threats | |||
| Unauthorized access | Medium | High | |
| Data theft | Low | Critical | |
| Accidental disclosure | High | Medium | |
| Technical Failures | |||
| System outage | Medium | High | |
| Data corruption | Low | High | |
| Integration failure | Medium | Medium | |
| Environmental | |||
| Natural disaster | Low | Critical | |
| Power failure | Medium | Medium | |
| HVAC failure | Low | Low |
Step 3: Assess Current Controls
| Control Category | Control | Implemented? | Effective? | Gap? |
|---|---|---|---|---|
| Access Control | Unique user IDs | Yes | Yes | No |
| Role-based access | Yes | Partial | Yes | |
| MFA | Partial | Yes | Yes | |
| Session timeout | Yes | Yes | No | |
| Encryption | Data at rest | Partial | Yes | Yes |
| Data in transit | Yes | Yes | No | |
| Audit | Logging enabled | Yes | Yes | No |
| Log review | Partial | No | Yes | |
| Training | Annual training | Yes | Partial | Yes |
| Phishing tests | No | N/A | Yes |
Step 4: Calculate Risk Scores
| Risk | Likelihood (1-5) | Impact (1-5) | Controls | Residual Risk | Priority |
|---|---|---|---|---|---|
| Ransomware | 4 | 5 | Moderate | High (16) | 1 |
| Phishing | 5 | 4 | Weak | High (18) | 2 |
| Unauthorized access | 3 | 4 | Moderate | Medium (10) | 3 |
| System outage | 3 | 4 | Strong | Medium (8) | 4 |
| Natural disaster | 2 | 5 | Moderate | Medium (7) | 5 |
Step 5: Risk Treatment Plan
| Risk | Treatment | Specific Actions | Owner | Deadline | Status |
|---|---|---|---|---|---|
| Ransomware | Mitigate | Deploy EDR, improve backups, segment network | CISO | Q2 | In progress |
| Phishing | Mitigate | Security awareness training, email filtering | Security | Q1 | Planned |
| Unauthorized access | Mitigate | Implement MFA, review access rights | IT | Q1 | In progress |
| System outage | Mitigate | DR testing, redundancy | IT Ops | Q2 | Planned |
| Natural disaster | Accept | Document in BCP | Facilities | Complete | Done |
HITRUST CSF Overview
What is HITRUST?
HITRUST CSF (Common Security Framework) is a certifiable framework that harmonizes healthcare security requirements from multiple sources:
- HIPAA Security Rule
- NIST Cybersecurity Framework
- ISO 27001/27002
- PCI DSS
- COBIT
- State regulations
HITRUST Assessment Types
| Assessment | Scope | Validation | Validity | Cost Range |
|---|---|---|---|---|
| Self-Assessment | Organization choice | Self-attested | 1 year | $15K-30K |
| Validated Assessment | Organization choice | Assessor verified | 1 year | $50K-150K |
| Certification | Comprehensive | Third-party audit | 2 years | $100K-300K |
HITRUST Control Categories
| Domain | Control Objectives |
|---|---|
| 00 - Information Security Management | Governance, policies, organization |
| 01 - Access Control | Authentication, authorization, access management |
| 02 - Human Resources | Hiring, training, termination |
| 03 - Risk Management | Risk assessment, treatment, monitoring |
| 04 - Security Policy | Policy framework, review, compliance |
| 05 - Organization of Information Security | Roles, responsibilities, coordination |
| 06 - Compliance | Legal, regulatory, audit |
| 07 - Asset Management | Inventory, classification, handling |
| 08 - Physical and Environmental | Facility security, environmental controls |
| 09 - Communications and Operations | Operations security, malware, backup |
| 10 - Information Systems Acquisition | Development, testing, change management |
| 11 - Information Security Incident | Incident response, forensics |
| 12 - Business Continuity | BCP, DRP, testing |
| 13 - Privacy Practices | Privacy program, individual rights |
HITRUST Maturity Levels
| Level | Name | Description | Typical Score |
|---|---|---|---|
| 1 | Policy | Policies documented | 1+ |
| 2 | Procedure | Procedures implemented | 2+ |
| 3 | Implemented | Controls operating | 3+ |
| 4 | Measured | Metrics tracked | 4+ |
| 5 | Managed | Continuous improvement | 5 |
Certification Threshold: Average score of 3+ across all applicable controls
Policy Templates
Information Security Policy (Healthcare)
1. Purpose This policy establishes the information security requirements for protecting electronic Protected Health Information (ePHI) and other sensitive information at [Organization Name].
2. Scope This policy applies to all workforce members, business associates, and systems that create, receive, maintain, or transmit ePHI.
3. Roles and Responsibilities
| Role | Responsibilities |
|---|---|
| Privacy Officer | PHI policies, breach response, complaints |
| Security Officer | Security policies, risk management, incidents |
| IT Department | Technical controls, system security |
| Workforce Members | Policy compliance, incident reporting |
| Business Associates | Contractual security requirements |
4. Security Requirements
4.1 Access Control
- Unique user identification for all workforce members
- Role-based access limited to minimum necessary
- Multi-factor authentication for remote access
- Automatic session termination after 15 minutes inactivity
- Immediate access termination upon workforce departure
4.2 Audit Controls
- Logging enabled for all systems containing ePHI
- Logs retained for minimum 6 years
- Regular log review for unauthorized access
- Audit trail protection from tampering
4.3 Integrity Controls
- Encryption of ePHI at rest (AES-256 or equivalent)
- Encryption of ePHI in transit (TLS 1.2+)
- Digital signatures for critical transactions
- Hash verification for data integrity
4.4 Transmission Security
- Encrypted email for ePHI transmission
- Secure file transfer protocols only
- No ePHI via unencrypted channels
5. Incident Response
- Immediate reporting of suspected incidents
- Investigation within 24 hours
- Breach notification per HIPAA requirements
- Documentation and lessons learned
6. Training
- Security awareness training at hire
- Annual refresher training
- Role-specific training as needed
- Training documentation retained
7. Enforcement Violations may result in disciplinary action up to and including termination.
Business Associate Agreement Template
Key Provisions:
| Section | Requirement |
|---|---|
| Permitted Uses | BA may use PHI only as specified |
| Safeguards | BA must implement HIPAA safeguards |
| Breach Notification | BA must notify CE within 24 hours |
| Subcontractors | Same requirements flow down |
| Access | BA must provide access upon request |
| Audit | CE may audit BA compliance |
| Termination | Return/destroy PHI upon termination |
| Documentation | BA must maintain compliance records |
Breach Response Procedure
Timeline Requirements:
| Action | Deadline | Responsible |
|---|---|---|
| Initial assessment | 24 hours | Privacy Officer |
| Risk assessment | 48 hours | Security Officer |
| Breach determination | 15 days | Privacy Officer |
| Individual notification | 60 days from discovery | Privacy Officer |
| HHS notification (500+ individuals) | 60 days | Privacy Officer |
| HHS notification (under 500 individuals) | End of calendar year | Privacy Officer |
| Media notification (500+ in state) | 60 days | Communications |
Risk Assessment Factors:
- Nature and extent of PHI involved
- Unauthorized person who received/accessed PHI
- Whether PHI was actually acquired or viewed
- Extent to which risk has been mitigated
Compliance Audit Checklist
Pre-Audit Preparation
| Category | Item | Status |
|---|---|---|
| Policies | ||
| Information security policy current | ||
| Privacy policy current | ||
| All required policies documented | ||
| Policies accessible to workforce | ||
| Risk Assessment | ||
| Risk analysis completed within 12 months | ||
| Risk management plan documented | ||
| Vulnerabilities addressed | ||
| Training | ||
| All workforce trained | ||
| Training records available | ||
| Training content appropriate | ||
| Access Controls | ||
| User access list current | ||
| Terminated user access removed | ||
| Access authorization documented | ||
| Business Associates | ||
| BA inventory complete | ||
| All BAAs executed | ||
| BA compliance verified |
Technical Controls Audit
| Control | Evidence Required | Finding |
|---|---|---|
| Unique user IDs | User list, no shared accounts | |
| Access termination | Terminated user review | |
| Automatic logoff | Session timeout configuration | |
| Encryption at rest | Encryption configuration | |
| Encryption in transit | TLS configuration | |
| Audit logging | Log samples and configuration | |
| Malware protection | AV deployment and updates | |
| Patch management | Patch status report | |
| Backup procedures | Backup logs and test restores | |
| Emergency access | Documented procedure |
Physical Security Audit
| Control | Evidence Required | Finding |
|---|---|---|
| Facility access controls | Access logs, visitor procedures | |
| Workstation security | Physical placement, screen locks | |
| Device controls | Inventory, disposal records | |
| Media controls | Encryption, disposal certificates | |
| Environmental controls | Temperature, fire suppression |
Ongoing Compliance Program
Compliance Calendar
| Frequency | Activity | Owner |
|---|---|---|
| Daily | Log review for anomalies | Security team |
| Weekly | Patch status review | IT |
| Monthly | Access review (sampling) | Security |
| Quarterly | Policy review | Privacy/Security Officer |
| Quarterly | Training completion check | HR |
| Semi-Annual | Incident trend analysis | Security Officer |
| Annual | Full risk assessment | Security Officer |
| Annual | Penetration testing | Security/Vendor |
| Annual | Business associate review | Privacy Officer |
| Annual | Workforce training | HR |
| Annual | Policy comprehensive review | Privacy/Security Officer |
Key Metrics Dashboard
| Metric | Target | Current | Trend |
|---|---|---|---|
| Training completion | 100% | 94% | ↗ |
| Open audit findings | 0 | 3 | → |
| Risk assessment age | < 365 days | 280 days | ✓ |
| BA agreements current | 100% | 100% | ✓ |
| Security incidents | 0 breaches | 0 | ✓ |
| Access reviews current | 100% | 85% | ↘ |
| Patches within SLA | 95% | 92% | ↗ |
| Encryption coverage | 100% | 98% | ↗ |
Key Takeaways
-
Risk assessment is foundational: HIPAA requires documented risk analysis—everything else builds on this
-
Addressable doesn't mean optional: "Addressable" specifications must be implemented or documented why not
-
Business associates are your responsibility: Ensure BAAs are in place and monitor BA compliance
-
Training prevents incidents: Most breaches involve human error—invest in awareness
-
Document everything: If it's not documented, it didn't happen for compliance purposes
-
Plan for breach response: It's not if but when—have procedures ready
For related resources, explore our IT Governance Framework Guide, Security Policy Review Checklist, and Vendor Management Policy Guide.