Free HIPAA guides
One guide for each HIPAA Compliance Category. Grouped by applicable controls with rationale for why they matter, the threat scenarios they defend against, what enforcement looks like, and templates that help you meet them. No cost, no sign up.
Getting started with HIPAA
New to this? The free playbook walks the first steps in order: what applies to you, the documents to put in place, and the habits that keep them real.
Risk Management
Risk analysis, management, and security program ownership.
6 controls · 4 templates · 1 threat scenario · enforcement patterns
Access Management
ePHI Access: Authorization, Identity Proofing, Authentication, and Termination.
13 controls · 5 templates · 4 threat scenarios · enforcement patterns
Data Security
Encryption, integrity, and transmission security for ePHI at rest and in motion.
7 controls · 2 templates · 4 threat scenarios · enforcement patterns
Asset Management
The devices, media, and premises that hold ePHI: endpoint protection, facility access, tracking, and disposal.
12 controls · 6 templates · 4 threat scenarios · enforcement patterns
Policies & Governance
Map how your team works to HIPAA provisions: policies, documentation and retention, training, and sanctions.
14 controls · 7 templates · 1 threat scenario · enforcement patterns
Vendor & BAA Management
Business associate agreements and downstream subcontractor assurances.
8 controls · 9 templates · 1 threat scenario · enforcement patterns
Privacy
The substantive Privacy Rule duties: permitted uses and disclosures, minimum necessary, and individual rights.
20 controls · 5 templates · 1 threat scenario · enforcement patterns
Process Diligence
Operational functions: review, monitor, evaluate, and notify.
15 controls · 4 templates · 3 threat scenarios · enforcement patterns
Resilience & Continuity
Withstand and recover: contingency planning, backups, disaster recovery, and incident response.
8 controls · 9 templates · 4 threat scenarios · enforcement patterns