How to HIPAA: Process Diligence
Free HIPAA guide · 15 controls · 4 templates
Operational functions: review, monitor, evaluate, and notify. The sections below are assembled from the same control catalog, threat library, and enforcement mapping our free assessment runs on.
Why this matters
- Breach notification
- Defines how you assess and report breaches of unsecured PHI. Getting the four-factor analysis or the notification deadlines wrong turns a manageable incident into penalties and reputational damage.
The controls in this area
The 45 CFR §164 requirements HIPAA places here: 15 of the 103 controls in our catalog. Our free templates and assessment track each one:
164.308(a)(1)(ii)(D) · 164.308(a)(8) · 164.308(b)(1) · 164.402 · 164.404 · 164.406 · 164.408 · 164.410 · 164.410 / SLA · 164.412 · 164.414 · 164.530(d) · 164.530(f) · 164.308(a)(5)(ii)(C) · 164.312(b)
What enforcement looks like here
OCR's recurring investigation findings in this area:
- Information system activity review 164.308(a)(1)(ii)(D)
- Audit controls 164.312(b)
- Breach notification (timeliness) 164.404
Breach causes reported to HHS that implicate these controls: Hacking/IT · Unauthorized Access
Related threat scenarios
Common threats (NIST SP 800-30 classes) that this area's controls defend against:
- AdversarialWeb / application attack
Exploits: Misconfiguration; no logging · 164.312(b) Audit Controls; 164.308(a)(1)(ii)(D) Review
- AdversarialPhishing / credential theft
Exploits: No or weak MFA; reused passwords · 164.312(d) Authentication; 164.308(a)(5) Training
- AdversarialThird-party / subcontractor compromise
Exploits: Missing BAA; weak vendor controls · 164.308(b) / 164.502(e) BA Contracts
Free templates for this area
De-branded policy and procedures templates mapped to this area's controls. Read the full text free, then adapt them to your organization:
See where your organization stands on the 15 controls in this area.
Join Us