Fast facts
HIPAA governs the protection of protected health information held by covered entities — providers, health plans and clearinghouses — and by the business associates that process PHI on their behalf. For Indian organisations, exposure almost always arrives through a Business Associate Agreement, which contractually imports the Security Rule and much of the Privacy Rule.
The Security Rule is control-based, organised into administrative, physical and technical safeguards. Each safeguard is either "required" or "addressable" — addressable does not mean optional; it means you must implement it, or document why it is not reasonable and appropriate and implement an equivalent alternative.
The Breach Notification Rule imposes tight timelines: notification to affected individuals without unreasonable delay and no later than 60 days from discovery, with contemporaneous notice to HHS for breaches affecting 500 or more individuals. Business associates must notify the covered entity, typically within a contractually shortened window.
Who it applies to
Penalties
Civil monetary penalties tiered by culpability, from approximately $141 to $71,162 per violation with an annual cap per identical provision, adjusted annually for inflation. Wilful neglect that is not corrected attracts the highest tier, and criminal penalties apply to knowing misuse.
The commercial and regulatory argument, rather than a restatement of the text. If none of these apply to you, the honest answer is that this framework is not your priority.
For Indian providers the exposure comes through a Business Associate Agreement, which imports the Security Rule and much of the Privacy Rule directly. Enforcement is contractual and reputational rather than an OCR action, but the substantive requirements are identical.
An inadequate or absent Security Rule risk analysis appears more often than any other issue in OCR enforcement. It is foundational — nearly every other safeguard decision is meant to flow from it — and a generic checklist will not withstand scrutiny.
Every addressable specification must be implemented, or you must document why it is not reasonable and appropriate and implement an equivalent alternative. Organisations that read "addressable" as discretionary accumulate findings.
Scope is the decision that sets the cost, and it is usually made in week one when the team knows least. Both columns matter equally.
In scope
Out of scope
How the boundary is decided: PHI leaks into places nobody scopes: support ticketing, application logs, screenshots in email, and test environments populated from production. Scope from where PHI actually appears rather than from the systems architecture diagram.
Stated as the duty rather than the clause number, because clause numbers do not tell an engineering team what to build.
Security management process including risk analysis and risk management, assigned security responsibility, workforce security, information access management, awareness training, incident procedures, contingency planning and periodic evaluation.
Facility access controls, workstation use and security policies, and device and media controls covering disposal, re-use, accountability and backup.
Unique user identification, emergency access, automatic logoff, encryption and decryption, audit controls, integrity controls and transmission security.
Written agreements with every business associate and subcontractor, flowing down safeguard obligations, breach notification duties and permitted uses of PHI.
Uses and disclosures limited to the minimum PHI necessary to accomplish the intended purpose, implemented through role-based access rather than policy statements alone.
Risk assessment of any impermissible use or disclosure, with notification to individuals, HHS and — for large breaches — the media within prescribed timelines.
The areas your teams will actually be building in, with control counts where the framework defines them.
Risk analysis, sanction policy, information system activity review and documented risk management decisions.
Unique identification, authorisation, access establishment and modification, and automatic logoff.
PHI encrypted at rest and in transit, with key management and integrity verification.
Audit controls recording activity in systems containing PHI, and mechanisms to detect improper alteration.
Clearance procedures, termination processes, and role-appropriate security awareness training with evidence of completion.
Data backup, disaster recovery, emergency mode operation, testing and criticality analysis for PHI systems.
Phases overlap deliberately. Design begins before assessment closes, so the programme does not stall waiting for a document to be signed off.
Weeks 1–3
Establish where protected health information enters, rests and leaves the environment, including ticketing, logs and non-production systems.
Weeks 3–6
Conduct the asset-level risk analysis to the standard OCR expects, documenting threats, vulnerabilities, likelihood and impact per system.
Weeks 6–14
Implement administrative, physical and technical safeguards, addressing every addressable specification explicitly with documented reasoning where alternatives are used.
Weeks 10–16
Review and strengthen Business Associate Agreements including subcontractor flow-down, and deliver role-appropriate workforce training with evidence.
Weeks 14–18
Build and rehearse the breach risk assessment and notification process against the 60-day clock.
Named artefacts, listed in the statement of work. If something is not on this list, we will tell you before you sign rather than after.
HIPAA compliance is continuous rather than certified. A readiness programme for an Indian business associate typically runs 12–18 weeks, with annual risk analysis thereafter.
PHI discovery
Weeks 1–3
Establishes true scope. Almost always larger than expected.
Risk analysis
Weeks 3–6
The foundational artefact. Everything else derives from it and OCR examines it first.
Safeguard implementation
Weeks 6–16
Administrative, physical and technical controls, plus contractual remediation.
Breach readiness
Weeks 14–18
Process built and rehearsed against the 60-day notification clock.
The sequence we follow, and the parts where first-time implementations most often lose time.
Establish exactly where PHI enters, rests and leaves your environment, including in ticketing and logs.
Conduct the Security Rule risk analysis to the standard OCR expects — the most commonly cited failure.
Address every addressable specification explicitly, with documented reasoning where alternatives are used.
Review and strengthen Business Associate Agreements, including subcontractor flow-down.
Implement audit controls and access review that can evidence minimum necessary in practice.
Build and rehearse the breach assessment and notification process against the 60-day clock.
Certification without the eighteen-month scramble.
Readiness, implementation and audit support for ISO 27001, ISO 27701, ISO 42001, SOC 2 and PCI DSS — run as a project with dates, owners and a definition of done.
Explore capabilityDefensible security, built around how your business actually loses money.
Threat-led security strategy, architecture and control design that prioritises the handful of scenarios that would genuinely hurt you — not a generic checklist of 300 controls.
Explore capabilityTurn data protection law into working product behaviour.
We map where personal data actually lives, rebuild consent and rights flows into your product, and leave you with a privacy programme that survives an audit and a board question.
Explore capabilitySequencing matters. Running these together off one control library costs meaningfully less than running them apart.
Including the questions where the honest answer is less convenient than the marketing one.
Ask a practitioner directly. First responses come from the person who would run your engagement, within one business day.
Ask a question
