HIPAA compliance guide
Key Takeaways
- What is HIPAA, and who does it cover?
- What do the Privacy, Security, and Breach Notification Rules require?
- How long do Security Rule records have to be kept?
- Is there an official HIPAA certification?
What is HIPAA, and who does it cover?
This guide explains the national standards for protecting health information. Covered entities include health plans, health care clearinghouses, and health care providers. A business associate is a person or organization, outside that workforce, whose work involves protected health information. This is a national federal guide. It is not legal advice.
What do the Privacy, Security, and Breach Notification Rules require?
The requirements below are from 45 CFR Subtitle A, the 10-1-24 edition, part 164. Section 164.308 is Administrative safeguards. Section 164.310 is Physical safeguards. Section 164.312 is Technical safeguards. In section 164.312, unique user identification is Required. Automatic logoff, and encryption and decryption, are Addressable. Addressable is not the same as Required.
Section 164.404(b) requires notice to each affected individual without unreasonable delay and in no case later than 60 calendar days after discovery of a breach. Section 164.406 requires notice to prominent media outlets when a breach involves more than 500 residents of a State or jurisdiction. Section 164.408 requires notice to the Secretary. Source: 45 CFR part 164, 10-1-24 edition.
For a small business, the practical start is a map of where protected health information goes. Typical pieces, not a complete compliance program, are:
- Hosting configured for that data, with access managed at the operating-system and application layers, under a signed business associate agreement. What to ask a host is on the HIPAA hosting guide.
- Network controls and restricted remote access. The 2024 CFR text above makes transmission security and encryption addressable specifications, not a promise that every control is Required.
- Encrypted backups in a separate location, with recovery objectives the organization sets for itself. This page does not publish those numbers.
- Role-based access. Unique user identification is Required in § 164.312. Automatic logoff is Addressable there.
- Email and file tools. Google's Workspace help page, last updated October 26, 2026, says a customer who is subject to HIPAA and wants to use covered Workspace or Cloud Identity services must accept Google's business associate amendment, and must not use protected health information in those services without it (Google Workspace HIPAA help).
- Checks for suspicious activity and vulnerability scanning on a schedule the organization chooses.
How long do Security Rule records have to be kept?
Section 164.316(b)(2)(i) of the same 10-1-24 edition says to retain the documentation required by paragraph (b)(1) for 6 years from the date of its creation or the date when it last was in effect, whichever is later.
Paragraph (b)(2)(iii) says to review that documentation periodically and update it when environmental or operational changes affect the security of the electronic protected health information.
Is there an official HIPAA certification?
The 10-1-24 part 164 text read for this guide does not create an official HIPAA certification. Yes. puna.one signs HIPAA BAAs. Current hosting scope is on the managed hosting page.
References
- U.S. Government Publishing Office. 45 CFR Subtitle A, 10-1-24 Edition, part 164. Sections 164.308, 164.310, 164.312, 164.316, 164.404, 164.406, and 164.408. https://www.govinfo.gov/content/pkg/CFR-2024-title45-vol2/pdf/CFR-2024-title45-vol2-part164.pdf
- Google Workspace Help. HIPAA Compliance with Google Workspace and Cloud Identity. Last updated October 26, 2026. https://support.google.com/a/answer/3407054
- Related pages: HIPAA hosting and managed hosting.
Guide only. puna.one does not hold, and this page does not imply, any certification, attestation or audit report for this framework.
This guide is not legal advice.