HIPAA Audits

A 2020 amendment to the US HITECH Act included an infosec “safe harbor” for HIPAA. While it is not truly a “safe harbor”, the HITECH Act amendment allows the US government to reduce penalties and reduce audit times when a recognized framework is adopted and implemented.

While the HITECH Act amendment specifically mentions NIST; ISO/IEC frameworks also satisfy the safe harbor requirements as “other available” options.

We support the following commonly used frameworks in the HIPAA compliance environment: 

• The NIST CSF for information security.
• NIST Appendix J for privacy.
• ISO/IEC 27001 for information security (an international standard).
• ISO/IEC 27701 for privacy (an international standard).
• NIST 800-53 for information security.
• HHS/OCR audit standards.

Frameworks are often combined to address the full spectrum of an organization's potential risks risks.