Frameworks that help meet and evidence the HIPAA Security Rule: recognized security practices under the 2021 HITECH amendment, HHS's 405(d) HICP practices and performance goals, and NIST SP 800-66.
What Public Law 116-321 changed: what counts as a recognized security practice, the 12-month look-back, how OCR weighs it in fines, audits and settlements, what it does not do, and how OCR asks for evidence.
Using HHS's HICP publication and performance goals in a HIPAA program: the five threats and ten practices, volumes by organization size, its status as a recognized security practice source, and what it does not guarantee.
How NIST SP 800-66 Rev. 2 helps implement the Security Rule: key activities per standard, risk assessment guidance, the NIST publications HHS lists as informational, the NIST CSF crosswalk, and mapping to SP 800-53 used by cloud providers.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.