HIPAA Compliance
The Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for protecting sensitive patient health information (PHI). It requires covered entities and their business associates to implement administrative, physical, and technical safeguards.
Who Needs HIPAA?
Healthcare providers, health plans, healthcare clearinghouses, and their business associates.
Key Benefits
- Operate legally in US healthcare markets
- Protect patient trust and organizational reputation
- Avoid OCR enforcement actions and civil penalties
- Enable partnerships with covered entities
Key Requirements
- 1Administrative safeguards (security management, workforce training)
- 2Physical safeguards (facility access, workstation security)
- 3Technical safeguards (access controls, audit controls, encryption)
- 4PHI use and disclosure controls (minimum necessary standard)
- 5Breach notification procedures
- 6Business Associate Agreements
Required Policy Templates
3 policies required for HIPAA compliance, organized by category.
Generate HIPAA Documentation
Answer questions about your infrastructure and PoliWriter generates all 3 HIPAA policies customized to your organization. Audit-ready in hours, not months.
Get Started FreeNo credit card required. 3 documents free.
Other Compliance Frameworks
SOC 2 Type II
Service Organization Control 2 - Trust Services Criteria covering Security, Availability, Processing Integrity, Confidentiality, and Privacy. Requires an observation period of 3-12 months demonstrating controls operate effectively over time.
20 templatesGDPR
General Data Protection Regulation - EU data protection and privacy regulation.
3 templatesISO 27001
International standard for information security management systems (ISMS).
3 templatesPCI DSS v4.0
Payment Card Industry Data Security Standard — security controls for organizations that store, process, or transmit payment cardholder data.
12 templatesCCPA/CPRA
California Consumer Privacy Act / California Privacy Rights Act — grants California consumers rights over their personal information collected by businesses.
8 templatesNIST CSF 2.0
NIST Cybersecurity Framework — voluntary guidance for managing cybersecurity risk across five core functions: Identify, Protect, Detect, Respond, and Recover.
10 templatesSOC 2 Type I
SOC 2 Type I — Point-in-time assessment of your security controls design. Ideal for first-time certification before progressing to Type II.
0 templatesISO 42001
ISO/IEC 42001 — International standard for Artificial Intelligence Management Systems (AIMS), covering responsible AI development, deployment, and governance.
0 templatesNIS 2 Directive
NIS 2 Directive (EU 2022/2555) — EU-wide cybersecurity legislation requiring essential and important entities to implement comprehensive risk management and incident reporting.
0 templatesNIST SP 800-53
NIST SP 800-53 — Comprehensive catalog of security and privacy controls for federal information systems, widely adopted by private sector organizations.
0 templates