HIPAA
US rules protecting health information, and how to set up HIPAA Security Rule compliance in cSquare.
Updated 2026-10-21
HIPAA applies to US covered entities and their business associates handling protected health information (PHI). It has three main rules: Privacy, Security and Breach Notification.
Set up HIPAA in cSquare
- Create the program from the HIPAA template. It covers the Security Rule's administrative, physical and technical safeguards.
- Map where PHI lives: systems, vendors and data flows.
- Perform your risk analysis in the risk register, as the Security Rule requires.
- Track business associate agreements in Vendors. Every vendor that touches PHI needs a signed BAA.
- Approve policies: security management, workforce security, access, audit controls, contingency planning, breach notification.
- Train your workforce and record acknowledgements.
List every vendor in my register that likely handles PHI and tell me which ones are missing a BAA.
Run a HIPAA Security Rule gap check on my program: list each safeguard without an implemented control or current evidence, grouped by administrative, physical and technical.
Required vs addressable
Some implementation specifications are required; others are addressable, meaning you implement them or document why an equivalent measure is reasonable. Record that reasoning on the control.