# HIPAA

> US rules protecting health information, and how to set up HIPAA Security Rule compliance in cSquare.

Source: https://docs.csquaregrc.com/frameworks/hipaa


HIPAA applies to US covered entities and their business associates handling **protected health information (PHI)**. It has three main rules: Privacy, Security and Breach Notification.

## Set up HIPAA in cSquare

1. **Create the program** from the HIPAA template. It covers the Security Rule's administrative, physical and technical safeguards.
2. **Map where PHI lives**: systems, vendors and data flows.
3. **Perform your risk analysis** in the [risk register](/guides/risks), as the Security Rule requires.
4. **Track business associate agreements** in [Vendors](/guides/vendors). Every vendor that touches PHI needs a signed BAA.
5. **Approve policies**: security management, workforce security, access, audit controls, contingency planning, breach notification.
6. **Train your workforce** and record acknowledgements.

```text
List every vendor in my register that likely handles PHI and tell me which ones are missing a BAA.
```

```text
Run a HIPAA Security Rule gap check on my program: list each safeguard without an implemented control or current evidence, grouped by administrative, physical and technical.
```

## Required vs addressable

Some implementation specifications are **required**; others are **addressable**, meaning you implement them or document why an equivalent measure is reasonable. Record that reasoning on the control.