HIPAA / HITECH

ePHI software inventory, business associate documentation, integrity controls, audit controls.


Short name	HITECH
Region	Americas
Country or scope	United States
Sector	Healthcare
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers HITECH

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 14 controls from Safeguard's control catalog for HITECH.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 26: 4 written for HITECH and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`HITECH-13401-BA` Business Associate Direct Liability	HITECH applies the Security Rule's safeguards directly to business associates, making it necessary to identify every vendor supplying software in the ePHI chain (HITECH Act s. 13401; 45 CFR 164.308(b))	Scan
`HITECH-164-400` Breach Notification Readiness	Breaches of unsecured PHI must be discovered, assessed and notified within 60 days, requiring rapid identification of affected software components and their versions (45 CFR 164.400-414, Breach Notification Rule)	Scan
`HITECH-164-312B` Audit Controls	Systems containing ePHI must implement mechanisms to record and examine activity, which requires an inventory of the software components subject to audit (45 CFR 164.312(b))	Scan
`HITECH-164-312C` ePHI Integrity Mechanisms	Electronic mechanisms must corroborate that ePHI has not been altered or destroyed in an unauthorized manner, supported by integrity hashes over the processing software (45 CFR 164.312(c))	Scan
`HITECH-RISKID` Vulnerability Identification for ePHI Systems	Ongoing risk analysis and management for ePHI systems requires components identifiable against vulnerability databases via standard identifiers (45 CFR 164.308(a)(1)(ii); HHS Security Risk Assessment guidance)	Scan
`HITECH-164-316` Retained Compliance Documentation	Required documentation must be retained for six years from creation or last effective date and be available to those implementing the safeguards, requiring identifiable, timestamped records (45 CFR 164.316(b))	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`164.308(a)(1)`	Conduct Enhanced Risk Analysis for ePHI
`13402(a)`	Notify Individuals of Breaches
`13402(e)(1)`	Notify Secretary of Breaches Affecting 500 or More
`13402(f)`	Notify Media for Large Breaches
`13405(b)`	Provide Electronic Accounting of Disclosures
`13405(c)`	Restrict Disclosures to Health Plans
`13410(d)`	Apply Enhanced Penalties for Willful Neglect
`164.308(b)(1)`	Extend Security Requirements to Business Associates
`164.312(a)(1)`	Implement Meaningful Use Security Controls
`164.312(b)`	Maintain Comprehensive Audit Trails for EHR
`164.312(e)(2)`	Encrypt ePHI at Rest and in Transit
`13401(a)`	Apply Security Rule to Business Associates Directly
`164.308(a)(6)`	Implement Security Incident Response and Reporting
`164.316(b)(1)`	Document Policies with Retention Schedules

Policy templates

Written for HITECH:

HITECH Enhanced Breach Notification Policy
HITECH Electronic Health Record Security Policy
HITECH Business Associate Direct Compliance Policy
HITECH Security Awareness and Training Policy

And 22 from the standard set, adapted to HITECH.