HIPAA Compliance Matrix

Document Version: 1.0 Date: November 11, 2025 Prepared For: Acme Corp Scope: Policy Framework HIPAA Security Rule & Privacy Rule Compliance Assessment

---

Executive Summary

This HIPAA Compliance Matrix provides a comprehensive mapping of Acme Corp's policy framework to the requirements of the Health Insurance Portability and Accountability Act (HIPAA) Security Rule (45 CFR Part 164, Subpart C) and Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E).

Overall Compliance Status

Security Rule Coverage: 92% of required specifications addressed Privacy Rule Coverage: 92% of key requirements addressed (updated to include policies/legal documents) Critical Gaps Identified: 3 areas requiring additional policy development (reduced from 8) Recommendations: 8 actionable items for enhanced compliance (reduced from 12)

This assessment demonstrates strong foundational compliance with HIPAA requirements. The organization maintains comprehensive internal operational policies (policies/) and has published public-facing legal notices (policies/legal/) that address patient rights, breach notification, and privacy practices. Remaining opportunities focus on workforce training documentation enhancements and emergency mode operations procedures.

---

Policy Framework Structure

This compliance assessment evaluates two distinct policy categories:

Internal Operational Policies (policies/)

Located in the /policies directory, these documents govern internal operations, staff responsibilities, and technical safeguards: - Purpose: Define operational procedures, technical controls, and staff responsibilities - Audience: Internal staff, IT teams, compliance personnel - Examples: SEC-002 (Access Control), SEC-004 (Incident Response), PRIV-001 (Data Privacy) - Compliance Role: Demonstrate implementation of HIPAA Security Rule safeguards

Public-Facing Legal Notices (policies/legal/)

Located in the /policies/legal directory, these documents communicate to patients and the public: - Purpose: Inform individuals of their HIPAA rights, privacy practices, and legal protections - Audience: Patients, healthcare consumers, general public - Examples: hipaa-compliance.md, privacy-policy.md, terms-conditions.md - Compliance Role: Demonstrate Privacy Rule patient rights, Notice of Privacy Practices, and breach notification commitments

Key Distinction: Internal policies describe how the organization operates. Public legal notices describe what rights and protections individuals have. Both are required for comprehensive HIPAA compliance. This assessment evaluates both categories to provide a complete compliance picture.

---

Table of Contents

1. Administrative Safeguards (§164.308)
2. Physical Safeguards (§164.310)
3. Technical Safeguards (§164.312)
4. Organizational Requirements (§164.314)
5. Policies and Procedures (§164.316)
6. Privacy Rule Requirements (§164.500 series)
7. Compliance Gap Summary
8. Recommendations

---

Administrative Safeguards (§164.308)

§164.308(a)(1) - Security Management Process

§164.308(a)(1)(i) - Security Management Process (Required)

Attribute	Details
HIPAA Requirement	Implement policies and procedures to prevent, detect, contain, and correct security violations.
Implementation Status	Addressed
Relevant Policies	• PRIV-001: Data Privacy and Security Policy • SEC-004: Incident Response and Reporting Policy • OPS-010: System Monitoring and Performance Management Policy
Policy Sections	• PRIV-001: Data Protection, Compliance sections • SEC-004: Incident Classification, Response Protocols, Detection and Analysis • OPS-010: Comprehensive Monitoring Coverage, Security Monitoring
Coverage Assessment	Strong (90%) - Comprehensive security management framework in place with clear incident response procedures, monitoring capabilities, and security controls. The policy framework establishes preventive, detective, and corrective controls across multiple layers.
Gaps	• Formal risk analysis documentation not explicitly referenced • Security management process documentation could be more explicitly tied to HIPAA requirements
Evidence of Compliance	• Documented incident response protocols with severity levels • Continuous monitoring with automated alerting • Quarterly security audits referenced in PRIV-001 • Post-incident review procedures in SEC-004

§164.308(a)(1)(ii)(A) - Risk Analysis (Required)

Attribute	Details
HIPAA Requirement	Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI).
Implementation Status	Partial
Relevant Policies	• OPS-004: Change Management Policy • COMP-003: Vendor Management Policy • OPS-002: Business Continuity and Disaster Recovery Policy
Policy Sections	• OPS-004: Risk Assessment and Impact Analysis • COMP-003: Vendor Assessment, Risk Classification • OPS-002: Business Impact Analysis (BIA), Risk Assessment
Coverage Assessment	Moderate (65%) - Risk analysis is embedded in change management, vendor assessment, and business continuity planning. However, a dedicated, documented enterprise-wide risk analysis specifically for ePHI is not explicitly described.
Gaps	• No standalone Risk Analysis Policy or documented risk assessment methodology • Missing annual risk analysis requirement • Risk register not mentioned • ePHI-specific risk analysis not explicitly documented
Evidence of Compliance	• Change management includes risk evaluation procedures • Vendor risk classification framework • Business impact analysis in disaster recovery planning

§164.308(a)(1)(ii)(B) - Risk Management (Required)

Attribute	Details
HIPAA Requirement	Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.
Implementation Status	Addressed
Relevant Policies	• PRIV-001: Data Privacy and Security Policy • SEC-002: Access Control and Authorization Policy • SEC-003: Password and Authentication Policy • SEC-005: Remote Work and Mobile Device Management Policy
Policy Sections	• PRIV-001: Data Protection, Access Controls sections • SEC-002: Role-Based Access Control, Access Reviews, Principle of Least Privilege • SEC-003: Password Requirements, Two-Factor Authentication • SEC-005: Device Security, Data Handling on Mobile Devices
Coverage Assessment	Strong (88%) - Comprehensive security controls implemented across access control, authentication, encryption, and device management. Controls are risk-based and documented.
Gaps	• Formal risk treatment plans not explicitly documented • Residual risk acceptance process not clearly defined
Evidence of Compliance	• Encryption required for data at rest and in transit (PRIV-001) • Multi-factor authentication implementation (SEC-003) • Role-based access with least privilege (SEC-002) • Regular access reviews and recertification (SEC-002)

§164.308(a)(1)(ii)(C) - Sanction Policy (Required)

Attribute	Details
HIPAA Requirement	Apply appropriate sanctions against workforce members who fail to comply with security policies and procedures.
Implementation Status	Addressed
Relevant Policies	• SEC-001: Acceptable Use Policy • SEC-003: Password and Authentication Policy • PRIV-001: Data Privacy and Security Policy
Policy Sections	• SEC-001: Compliance and Enforcement section • SEC-003: Compliance and Enforcement, Violations • PRIV-001: Compliance and Enforcement, Violations
Coverage Assessment	Strong (85%) - Clear sanctions defined for policy violations with progressive discipline approach. Enforcement mechanisms documented across multiple policies.
Gaps	• Specific HIPAA violation sanctions not explicitly differentiated from general IT policy violations • Sanction documentation process not detailed
Evidence of Compliance	• Graduated sanctions from warning to termination (SEC-001) • Account suspension for non-compliance (SEC-003) • Documented disciplinary action process (PRIV-001) • Violation reporting requirements across policies

§164.308(a)(1)(ii)(D) - Information System Activity Review (Required)

Attribute	Details
HIPAA Requirement	Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.
Implementation Status	Addressed
Relevant Policies	• OPS-010: System Monitoring and Performance Management Policy • SEC-002: Access Control and Authorization Policy • SEC-004: Incident Response and Reporting Policy
Policy Sections	• OPS-010: Comprehensive Monitoring Coverage, Security Monitoring, Performance Reporting • SEC-002: Access Reviews (quarterly for all users, monthly for privileged) • SEC-004: Post-Incident Review, Documentation
Coverage Assessment	Strong (92%) - Comprehensive monitoring and review procedures with documented frequency and responsibilities. Audit logging with retention requirements in place.
Gaps	• Specific review of ePHI access logs not explicitly called out • Log review frequency for ePHI access could be more specific
Evidence of Compliance	• Continuous system monitoring with automated alerting (OPS-010) • Quarterly access reviews for all systems (SEC-002) • Monthly privileged account reviews (SEC-002) • One-year audit log retention (SEC-002) • Incident tracking and documentation (SEC-004)

---

§164.308(a)(2) - Assigned Security Responsibility

Attribute	Details
HIPAA Requirement	Identify the security official who is responsible for the development and implementation of security policies and procedures.
Implementation Status	Addressed
Relevant Policies	All security policies include ownership and responsibility assignments
Policy Sections	• Policy metadata: owner, approvers fields • Roles and Responsibilities sections in all policies • SEC-002: IT Security Team ownership • SEC-004: IT Security Team coordination
Coverage Assessment	Strong (95%) - Clear security ownership assigned. Chief Information Security Officer (CISO) identified as approver on security policies. IT Security Team designated as policy owner.
Gaps	• CISO role could be more prominently featured in a dedicated Information Security Governance Policy
Evidence of Compliance	• CISO listed as approver on SEC-002, SEC-004, SEC-005 • IT Security Team designated as owner on security policies • Clear responsibility matrices in each policy • Security Team responsibilities defined across policies

---

§164.308(a)(3) - Workforce Security

§164.308(a)(3)(i) - Workforce Security (Required)

Attribute	Details
HIPAA Requirement	Implement policies and procedures to ensure that all members of the workforce have appropriate access to ePHI and to prevent unauthorized access.
Implementation Status	Addressed
Relevant Policies	• SEC-002: Access Control and Authorization Policy • HR-002: Employee Onboarding and Offboarding IT Policy • HR-001: Employee IT Training and Awareness Policy
Policy Sections	• SEC-002: Role-Based Access Control, Access Request and Approval, Access Reviews • HR-002: Employee Onboarding, Offboarding, Transfers and Role Changes • HR-001: Security Awareness Training, Policy Refresher Training
Coverage Assessment	Strong (90%) - Comprehensive workforce security controls including access provisioning, role changes, termination procedures, and ongoing training.
Gaps	• Background check requirements mentioned but not fully detailed • Workforce security authorization termination procedures could be more explicit for different separation scenarios
Evidence of Compliance	• Formal access request and approval process (SEC-002) • Manager and data owner approvals required (SEC-002) • Standardized onboarding/offboarding procedures (HR-002) • Mandatory security awareness training (HR-001) • Quarterly access reviews (SEC-002)

§164.308(a)(3)(ii)(A) - Authorization and/or Supervision (Addressable)

Attribute	Details
HIPAA Requirement	Implement procedures for authorization and/or supervision of workforce members who work with ePHI.
Implementation Status	Addressed
Relevant Policies	• SEC-002: Access Control and Authorization Policy • HR-002: Employee Onboarding and Offboarding IT Policy
Policy Sections	• SEC-002: Access Request and Approval (manager approval required), Access Reviews • HR-002: Onboarding Day 1 Activities, Manager verifies access is appropriate
Coverage Assessment	Strong (85%) - Multi-level approval process with manager oversight. Regular certification of access appropriateness.
Gaps	• Supervision requirements for access to ePHI not explicitly detailed • Different authorization levels based on ePHI sensitivity not explicitly described
Evidence of Compliance	• Manager approval required for all access requests (SEC-002) • Data owner approval for sensitive data (SEC-002) • Executive approval for administrative access (SEC-002) • Managers certify team access quarterly (SEC-002)

§164.308(a)(3)(ii)(B) - Workforce Clearance Procedure (Addressable)

Attribute	Details
HIPAA Requirement	Implement procedures to determine that workforce member access is appropriate.
Implementation Status	Partial
Relevant Policies	• SEC-002: Access Control and Authorization Policy • HR-002: Employee Onboarding and Offboarding IT Policy
Policy Sections	• SEC-002: Role-Based Access Control, Access Reviews • HR-002: First Week activities, Manager verifies access • SEC-002: Privileged Access Management - Annual background checks mentioned
Coverage Assessment	Moderate (70%) - Access appropriateness verified through approval process and quarterly reviews. Background checks mentioned for privileged users.
Gaps	• Formal workforce clearance procedures not fully documented • Background check requirements not detailed (frequency, scope, criteria) • Clearance levels for different types of ePHI access not defined • Pre-employment screening procedures not explicitly detailed
Evidence of Compliance	• Business justification required for access requests (SEC-002) • Manager verification of access appropriateness (HR-002) • Annual background checks for privileged access users (SEC-002) • Role-based access tied to job functions (SEC-002)

§164.308(a)(3)(ii)(C) - Termination Procedures (Addressable)

Attribute	Details
HIPAA Requirement	Implement procedures for terminating access when employment ends or is no longer required.
Implementation Status	Addressed
Relevant Policies	• HR-002: Employee Onboarding and Offboarding IT Policy • SEC-002: Access Control and Authorization Policy
Policy Sections	• HR-002: Employee Offboarding, Account Deactivation Timeline, Emergency Offboarding • SEC-002: Access Revocation procedures
Coverage Assessment	Excellent (95%) - Comprehensive termination procedures with specific timelines and verification requirements. Distinguishes between voluntary and involuntary termination.
Gaps	• None significant - termination procedures are well-documented and comprehensive
Evidence of Compliance	• Immediate access termination for involuntary separations (HR-002) • Same-day termination for voluntary departures (HR-002) • 24-hour cloud service access removal (HR-002) • Equipment retrieval and data sanitization procedures (HR-002) • Offboarding checklist with verification (HR-002) • Emergency offboarding procedures with 15-minute response (HR-002) • Password reset on shared accounts (SEC-002)

---

§164.308(a)(4) - Information Access Management

§164.308(a)(4)(i) - Information Access Management (Required)

Attribute	Details
HIPAA Requirement	Implement policies and procedures for authorizing access to ePHI that are consistent with applicable requirements.
Implementation Status	Addressed
Relevant Policies	• SEC-002: Access Control and Authorization Policy • PRIV-001: Data Privacy and Security Policy
Policy Sections	• SEC-002: Role-Based Access Control, Access Request and Approval, Principle of Least Privilege • PRIV-001: Access Controls section
Coverage Assessment	Strong (88%) - Robust access management framework based on roles, least privilege, and need-to-know principles with formal approval processes.
Gaps	• ePHI-specific access categories not explicitly defined • Minimum necessary standard not explicitly referenced
Evidence of Compliance	• Formal access request process with approvals (SEC-002) • Role-based access control implementation (SEC-002) • Least privilege principle enforced (SEC-002) • Need-to-know basis for access grants (SEC-002) • Separation of duties for sensitive functions (SEC-002)

§164.308(a)(4)(ii)(A) - Isolating Health Care Clearinghouse Functions (Required for Clearinghouses)

Attribute	Details
HIPAA Requirement	If a health care clearinghouse is part of a larger organization, implement policies to protect ePHI from unauthorized access by the larger organization.
Implementation Status	Not Applicable
Relevant Policies	N/A
Policy Sections	N/A
Coverage Assessment	N/A - Acme Corp is not a healthcare clearinghouse
Gaps	N/A
Evidence of Compliance	N/A

§164.308(a)(4)(ii)(B) - Access Authorization (Addressable)

Attribute	Details
HIPAA Requirement	Implement policies for granting access to ePHI through workstations, transactions, programs, processes, or other mechanisms.
Implementation Status	Addressed
Relevant Policies	• SEC-002: Access Control and Authorization Policy • SEC-003: Password and Authentication Policy • SEC-005: Remote Work and Mobile Device Management Policy
Policy Sections	• SEC-002: Access Request and Approval, Access Provisioning • SEC-003: Two-Factor Authentication requirements • SEC-005: Secure Remote Access, Context-aware access policies
Coverage Assessment	Strong (90%) - Comprehensive access authorization covering various access mechanisms including remote, mobile, and SSO-based access.
Gaps	• Workstation-specific access controls not explicitly detailed • Transaction-level access controls for ePHI applications not explicitly described
Evidence of Compliance	• Documented access request and approval process (SEC-002) • Google Workspace SSO with 2FA required (SEC-003, SEC-005) • Context-aware access based on device compliance (SEC-005) • Role-based access provisioning (SEC-002)

§164.308(a)(4)(ii)(C) - Access Establishment and Modification (Addressable)

Attribute	Details
HIPAA Requirement	Implement policies for establishing, documenting, reviewing, and modifying access rights.
Implementation Status	Addressed
Relevant Policies	• SEC-002: Access Control and Authorization Policy • HR-002: Employee Onboarding and Offboarding IT Policy
Policy Sections	• SEC-002: Access Request and Approval, Access Modification, Access Reviews • HR-002: Transfers and Role Changes
Coverage Assessment	Excellent (92%) - Comprehensive procedures for the entire access lifecycle from establishment through modification to termination. Documentation and review requirements clearly defined.
Gaps	• None significant - access lifecycle procedures are comprehensive
Evidence of Compliance	• Formal access request process with documentation (SEC-002) • Access modification procedures with approval (SEC-002) • Quarterly access reviews for all users (SEC-002) • Monthly reviews for privileged accounts (SEC-002) • Role change procedures with access updates (HR-002) • Access provisioning documented in ticketing system (HR-002)

---

§164.308(a)(5) - Security Awareness and Training

§164.308(a)(5)(i) - Security Awareness and Training (Required)

Attribute	Details
HIPAA Requirement	Implement a security awareness and training program for all workforce members.
Implementation Status	Addressed
Relevant Policies	• HR-001: Employee IT Training and Awareness Policy • HR-002: Employee Onboarding and Offboarding IT Policy
Policy Sections	• HR-001: Orientation Training, Security Awareness Training, Policy Refresher Training • HR-002: Day 1 Activities - Security awareness training assigned
Coverage Assessment	Strong (85%) - Comprehensive training program with new hire orientation, annual refreshers, and ongoing security awareness activities.
Gaps	• HIPAA-specific training content not explicitly detailed • Training effectiveness metrics could be more specific • Documentation of training completion and records retention not fully detailed
Evidence of Compliance	• Mandatory IT orientation within first week (HR-001) • Annual security awareness training required (HR-001) • Monthly security tips and reminders (HR-001) • Role-specific training programs (HR-001) • Training completion tracked and documented (HR-001)

§164.308(a)(5)(ii)(A) - Security Reminders (Addressable)

Attribute	Details
HIPAA Requirement	Periodic security updates and reminders to workforce members.
Implementation Status	Addressed
Relevant Policies	• HR-001: Employee IT Training and Awareness Policy
Policy Sections	• HR-001: Security Awareness Training - Monthly security tips and reminders, Timely alerts on emerging threats
Coverage Assessment	Strong (88%) - Regular security communications including monthly tips, quarterly campaigns, and timely threat alerts.
Gaps	• None significant - security reminder program is well-established
Evidence of Compliance	• Monthly security tips and reminders (HR-001) • Quarterly simulated phishing campaigns (HR-001) • Timely alerts on emerging threats (HR-001) • Security Team develops awareness content (HR-001)

§164.308(a)(5)(ii)(B) - Protection from Malicious Software (Addressable)

Attribute	Details
HIPAA Requirement	Procedures for guarding against, detecting, and reporting malicious software.
Implementation Status	Partial
Relevant Policies	• SEC-005: Remote Work and Mobile Device Management Policy • HR-001: Employee IT Training and Awareness Policy
Policy Sections	• SEC-005: Device Security - IT-approved antivirus/anti-malware software, Automatic security updates • HR-001: Security Awareness Training includes safe browsing and email habits
Coverage Assessment	Moderate (70%) - Antivirus and anti-malware requirements documented. Security awareness training includes malware prevention topics.
Gaps	• Dedicated Malware Protection Policy not present • Malware detection and reporting procedures not fully detailed • Malware response procedures not explicitly documented • Anti-malware software standards and update requirements not comprehensively defined
Evidence of Compliance	• IT-approved antivirus/anti-malware required on all devices (SEC-005) • Automatic security updates enabled (SEC-005) • Security awareness training covers safe browsing and email habits (HR-001) • Phishing simulations to test user awareness (HR-001)

§164.308(a)(5)(ii)(C) - Log-in Monitoring (Addressable)

Attribute	Details
HIPAA Requirement	Procedures for monitoring log-in attempts and reporting discrepancies.
Implementation Status	Addressed
Relevant Policies	• SEC-003: Password and Authentication Policy • OPS-010: System Monitoring and Performance Management Policy • SEC-002: Access Control and Authorization Policy
Policy Sections	• SEC-003: Multiple Failed Attempts - Accounts lock after 5 failed attempts within 15 minutes • OPS-010: Security Monitoring, Incident Detection and Response • SEC-002: Access activation logged and auditable
Coverage Assessment	Strong (85%) - Account lockout after failed attempts, comprehensive monitoring and logging of access activities.
Gaps	• Specific procedures for reviewing and investigating login anomalies not detailed • Login monitoring alert thresholds not explicitly defined
Evidence of Compliance	• Account lockout after 5 failed login attempts (SEC-003) • Access grant/revoke actions logged (SEC-002) • One-year audit log retention (SEC-002) • Security monitoring with automated alerting (OPS-010) • Session logging and monitoring through Google Workspace (SEC-002)

§164.308(a)(5)(ii)(D) - Password Management (Addressable)

Attribute	Details
HIPAA Requirement	Procedures for creating, changing, and safeguarding passwords.
Implementation Status	Addressed
Relevant Policies	• SEC-003: Password and Authentication Policy • SEC-002: Access Control and Authorization Policy
Policy Sections	• SEC-003: Password Requirements, Password Complexity, Password Length, Password Expiration, Secure Storage • SEC-002: Service Account password management
Coverage Assessment	Excellent (95%) - Comprehensive password management procedures including complexity, length, expiration, storage, and authentication requirements.
Gaps	• None significant - password management procedures are comprehensive and well-documented
Evidence of Compliance	• 12-character minimum for standard accounts, 16 for admin (SEC-003) • Password complexity requirements (uppercase, lowercase, numbers, special characters) (SEC-003) • No password reuse (last 5 passwords) (SEC-003) • 90-day expiration standard, 60-day for admin accounts (SEC-003) • Two-factor authentication required for Google Workspace and sensitive systems (SEC-003) • Secure password storage requirements (SEC-003) • Service account passwords 24+ characters, stored in vault (SEC-002)

---

§164.308(a)(6) - Security Incident Procedures

§164.308(a)(6)(i) - Security Incident Procedures (Required)

Attribute	Details
HIPAA Requirement	Implement policies and procedures to address security incidents.
Implementation Status	Addressed
Relevant Policies	• SEC-004: Incident Response and Reporting Policy
Policy Sections	• SEC-004: Incident Classification, Reporting Requirements, Response Protocols (Detection, Containment, Eradication, Recovery), Post-Incident Review
Coverage Assessment	Strong (90%) - Comprehensive incident response framework with clear procedures for detection, response, containment, eradication, recovery, and post-incident review.
Gaps	• Breach notification procedures (HIPAA-specific) not explicitly detailed • Breach risk assessment methodology not documented
Evidence of Compliance	• Defined incident severity levels (P1-P4) (SEC-004) • Clear reporting requirements with timeframes (SEC-004) • Structured response protocols (SEC-004) • Post-incident review within 1 week (SEC-004) • Lessons learned documentation (SEC-004) • Quarterly incident response drills (SEC-004)

§164.308(a)(6)(ii) - Response and Reporting (Required)

Attribute	Details
HIPAA Requirement	Identify and respond to suspected or known security incidents; mitigate harmful effects; document incidents and outcomes.
Implementation Status	Addressed
Relevant Policies	• policies/legal/hipaa-compliance.md • SEC-004: Incident Response and Reporting Policy
Policy Sections	• hipaa-compliance.md: Breach Notification - Procedures for detecting, responding to, mitigating, documenting, and reporting breaches • SEC-004: Response Protocols, Procedures (Initial Response, Investigation, Containment Actions, Recovery Process, Communication, Post-Incident Activities)
Coverage Assessment	Strong (92%) - Comprehensive incident response framework with explicit breach notification procedures. Public-facing breach notification commitment documented.
Gaps	• 4-factor breach risk assessment methodology not explicitly detailed • Specific breach notification timelines (60 days) not stated • HHS and media notification thresholds (500 individuals) could be more explicit
Evidence of Compliance	• Breach notification procedures publicly documented (hipaa-compliance.md) • Commitment to notify affected individuals and authorities per federal law • Incident response procedures designed to detect, respond, mitigate, document, and prevent breaches • All employees required to report incidents immediately (SEC-004) • Initial response within 30 minutes (SEC-004) • Incident tracking system for logging (SEC-004) • Containment actions documented (SEC-004) • Final incident report required (SEC-004) • Communications documented (SEC-004) • Regulatory reporting mentioned (within legal timeframes) (SEC-004)

---

§164.308(a)(7) - Contingency Plan

§164.308(a)(7)(i) - Contingency Plan (Required)

Attribute	Details
HIPAA Requirement	Establish policies and procedures for responding to emergencies or other occurrences that damage systems containing ePHI.
Implementation Status	Addressed
Relevant Policies	• OPS-001: Backup and Disaster Recovery Policy • OPS-002: Business Continuity and Disaster Recovery Policy
Policy Sections	• OPS-001: Data Backup, Disaster Recovery Plan, Recovery Objectives, Recovery Procedures • OPS-002: Business Continuity Planning, Disaster Recovery, Incident Classification
Coverage Assessment	Strong (90%) - Comprehensive contingency planning with backup procedures, disaster recovery plans, and business continuity procedures.
Gaps	• Emergency mode operations not explicitly detailed • ePHI access in emergency mode not specifically addressed
Evidence of Compliance	• Defined RTO and RPO for critical systems (OPS-001, OPS-002) • Documented disaster recovery procedures (OPS-001, OPS-002) • Backup and restoration procedures (OPS-001) • Alternative site arrangements (OPS-001) • Regular testing (quarterly DR tests, annual full-scale drill) (OPS-001, OPS-002)

§164.308(a)(7)(ii)(A) - Data Backup Plan (Required)

Attribute	Details
HIPAA Requirement	Establish procedures to create and maintain retrievable exact copies of ePHI.
Implementation Status	Addressed
Relevant Policies	• OPS-001: Backup and Disaster Recovery Policy
Policy Sections	• OPS-001: Data Backup (Backup Frequency, Backup Storage, Backup Verification)
Coverage Assessment	Excellent (95%) - Comprehensive backup procedures with frequency, encryption, geographic redundancy, retention, and verification testing.
Gaps	• None significant - backup procedures are comprehensive
Evidence of Compliance	• Daily full backups with hourly incremental for critical data (OPS-001) • Backups encrypted with AES-256 (OPS-001) • Geographic redundancy with separate regions (OPS-001) • 30-day daily retention, 1-year monthly retention (OPS-001) • Monthly test restoration of samples (OPS-001) • Automated verification daily (OPS-001) • Backup failure alerts within 1 hour (OPS-001)

§164.308(a)(7)(ii)(B) - Disaster Recovery Plan (Required)

Attribute	Details
HIPAA Requirement	Establish procedures to restore any loss of data and recover critical business processes and systems.
Implementation Status	Addressed
Relevant Policies	• OPS-001: Backup and Disaster Recovery Policy • OPS-002: Business Continuity and Disaster Recovery Policy
Policy Sections	• OPS-001: Disaster Recovery Plan, Recovery Procedures, Testing • OPS-002: Disaster Recovery, Business Continuity Planning, Recovery Time Objectives
Coverage Assessment	Strong (92%) - Detailed disaster recovery procedures with documented recovery steps, RTO/RPO objectives, and regular testing.
Gaps	• ePHI-specific recovery priorities not explicitly documented
Evidence of Compliance	• RTO: 4 hours for critical systems (OPS-001, OPS-002) • RPO: Maximum 1 hour data loss (OPS-001, OPS-002) • Step-by-step recovery procedures documented (OPS-001) • System prioritization defined (OPS-002) • Quarterly disaster recovery tests (OPS-001) • Annual full-scale DR drill (OPS-001, OPS-002) • Alternative infrastructure maintained (OPS-002)

§164.308(a)(7)(ii)(C) - Emergency Mode Operation Plan (Required)

Attribute	Details
HIPAA Requirement	Establish procedures to enable continuation of critical business processes for protection of ePHI while operating in emergency mode.
Implementation Status	Partial
Relevant Policies	• OPS-002: Business Continuity and Disaster Recovery Policy
Policy Sections	• OPS-002: Business Continuity Planning - Establishes alternate operations procedures and workarounds
Coverage Assessment	Moderate (70%) - Business continuity planning includes alternate operations procedures. However, specific emergency mode operations for ePHI protection not explicitly detailed.
Gaps	• Emergency mode operations plan not explicitly documented • ePHI access and security in emergency mode not specifically addressed • Emergency mode authorization procedures not detailed • Procedures for operating with partial system availability not fully documented
Evidence of Compliance	• Alternate operations procedures referenced (OPS-002) • Communication protocols for emergencies (OPS-002) • Incident classification levels (OPS-002) • Alternative infrastructure maintained (OPS-002)

§164.308(a)(7)(ii)(D) - Testing and Revision Procedures (Addressable)

Attribute	Details
HIPAA Requirement	Implement procedures for periodic testing and revision of contingency plans.
Implementation Status	Addressed
Relevant Policies	• OPS-001: Backup and Disaster Recovery Policy • OPS-002: Business Continuity and Disaster Recovery Policy
Policy Sections	• OPS-001: Testing, Documentation • OPS-002: Regular Testing and Exercises
Coverage Assessment	Excellent (95%) - Comprehensive testing program with multiple levels of testing, documentation of results, and plan updates based on findings.
Gaps	• None significant - testing and revision procedures are comprehensive
Evidence of Compliance	• Quarterly disaster recovery tests (OPS-001, OPS-002) • Annual full-scale disaster recovery drill (OPS-001, OPS-002) • Quarterly tabletop exercises (OPS-002) • Monthly backup restoration tests (OPS-001, OPS-002) • Test results documented (OPS-001, OPS-002) • Procedures updated based on test findings (OPS-001, OPS-002) • Post-test reviews documented (OPS-002)

§164.308(a)(7)(ii)(E) - Applications and Data Criticality Analysis (Addressable)

Attribute	Details
HIPAA Requirement	Assess the relative criticality of specific applications and data in support of other contingency plan components.
Implementation Status	Addressed
Relevant Policies	• OPS-002: Business Continuity and Disaster Recovery Policy • OPS-001: Backup and Disaster Recovery Policy
Policy Sections	• OPS-002: Business Continuity Planning - Business Impact Analysis (BIA) conducted annually, System Prioritization • OPS-001: Recovery Objectives - defines criticality levels
Coverage Assessment	Strong (85%) - Business impact analysis process with system criticality assessment and prioritized recovery approach.
Gaps	• ePHI-specific data criticality not explicitly documented • Criticality assessment methodology could be more detailed
Evidence of Compliance	• Annual Business Impact Analysis conducted (OPS-002) • System prioritization: Critical, Essential, Standard (OPS-002) • Different RTO/RPO for different criticality levels (OPS-001, OPS-002) • Critical systems identified (student portal, authentication, database) (OPS-002)

---

§164.308(a)(8) - Evaluation

Attribute	Details
HIPAA Requirement	Perform periodic technical and non-technical evaluation based on standards implemented to assess security and determine compliance.
Implementation Status	Addressed
Relevant Policies	• PRIV-001: Data Privacy and Security Policy • SEC-002: Access Control and Authorization Policy • OPS-010: System Monitoring and Performance Management Policy
Policy Sections	• PRIV-001: Compliance Audits - Quarterly audits to verify adherence to data protection standards • SEC-002: Compliance and Enforcement - Access reviews and audit logging • OPS-010: Compliance and Enforcement - Regular audits of monitoring effectiveness
Coverage Assessment	Strong (85%) - Regular compliance audits and reviews documented across multiple policies. Evaluation activities include access reviews, security audits, and monitoring assessments.
Gaps	• Formal HIPAA security evaluation not explicitly scheduled or documented • Comprehensive security evaluation methodology not detailed • Annual security evaluation requirement not explicitly stated
Evidence of Compliance	• Quarterly compliance audits (PRIV-001) • Quarterly access reviews (SEC-002) • Annual policy reviews (all policies) • Quarterly monitoring effectiveness reviews (OPS-010) • Annual third-party audit of backup and DR procedures (OPS-001)

---

§164.308(b) - Business Associate Contracts

§164.308(b)(1) - Business Associate Contracts (Required)

Attribute	Details
HIPAA Requirement	Obtain satisfactory assurances from business associates that they will appropriately safeguard ePHI through written contracts or other arrangements.
Implementation Status	Addressed
Relevant Policies	• COMP-003: Vendor Management Policy
Policy Sections	• COMP-003: Contract Requirements - HIPAA Business Associate Agreement (BAA), Due Diligence Requirements
Coverage Assessment	Excellent (95%) - Comprehensive business associate management with detailed BAA requirements, vendor assessment, and ongoing monitoring.
Gaps	• None significant - BAA requirements are comprehensive and well-documented
Evidence of Compliance	• BAA required for all vendors with PHI access (COMP-003) • BAA must be signed before PHI access (COMP-003) • BAA covers permitted uses, safeguards, breach notification, subcontractors, termination, data return (COMP-003) • Vendor assessment includes HIPAA compliance documentation (COMP-003) • 100% BAA coverage tracked as compliance metric (COMP-003) • Incident notification required within 24 hours (COMP-003) • Right to audit vendor practices (COMP-003)

---

Physical Safeguards (§164.310)

§164.310(a) - Facility Access Controls

§164.310(a)(1) - Facility Access Controls (Required)

Attribute	Details
HIPAA Requirement	Implement policies and procedures to limit physical access to electronic information systems and the facilities in which they are housed, while ensuring authorized access.
Implementation Status	Partial
Relevant Policies	• OPS-005: IT Asset Management Policy • SEC-005: Remote Work and Mobile Device Management Policy
Policy Sections	• OPS-005: Physical Security of Assets - Secure storage, Access control to equipment areas • SEC-005: Device Security requirements
Coverage Assessment	Moderate (60%) - Physical security requirements mentioned but not comprehensively detailed. Focus appears to be on cloud-based and remote operations.
Gaps	• Dedicated Physical Security Policy not present • Facility access control procedures not fully documented • Visitor access procedures not defined • Physical access logging not explicitly described • Data center physical security not detailed (may be handled by cloud provider)
Evidence of Compliance	• Secure storage in locked, access-controlled areas (OPS-005) • Physical access to server rooms restricted (OPS-005) • Lost/stolen device reporting required immediately (SEC-005) • Equipment retrieval during offboarding (HR-002)

§164.310(a)(2)(i) - Contingency Operations (Addressable)

Attribute	Details
HIPAA Requirement	Establish procedures to allow facility access in support of restoration of lost data under disaster recovery and emergency mode operations.
Implementation Status	Partial
Relevant Policies	• OPS-001: Backup and Disaster Recovery Policy • OPS-002: Business Continuity and Disaster Recovery Policy
Policy Sections	• OPS-001: Disaster Recovery Plan, Recovery Procedures • OPS-002: Disaster Recovery Implementation
Coverage Assessment	Moderate (65%) - Disaster recovery procedures documented but emergency facility access procedures not explicitly detailed.
Gaps	• Emergency facility access procedures not explicitly documented • Physical access during disaster recovery operations not detailed • Emergency access authorization procedures not specified
Evidence of Compliance	• Alternative site arrangements if primary facility unavailable (OPS-001) • Cloud-based backup infrastructure (OPS-002) • Recovery procedures documented (OPS-001)

§164.310(a)(2)(ii) - Facility Security Plan (Addressable)

Attribute	Details
HIPAA Requirement	Implement policies to safeguard facilities and equipment from unauthorized physical access, tampering, and theft.
Implementation Status	Partial
Relevant Policies	• OPS-005: IT Asset Management Policy
Policy Sections	• OPS-005: Physical Security of Assets
Coverage Assessment	Moderate (55%) - Basic physical security requirements mentioned but comprehensive facility security plan not documented.
Gaps	• Formal Facility Security Plan not present • Physical security controls (cameras, alarms, etc.) not documented • Environmental controls not detailed • Physical perimeter security not addressed • Facility security testing not described
Evidence of Compliance	• Secure storage requirements (OPS-005) • Access control to equipment areas (OPS-005) • Environmental controls mentioned for critical equipment (OPS-010) • Insurance coverage for high-value assets (OPS-005)

§164.310(a)(2)(iii) - Access Control and Validation Procedures (Addressable)

Attribute	Details
HIPAA Requirement	Implement procedures to control and validate physical access to facilities based on role or function.
Implementation Status	Partial
Relevant Policies	• OPS-005: IT Asset Management Policy • HR-002: Employee Onboarding and Offboarding IT Policy
Policy Sections	• OPS-005: Physical Security of Assets - Physical access to server rooms and equipment areas restricted • HR-002: Physical access badges deactivated during offboarding
Coverage Assessment	Moderate (60%) - Basic physical access control requirements mentioned but comprehensive validation procedures not documented.
Gaps	• Physical access control system not described • Badge issuance and management procedures not detailed • Physical access logging and monitoring not explicitly documented • Role-based physical access not comprehensively defined
Evidence of Compliance	• Physical access restrictions to server rooms (OPS-005) • Physical access badges deactivated upon termination (HR-002) • Access control to secure storage areas (OPS-005)

§164.310(a)(2)(iv) - Maintenance Records (Addressable)

Attribute	Details
HIPAA Requirement	Implement policies for documenting repairs and modifications to physical components of facilities.
Implementation Status	Partial
Relevant Policies	• OPS-005: IT Asset Management Policy • OPS-004: Change Management Policy
Policy Sections	• OPS-005: Asset Maintenance and Repair - Maintenance activities logged • OPS-004: Documentation requirements for infrastructure changes
Coverage Assessment	Moderate (65%) - Asset maintenance logging required but facility-specific maintenance records not fully addressed.
Gaps	• Facility maintenance records not explicitly documented • Physical security system maintenance not addressed • Environmental system maintenance records not specified
Evidence of Compliance	• Maintenance activities logged in asset record (OPS-005) • Hardware upgrades documented in change management (OPS-004) • Warranty and support renewals tracked (OPS-005)

---

§164.310(b) - Workstation Use

Attribute	Details
HIPAA Requirement	Implement policies specifying proper functions to be performed, manner of use, and physical attributes of the workstation environment for accessing ePHI.
Implementation Status	Partial
Relevant Policies	• SEC-001: Acceptable Use Policy • SEC-005: Remote Work and Mobile Device Management Policy
Policy Sections	• SEC-001: Permitted Use, Prohibited Activities • SEC-005: Device Security, Data Handling on Mobile Devices
Coverage Assessment	Moderate (70%) - Acceptable use and device security requirements documented but workstation-specific policies not comprehensively detailed.
Gaps	• Dedicated Workstation Security Policy not present • Physical workstation placement requirements not specified • Screen positioning and privacy requirements not detailed • Workstation environment specifications not documented • Unattended workstation procedures not explicitly stated
Evidence of Compliance	• Acceptable use guidelines (SEC-001) • Screen lock with 5-minute timeout required (SEC-005) • Device security requirements (SEC-005) • Prohibited activities defined (SEC-001)

---

§164.310(c) - Workstation Security

Attribute	Details
HIPAA Requirement	Implement physical safeguards for workstations that access ePHI to restrict access to authorized users.
Implementation Status	Addressed
Relevant Policies	• SEC-005: Remote Work and Mobile Device Management Policy • SEC-003: Password and Authentication Policy
Policy Sections	• SEC-005: Device Security - Screen lock, Full disk encryption, Physical device security • SEC-003: Authentication requirements
Coverage Assessment	Strong (80%) - Good technical controls for workstation security including encryption, screen locks, and authentication requirements.
Gaps	• Physical workstation security measures not fully detailed • Cable locks and physical barriers not comprehensively addressed • Workstation positioning requirements not specified
Evidence of Compliance	• Full disk encryption required (SEC-005) • Screen lock with 5-minute maximum timeout (SEC-005) • Two-factor authentication for access (SEC-003) • Portable device locks/cables when appropriate (OPS-005) • Lost/stolen device reporting and remote wipe (SEC-005)

---

§164.310(d) - Device and Media Controls

§164.310(d)(1) - Device and Media Controls (Required)

Attribute	Details
HIPAA Requirement	Implement policies for the receipt and removal of hardware and electronic media containing ePHI into and out of a facility, and the movement of these items within the facility.
Implementation Status	Addressed
Relevant Policies	• OPS-005: IT Asset Management Policy • HR-002: Employee Onboarding and Offboarding IT Policy
Policy Sections	• OPS-005: Asset Lifecycle Management (Acquisition, Deployment, Retirement, Disposal) • HR-002: Equipment Return, Data Handling
Coverage Assessment	Strong (85%) - Comprehensive asset lifecycle management with tracking, accountability, and secure disposal procedures.
Gaps	• Media movement within facility not explicitly detailed • Removable media policies not comprehensively documented • Media accountability logs not explicitly described
Evidence of Compliance	• Assets received and recorded within 24 hours (OPS-005) • Asset tags applied before deployment (OPS-005) • Equipment retrieval during offboarding (HR-002) • Physical assets removed from inventory upon retirement (OPS-005) • Asset location tracking (OPS-005)

§164.310(d)(2)(i) - Disposal (Required)

Attribute	Details
HIPAA Requirement	Implement policies for final disposition of ePHI and hardware/media on which stored.
Implementation Status	Addressed
Relevant Policies	• OPS-005: IT Asset Management Policy • COMP-002: Data Retention and Archiving Policy
Policy Sections	• OPS-005: Asset Disposal and Sanitization • COMP-002: Data Disposal and Destruction
Coverage Assessment	Excellent (95%) - Comprehensive disposal procedures following NIST 800-88 standards with verification and documentation requirements.
Gaps	• None significant - disposal procedures are comprehensive and follow industry standards
Evidence of Compliance	• NIST 800-88 compliant data sanitization (OPS-005, COMP-002) • Minimum 3-pass overwrite for storage devices (OPS-005) • Physical destruction for sensitive devices (OPS-005, COMP-002) • IT security verifies data removal (OPS-005) • Certificates of destruction obtained and retained (OPS-005, COMP-002) • Certified e-waste recycling programs (OPS-005) • Disposal records maintained for 3 years (OPS-005, COMP-002)

§164.310(d)(2)(ii) - Media Re-use (Required)

Attribute	Details
HIPAA Requirement	Implement procedures for removal of ePHI from electronic media before media is made available for re-use.
Implementation Status	Addressed
Relevant Policies	• OPS-005: IT Asset Management Policy • HR-002: Employee Onboarding and Offboarding IT Policy
Policy Sections	• OPS-005: Asset Disposal and Sanitization - Data sanitization before disposal • HR-002: Equipment Return - Secure data deletion on returned equipment, Equipment inspection and sanitization
Coverage Assessment	Strong (90%) - Clear procedures for data removal before media re-use with verification requirements.
Gaps	• Media re-use approval process not explicitly documented
Evidence of Compliance	• Data sanitization before disposal using NIST 800-88 methods (OPS-005) • Verification of data removal documented (OPS-005) • Secure data deletion on returned equipment (HR-002) • Equipment inspection and sanitization process (HR-002) • Personal data separated during equipment return (HR-002)

§164.310(d)(2)(iii) - Accountability (Addressable)

Attribute	Details
HIPAA Requirement	Maintain record of movements of hardware and electronic media and any person responsible.
Implementation Status	Addressed
Relevant Policies	• OPS-005: IT Asset Management Policy • HR-002: Employee Onboarding and Offboarding IT Policy
Policy Sections	• OPS-005: Asset Tracking Requirements, Asset Assignment and Transfer • HR-002: Equipment assignment with acknowledgment
Coverage Assessment	Strong (88%) - Comprehensive asset tracking with assignment records, transfers logged, and user accountability.
Gaps	• Internal media movement tracking not explicitly detailed
Evidence of Compliance	• All assets documented in Asset Management System (OPS-005) • Real-time inventory updates within 24 hours (OPS-005) • Assigned user/department tracked (OPS-005) • Asset transfers documented with signatures (OPS-005) • Quarterly physical inventory audits (OPS-005) • User acknowledgment of asset receipt required (OPS-005, HR-002)

§164.310(d)(2)(iv) - Data Backup and Storage (Addressable)

Attribute	Details
HIPAA Requirement	Create retrievable, exact copy of ePHI before movement of equipment.
Implementation Status	Addressed
Relevant Policies	• OPS-001: Backup and Disaster Recovery Policy • HR-002: Employee Onboarding and Offboarding IT Policy
Policy Sections	• OPS-001: Data Backup, Backup Storage • HR-002: Data Handling - Manager identifies critical data to preserve, Files transferred to designated successor
Coverage Assessment	Strong (85%) - Regular backup procedures with verification. Data preservation during equipment movement addressed.
Gaps	• Backup before equipment movement not explicitly required in all scenarios
Evidence of Compliance	• Daily full backups with hourly incremental (OPS-001) • Geographic redundancy (OPS-001) • Data preservation procedures during offboarding (HR-002) • Files transferred before equipment return (HR-002) • Backup verification with monthly test restores (OPS-001)

---

Technical Safeguards (§164.312)

§164.312(a) - Access Control

§164.312(a)(1) - Access Control (Required)

Attribute	Details
HIPAA Requirement	Implement technical policies and procedures for electronic information systems that maintain ePHI to allow access only to authorized persons or software programs.
Implementation Status	Addressed
Relevant Policies	• SEC-002: Access Control and Authorization Policy • SEC-003: Password and Authentication Policy • PRIV-001: Data Privacy and Security Policy
Policy Sections	• SEC-002: Role-Based Access Control, Access Request and Approval, Principle of Least Privilege • SEC-003: Two-Factor Authentication, Password Requirements • PRIV-001: Access Controls section
Coverage Assessment	Strong (90%) - Comprehensive technical access controls including RBAC, authentication, and authorization mechanisms.
Gaps	• Application-level access controls not fully detailed • Technical enforcement mechanisms not comprehensively described
Evidence of Compliance	• Role-based access control implemented (SEC-002) • Principle of least privilege (SEC-002) • Two-factor authentication required (SEC-003) • Google Workspace SSO for centralized access control (SEC-003) • Context-aware access policies (SEC-002, SEC-005) • Access provisioning and deprovisioning procedures (SEC-002)

§164.312(a)(2)(i) - Unique User Identification (Required)

Attribute	Details
HIPAA Requirement	Assign unique name and/or number for identifying and tracking user identity.
Implementation Status	Addressed
Relevant Policies	• SEC-002: Access Control and Authorization Policy • SEC-003: Password and Authentication Policy
Policy Sections	• SEC-002: Administrative and Privileged Access - Separate administrative accounts from standard user accounts • SEC-003: Google Workspace SSO - Individual accounts
Coverage Assessment	Excellent (95%) - Unique user identification enforced through Google Workspace SSO and separate administrative accounts. No shared credentials permitted.
Gaps	• None significant - unique user identification is well-established
Evidence of Compliance	• Individual Google Workspace accounts for each user (SEC-003) • Separate administrative accounts from standard accounts (SEC-002) • Service accounts documented with owner (SEC-002) • No interactive login for service accounts (SEC-002) • Shared credentials prohibited (SEC-003) • Account activity logging for individual users (OPS-010)

§164.312(a)(2)(ii) - Emergency Access Procedure (Required)

Attribute	Details
HIPAA Requirement	Establish procedures for obtaining necessary ePHI during an emergency.
Implementation Status	Addressed
Relevant Policies	• SEC-002: Access Control and Authorization Policy • OPS-002: Business Continuity and Disaster Recovery Policy
Policy Sections	• SEC-002: Emergency Access procedures • OPS-002: Emergency mode operations
Coverage Assessment	Strong (85%) - Emergency access procedures documented with approval and logging requirements.
Gaps	• Emergency access to ePHI specifically not comprehensively detailed • Break-glass account procedures could be more detailed
Evidence of Compliance	• Emergency access request procedures defined (SEC-002) • Verbal approval from CTO or CISO required (SEC-002) • Enhanced logging for emergency access (SEC-002) • Follow-up written approval within 24 hours (SEC-002) • Access reviewed and removed when emergency resolved (SEC-002) • Break-glass accounts mentioned with extensive logging (SEC-002)

§164.312(a)(2)(iii) - Automatic Logoff (Addressable)

Attribute	Details
HIPAA Requirement	Implement electronic procedures that terminate electronic session after predetermined time of inactivity.
Implementation Status	Addressed
Relevant Policies	• SEC-005: Remote Work and Mobile Device Management Policy • SEC-003: Password and Authentication Policy
Policy Sections	• SEC-005: Device Security - Screen lock enabled with maximum 5-minute timeout • SEC-003: Google Workspace session management
Coverage Assessment	Strong (88%) - Screen lock timeouts enforced. Session management through Google Workspace.
Gaps	• Application-level session timeouts not explicitly documented • Different timeout requirements for different sensitivity levels not specified
Evidence of Compliance	• Screen lock with maximum 5-minute timeout (SEC-005) • Session management through Google Workspace admin console (SEC-002) • Automatic security updates enabled (SEC-005) • Context-aware access with session controls (SEC-005)

§164.312(a)(2)(iv) - Encryption and Decryption (Addressable)

Attribute	Details
HIPAA Requirement	Implement mechanism to encrypt and decrypt ePHI.
Implementation Status	Addressed
Relevant Policies	• PRIV-001: Data Privacy and Security Policy • SEC-005: Remote Work and Mobile Device Management Policy • OPS-001: Backup and Disaster Recovery Policy
Policy Sections	• PRIV-001: Data Protection - Encryption in transit and at rest • SEC-005: Device Security - Full disk encryption required • OPS-001: Backup Storage - Encryption required (AES-256)
Coverage Assessment	Excellent (95%) - Comprehensive encryption requirements for data at rest, in transit, and on devices. Specific encryption standards documented.
Gaps	• None significant - encryption requirements are comprehensive
Evidence of Compliance	• Encryption in transit (TLS/SSL) and at rest (AES-256) required (PRIV-001) • Full disk encryption on all devices (BitLocker, FileVault) (SEC-005) • All backups encrypted with AES-256 (OPS-001) • Archived data encrypted at rest (COMP-002) • Encryption enabled on personal devices accessing company data (SEC-005)

---

§164.312(b) - Audit Controls

Attribute	Details
HIPAA Requirement	Implement hardware, software, and procedural mechanisms that record and examine activity in information systems containing or using ePHI.
Implementation Status	Addressed
Relevant Policies	• OPS-010: System Monitoring and Performance Management Policy • SEC-002: Access Control and Authorization Policy
Policy Sections	• OPS-010: Comprehensive Monitoring Coverage, Log Aggregation, Performance Reporting • SEC-002: Audit Logging - All access grant/revoke actions logged and retained for 1 year
Coverage Assessment	Strong (88%) - Comprehensive monitoring and logging with defined retention periods and review procedures.
Gaps	• ePHI-specific audit logging not explicitly detailed • Audit log protection and integrity controls not fully documented • Audit log analysis procedures could be more detailed
Evidence of Compliance	• Continuous system monitoring (OPS-010) • Log aggregation platform (Splunk, ELK Stack) (OPS-010) • Access grant/revoke actions logged (SEC-002) • One-year audit log retention (SEC-002) • Session logging and monitoring through Google Workspace (SEC-002) • Regular review of logs (OPS-010) • Security monitoring for anomalies and threats (OPS-010)

---

§164.312(c) - Integrity

§164.312(c)(1) - Integrity (Required)

Attribute	Details
HIPAA Requirement	Implement policies to ensure ePHI is not improperly altered or destroyed.
Implementation Status	Addressed
Relevant Policies	• OPS-004: Change Management Policy • OPS-001: Backup and Disaster Recovery Policy • COMP-002: Data Retention and Archiving Policy
Policy Sections	• OPS-004: Change Request and Documentation, Testing and Validation • OPS-001: Backup Verification, Data integrity • COMP-002: Secure Archiving Requirements - Integrity verification using checksums
Coverage Assessment	Strong (85%) - Data integrity controls through change management, backup verification, and archiving integrity checks.
Gaps	• ePHI-specific integrity controls not explicitly documented • Real-time integrity monitoring not fully detailed • Data integrity incident response not specifically addressed
Evidence of Compliance	• Change management controls prevent unauthorized alterations (OPS-004) • System backups before changes (OPS-004) • Backup integrity verification (OPS-001) • Checksums/digital signatures for archived data (COMP-002) • Version control for code and configurations (OPS-004) • Monthly backup restoration tests verify integrity (OPS-001)

§164.312(c)(2) - Mechanism to Authenticate ePHI (Addressable)

Attribute	Details
HIPAA Requirement	Implement electronic mechanisms to corroborate that ePHI has not been altered or destroyed in an unauthorized manner.
Implementation Status	Partial
Relevant Policies	• COMP-002: Data Retention and Archiving Policy • OPS-001: Backup and Disaster Recovery Policy
Policy Sections	• COMP-002: Secure Archiving Requirements - Use checksums or digital signatures to verify data integrity • OPS-001: Backup Verification procedures
Coverage Assessment	Moderate (70%) - Data integrity mechanisms for archived data and backups documented. Real-time authentication of ePHI not comprehensively addressed.
Gaps	• ePHI authentication mechanisms not explicitly documented • Hash verification or digital signatures for ePHI not detailed • Real-time integrity checking not comprehensively described
Evidence of Compliance	• Checksums for archived data integrity (COMP-002) • Digital signatures option for archived data (COMP-002) • Backup verification procedures (OPS-001) • Quarterly verification of archived data retrieval (COMP-002)

---

§164.312(d) - Person or Entity Authentication

Attribute	Details
HIPAA Requirement	Implement procedures to verify that a person or entity seeking access to ePHI is the one claimed.
Implementation Status	Addressed
Relevant Policies	• SEC-003: Password and Authentication Policy • SEC-002: Access Control and Authorization Policy
Policy Sections	• SEC-003: Two-Factor Authentication, Password Requirements, Primary Authentication - Google Workspace SSO • SEC-002: Access authentication and authorization
Coverage Assessment	Excellent (95%) - Strong authentication mechanisms including multi-factor authentication, SSO, and password complexity requirements.
Gaps	• None significant - authentication procedures are comprehensive and strong
Evidence of Compliance	• Two-factor authentication required for all Google Workspace accounts (SEC-003) • 2FA required for administrative accounts and systems with PHI (SEC-003) • Strong password requirements (12-16 character minimum) (SEC-003) • Google Workspace SSO as primary authentication (SEC-003) • Context-aware access policies (SEC-005) • Account lockout after failed login attempts (SEC-003) • Password complexity requirements enforced (SEC-003)

---

§164.312(e) - Transmission Security

§164.312(e)(1) - Transmission Security (Required)

Attribute	Details
HIPAA Requirement	Implement technical security measures to guard against unauthorized access to ePHI being transmitted over electronic communications network.
Implementation Status	Addressed
Relevant Policies	• PRIV-001: Data Privacy and Security Policy • SEC-005: Remote Work and Mobile Device Management Policy
Policy Sections	• PRIV-001: Data Protection - Encryption in transit (TLS/SSL) • SEC-005: Network Security - Cloud-based applications accessed securely via HTTPS
Coverage Assessment	Strong (90%) - Encryption in transit required with TLS/SSL. HTTPS access for all applications.
Gaps	• Specific transmission security standards (TLS versions) not explicitly documented • Email encryption requirements not detailed • Secure file transfer protocols not comprehensively specified
Evidence of Compliance	• Encryption in transit using TLS/SSL (PRIV-001) • HTTPS required for cloud applications (SEC-005) • Google Workspace SSO provides secure transmission (SEC-003, SEC-005) • VPN mentioned in remote access context (HR-002) • Network security requirements (SEC-005)

§164.312(e)(2)(i) - Integrity Controls (Addressable)

Attribute	Details
HIPAA Requirement	Implement security measures to ensure electronically transmitted ePHI is not improperly modified without detection.
Implementation Status	Partial
Relevant Policies	• PRIV-001: Data Privacy and Security Policy
Policy Sections	• PRIV-001: Encryption in transit provides integrity protection
Coverage Assessment	Moderate (65%) - Encryption in transit provides some integrity protection, but explicit transmission integrity controls not detailed.
Gaps	• Transmission integrity mechanisms not explicitly documented • Message authentication codes or checksums for transmissions not specified • Detection of transmission tampering not detailed
Evidence of Compliance	• TLS/SSL encryption provides integrity checking (PRIV-001) • HTTPS for all application access (SEC-005)

§164.312(e)(2)(ii) - Encryption (Addressable)

Attribute	Details
HIPAA Requirement	Implement mechanism to encrypt ePHI whenever deemed appropriate.
Implementation Status	Addressed
Relevant Policies	• PRIV-001: Data Privacy and Security Policy • SEC-005: Remote Work and Mobile Device Management Policy
Policy Sections	• PRIV-001: Encryption in transit (TLS/SSL) • SEC-005: HTTPS access, Context-aware access with encryption
Coverage Assessment	Strong (90%) - Encryption in transit required for all data transmission. HTTPS mandatory for application access.
Gaps	• Email encryption not explicitly required • Encryption for all transmission types not comprehensively documented
Evidence of Compliance	• Encryption in transit using TLS/SSL required (PRIV-001) • HTTPS required for all cloud applications (SEC-005) • Google Workspace provides encrypted transmission (SEC-003) • Secure SSO-integrated applications only (SEC-005)

---

Organizational Requirements (§164.314)

§164.314(a) - Business Associate Contracts

§164.314(a)(1) - Business Associate Contracts (Required)

Attribute	Details
HIPAA Requirement	Business associate contracts must provide satisfactory assurances that the business associate will appropriately safeguard the information.
Implementation Status	Addressed
Relevant Policies	• COMP-003: Vendor Management Policy
Policy Sections	• COMP-003: Contract Requirements, HIPAA Business Associate Agreement (BAA)
Coverage Assessment	Excellent (95%) - Comprehensive BAA requirements with detailed contract provisions and monitoring.
Gaps	• None significant - BAA requirements are comprehensive
Evidence of Compliance	• BAA required before PHI access (COMP-003) • BAA covers all required elements (COMP-003) • Vendor HIPAA compliance assessment (COMP-003) • SOC 2 Type II reports required (COMP-003) • Incident notification within 24 hours (COMP-003) • Right to audit provisions (COMP-003) • Subcontractor provisions in BAA (COMP-003) • 100% BAA coverage compliance metric (COMP-003)

§164.314(a)(2) - Other Arrangements

Attribute	Details
HIPAA Requirement	When covered entity and business associate are both governmental entities, may use memorandum of understanding, law, or other arrangement instead of contract.
Implementation Status	Not Applicable
Relevant Policies	N/A
Policy Sections	N/A
Coverage Assessment	N/A - Acme Corp is not a governmental entity
Gaps	N/A
Evidence of Compliance	N/A

---

§164.314(b) - Requirements for Group Health Plans

Attribute	Details
HIPAA Requirement	Group health plan requirements (if applicable).
Implementation Status	Not Applicable
Relevant Policies	N/A
Policy Sections	N/A
Coverage Assessment	N/A - Acme Corp does not appear to be a group health plan
Gaps	N/A
Evidence of Compliance	N/A

---

Policies and Procedures (§164.316)

§164.316(a) - Policies and Procedures

Attribute	Details
HIPAA Requirement	Implement reasonable and appropriate policies and procedures to comply with standards, implementation specifications, and requirements.
Implementation Status	Addressed
Relevant Policies	All policies in the framework
Policy Sections	Comprehensive policy framework covering Security Rule requirements
Coverage Assessment	Strong (88%) - Comprehensive policy framework with documented procedures across administrative, physical, and technical safeguards.
Gaps	• Some HIPAA-specific policy elements not explicitly documented • Gap in physical security policies • Some addressable specifications require additional documentation
Evidence of Compliance	• 20+ documented policies covering IT operations, security, privacy, compliance • Policies include purpose, scope, procedures, responsibilities • Policies aligned with HIPAA, SOC 2, and other frameworks • Regular policy review cycles (annual) • Policy approval process with designated approvers

---

§164.316(b) - Documentation

§164.316(b)(1) - Documentation (Required)

Attribute	Details
HIPAA Requirement	Maintain written (electronic) documentation of policies, procedures, and actions required.
Implementation Status	Addressed
Relevant Policies	All policies in the framework
Policy Sections	All policies are documented in markdown format with version control
Coverage Assessment	Excellent (92%) - All policies documented in writing (electronic format) with version control and metadata.
Gaps	• Documentation of HIPAA risk analyses not explicitly mentioned • Some implementation actions may lack documentation
Evidence of Compliance	• All policies maintained in GitHub repository (version controlled) • Policy metadata includes version, dates, owners, approvers • Document Control section in each policy • Revision History tracked in each policy • Written procedures within each policy • Change management for policy updates (OPS-004)

§164.316(b)(2)(i) - Time Limit (Required)

Attribute	Details
HIPAA Requirement	Retain documentation for 6 years from date of creation or date when last in effect, whichever is later.
Implementation Status	Partial
Relevant Policies	• COMP-002: Data Retention and Archiving Policy
Policy Sections	• COMP-002: Data Classification and Retention Periods - Policy documents: Permanent retention (superseded versions archived for 7 years)
Coverage Assessment	Strong (85%) - Policy retention exceeds HIPAA requirements. Other documentation retention periods documented.
Gaps	• 6-year retention requirement not explicitly stated for all HIPAA-related documentation • Audit reports and security incident documentation retention should explicitly reference 6-year minimum
Evidence of Compliance	• Superseded policy versions archived for 7 years (exceeds 6-year requirement) (COMP-002) • Compliance audit reports retained 7 years (COMP-002) • Audit logs retained 1 year (may need extension for critical ePHI access logs) (SEC-002) • Disposal records maintained 3 years (COMP-002) • Version control preserves policy history (all policies)

§164.316(b)(2)(ii) - Availability (Required)

Attribute	Details
HIPAA Requirement	Make documentation available to those responsible for implementing procedures.
Implementation Status	Addressed
Relevant Policies	All policies in the framework
Policy Sections	Document Control section in each policy specifies distribution
Coverage Assessment	Strong (90%) - Policies specify distribution and are stored in accessible repository.
Gaps	• Access control to policy repository not explicitly documented • Policy availability during emergency operations not explicitly addressed
Evidence of Compliance	• Policies stored in GitHub repository (centralized, accessible) (all policies) • Distribution lists specified in Document Control section (all policies) • Internal classification allows employee access (all policies) • Policy links embedded for easy navigation (all policies) • Training references policies (HR-001)

§164.316(b)(2)(iii) - Updates (Required)

Attribute	Details
HIPAA Requirement	Review and update documentation periodically in response to environmental or operational changes.
Implementation Status	Addressed
Relevant Policies	All policies include review schedules
Policy Sections	Policy metadata includes last_review and next_review dates; Revision History section tracks updates
Coverage Assessment	Strong (90%) - All policies have defined annual review cycles. Revision history tracked. Change management for updates.
Gaps	• Trigger-based review process for environmental/operational changes could be more explicit
Evidence of Compliance	• Annual review cycle for all policies (policy metadata) • next_review date tracked (policy metadata) • Revision History section in each policy • Version numbers tracked (policy metadata) • Change management process for policy updates (OPS-004) • Quarterly policy reviews mentioned for some policies (COMP-002)

---

Privacy Rule Requirements (§164.500 series)

§164.502 - Uses and Disclosures of PHI

§164.502(a) - General Rule for Uses and Disclosures

Attribute	Details
HIPAA Requirement	May not use or disclose PHI except as permitted or required by Privacy Rule.
Implementation Status	Partial
Relevant Policies	• PRIV-001: Data Privacy and Security Policy • COMP-003: Vendor Management Policy
Policy Sections	• PRIV-001: Data Protection, Data Minimization, Compliance • COMP-003: Data Sharing, Data Protection Requirements
Coverage Assessment	Moderate (60%) - General data privacy principles in place but Privacy Rule specifics not comprehensively documented.
Gaps	• Dedicated Privacy Rule compliance policy not present • Permitted uses and disclosures not explicitly defined • Privacy Rule notice of privacy practices not addressed • Individual rights (access, amendment, accounting) not documented
Evidence of Compliance	• Data minimization principle (PRIV-001) • Vendor data sharing controls (COMP-003) • Data protection requirements (PRIV-001) • Adherence to HIPAA regulations referenced (PRIV-001)

§164.502(b) - Minimum Necessary Standard

Attribute	Details
HIPAA Requirement	When using or disclosing PHI, make reasonable efforts to limit to minimum necessary.
Implementation Status	Partial
Relevant Policies	• SEC-002: Access Control and Authorization Policy • COMP-003: Vendor Management Policy
Policy Sections	• SEC-002: Principle of Least Privilege, Minimum necessary access provisioned • COMP-003: Data Minimization - Share only data necessary for vendor to perform services
Coverage Assessment	Moderate (70%) - Least privilege and data minimization principles align with minimum necessary, but not explicitly documented in Privacy Rule context.
Gaps	• Minimum necessary standard not explicitly documented • Minimum necessary determinations for routine disclosures not defined • Role-based minimum necessary not explicitly tied to Privacy Rule
Evidence of Compliance	• Principle of least privilege applied (SEC-002) • Minimum necessary access provisioned (SEC-002) • Data minimization for vendor sharing (COMP-003) • Need-to-know basis for access (SEC-002) • Regular review of data shared with vendors (COMP-003)

§164.502(e) - Business Associate Requirements

Attribute	Details
HIPAA Requirement	May disclose PHI to business associate and allow business associate to create or receive PHI on covered entity's behalf only if satisfactory assurances obtained.
Implementation Status	Addressed
Relevant Policies	• COMP-003: Vendor Management Policy
Policy Sections	• COMP-003: HIPAA Business Associate Agreement (BAA) requirements
Coverage Assessment	Excellent (95%) - Comprehensive BAA requirements already documented under Security Rule. Same assessment applies to Privacy Rule.
Gaps	• None significant - BAA requirements comprehensively cover both Security and Privacy Rule
Evidence of Compliance	Same as §164.314(a)(1) - Business Associate Contracts above

---

§164.520 - Notice of Privacy Practices

Attribute	Details
HIPAA Requirement	Provide notice of privacy practices to individuals and make available upon request.
Implementation Status	Addressed
Relevant Policies	• policies/legal/hipaa-compliance.md • policies/legal/privacy-policy.md
Policy Sections	• hipaa-compliance.md: Your Rights Under HIPAA, How We Protect Your Health Information, SMS Communications, Information Sharing with Your Consent, Breach Notification • privacy-policy.md: Information We Collect, How We Use Your Information, Information Sharing, Your Rights
Coverage Assessment	Strong (90%) - Comprehensive public-facing privacy notice published at https://recoveryecosystem.ai/hipaa. Covers all required HIPAA privacy practices including patient rights, safeguards, uses/disclosures, complaints, and breach notification. Privacy Policy provides additional detail on information practices.
Gaps	• Individual acknowledgment procedures for Notice of Privacy Practices receipt not explicitly documented
Evidence of Compliance	• Published HIPAA Compliance Notice with all required elements (hipaa-compliance.md) • Patient rights clearly described (access, amend, accounting, restrictions, confidential communications) • Privacy practices described (uses, disclosures, safeguards) • Privacy Officer contact information provided (privacy@myorbiit.com) • Privacy Policy describes information collection, use, sharing, and retention practices • Notice available on public website

---

§164.524 - Access to PHI

Attribute	Details
HIPAA Requirement	Provide individuals with right to access their PHI.
Implementation Status	Addressed
Relevant Policies	• policies/legal/hipaa-compliance.md • policies/legal/privacy-policy.md
Policy Sections	• hipaa-compliance.md: Your Rights Under HIPAA - "Right to Access: You can request and receive a copy of your health information" • privacy-policy.md: Your Rights - "Access to the information we maintain about you"
Coverage Assessment	Strong (85%) - Patient right to access PHI clearly documented in public-facing legal documents. Privacy Officer contact information provided for requests.
Gaps	• Specific access request procedures and timelines (30-day requirement) not detailed • Access denial procedures not explicitly documented • Access format and delivery methods not specified
Evidence of Compliance	• Right to access explicitly stated in HIPAA Compliance Notice (hipaa-compliance.md) • Access rights described in Privacy Policy (privacy-policy.md) • Privacy Officer contact provided for exercising rights (privacy@myorbiit.com) • Commitment to handling requests in accordance with applicable legal standards

---

§164.526 - Amendment of PHI

Attribute	Details
HIPAA Requirement	Provide individuals with right to request amendment to their PHI.
Implementation Status	Addressed
Relevant Policies	• policies/legal/hipaa-compliance.md • policies/legal/privacy-policy.md
Policy Sections	• hipaa-compliance.md: Your Rights Under HIPAA - "Right to Amend: You can request corrections to your health information" • privacy-policy.md: Your Rights - "Correction of inaccuracies"
Coverage Assessment	Strong (85%) - Patient right to request amendment explicitly documented in public-facing legal documents. Privacy Officer contact information provided for requests.
Gaps	• Specific amendment request procedures and timelines (60-day requirement) not detailed • Amendment acceptance/denial criteria not explicitly documented • Amendment distribution procedures not specified
Evidence of Compliance	• Right to amend explicitly stated in HIPAA Compliance Notice (hipaa-compliance.md) • Amendment rights described in Privacy Policy (privacy-policy.md) • Privacy Officer contact provided for exercising rights (privacy@myorbiit.com) • Commitment to handling requests in accordance with applicable legal standards

---

§164.528 - Accounting of Disclosures

Attribute	Details
HIPAA Requirement	Provide individuals with accounting of disclosures of their PHI.
Implementation Status	Addressed
Relevant Policies	• policies/legal/hipaa-compliance.md • policies/legal/privacy-policy.md • SEC-002: Access Control and Authorization Policy • OPS-010: System Monitoring and Performance Management Policy
Policy Sections	• hipaa-compliance.md: Your Rights Under HIPAA - "Right to an Accounting: You can request a list of certain disclosures of your health information" • privacy-policy.md: Your Rights - "Request for an accounting of disclosures" • SEC-002: Audit Logging - Access grant/revoke actions logged • OPS-010: Audit logging and monitoring
Coverage Assessment	Strong (80%) - Patient right to accounting explicitly documented in public-facing legal documents. Technical foundation for tracking disclosures exists through comprehensive audit logging. Privacy Officer contact information provided for requests.
Gaps	• Specific accounting request procedures and timelines (60-day requirement) not detailed • 6-year disclosure retention requirement not explicitly specified (current retention is 1 year) • Exclusions from accounting (treatment, payment, healthcare operations) not specified
Evidence of Compliance	• Right to accounting explicitly stated in HIPAA Compliance Notice (hipaa-compliance.md) • Accounting rights described in Privacy Policy (privacy-policy.md) • Privacy Officer contact provided for exercising rights (privacy@myorbiit.com) • Access logging with 1-year retention (SEC-002) • Session logging through Google Workspace (SEC-002) • Comprehensive system monitoring and audit logs (OPS-010)

---

§164.530 - Administrative Requirements

§164.530(a) - Personnel Designations

Attribute	Details
HIPAA Requirement	Designate privacy official and contact person for receiving complaints.
Implementation Status	Addressed
Relevant Policies	• policies/legal/hipaa-compliance.md • PRIV-001: Data Privacy and Security Policy
Policy Sections	• hipaa-compliance.md: Questions or Concerns - "Privacy Officer, Orbiit Services Inc., Email: privacy@myorbiit.com" • PRIV-001: Policy owner includes Compliance Team
Coverage Assessment	Strong (90%) - Privacy Officer explicitly designated with contact information published in public-facing HIPAA Compliance Notice. Contact person for complaints identified.
Gaps	• Privacy Official name not specified (only title and email provided) • Detailed Privacy Official responsibilities not documented in internal policies
Evidence of Compliance	• Privacy Officer explicitly designated in HIPAA Compliance Notice (hipaa-compliance.md) • Privacy Officer contact information published (privacy@myorbiit.com) • Chief Compliance Officer listed as approver (PRIV-001) • Compliance Team has oversight (PRIV-001) • Security official identified (CISO)

§164.530(b) - Training

Attribute	Details
HIPAA Requirement	Train all workforce members on policies and procedures regarding PHI.
Implementation Status	Partial
Relevant Policies	• HR-001: Employee IT Training and Awareness Policy • PRIV-001: Data Privacy and Security Policy
Policy Sections	• HR-001: Orientation Training includes HIPAA obligations, Security Awareness Training • PRIV-001: Training on data privacy practices
Coverage Assessment	Moderate (70%) - General security and privacy training documented but HIPAA-specific training content not detailed.
Gaps	• HIPAA Privacy Rule-specific training not explicitly documented • Privacy training content requirements not detailed • Training documentation and certification not comprehensively specified • Periodic privacy training intervals not defined
Evidence of Compliance	• New employee orientation includes HIPAA obligations (HR-001) • Data privacy training mentioned (PRIV-001) • Annual security awareness training (HR-001) • Training completion tracked (HR-001) • Role-specific training programs (HR-001)

§164.530(d) - Safeguards

Attribute	Details
HIPAA Requirement	Have in place appropriate administrative, technical, and physical safeguards to protect privacy of PHI.
Implementation Status	Addressed
Relevant Policies	Multiple policies across administrative, physical, and technical safeguards
Policy Sections	See Security Rule sections above for comprehensive coverage
Coverage Assessment	Strong (85%) - Comprehensive safeguards in place as documented throughout Security Rule compliance matrix.
Gaps	Same gaps as identified in Security Rule sections
Evidence of Compliance	See Security Rule sections - safeguards comprehensively documented

§164.530(e) - Complaints

Attribute	Details
HIPAA Requirement	Provide process for individuals to make complaints concerning policies and procedures or compliance.
Implementation Status	Addressed
Relevant Policies	• policies/legal/hipaa-compliance.md • policies/legal/privacy-policy.md • SEC-004: Incident Response and Reporting Policy • PRIV-001: Data Privacy and Security Policy
Policy Sections	• hipaa-compliance.md: Questions or Concerns - "If you have questions about our HIPAA compliance practices or concerns about the privacy of your health information, please contact: Privacy Officer, Email: privacy@myorbiit.com" • privacy-policy.md: Contact Information section • SEC-004: Incident reporting procedures • PRIV-001: Violation reporting
Coverage Assessment	Strong (85%) - Clear contact mechanism for privacy complaints publicly documented with Privacy Officer contact information. General incident and violation reporting procedures provide operational framework.
Gaps	• Specific privacy complaint investigation procedures not detailed • Complaint documentation and tracking requirements not specified • No retaliation policy not explicitly documented • Complaint resolution timelines not defined
Evidence of Compliance	• Privacy Officer contact information published for concerns and complaints (hipaa-compliance.md) • Email: privacy@myorbiit.com designated for privacy questions and concerns • Contact information in Privacy Policy (privacy-policy.md) • Incident reporting procedures exist (SEC-004) • Violation reporting framework in place (PRIV-001)

§164.530(i) - Sanctions

Attribute	Details
HIPAA Requirement	Apply appropriate sanctions against workforce members who violate policies or Privacy Rule.
Implementation Status	Addressed
Relevant Policies	• SEC-001: Acceptable Use Policy • PRIV-001: Data Privacy and Security Policy
Policy Sections	• SEC-001: Compliance and Enforcement • PRIV-001: Compliance and Enforcement - Violations may result in disciplinary actions up to termination
Coverage Assessment	Strong (85%) - Sanction policies in place for security and privacy violations. Same assessment as §164.308(a)(1)(ii)(C).
Gaps	Same as §164.308(a)(1)(ii)(C) - Specific HIPAA violation sanctions not explicitly differentiated
Evidence of Compliance	Same as §164.308(a)(1)(ii)(C) - Sanction Policy above

---

Compliance Gap Summary

Critical Gaps (High Priority - Immediate Action Required)

Gap #	HIPAA Requirement	Current Status	Impact	Recommendation Priority
1	§164.308(a)(1)(ii)(A) - Risk Analysis	Partial - No documented enterprise-wide risk analysis	High	Critical
2	§164.308(a)(7)(ii)(C) - Emergency Mode Plan	Partial - ePHI access in emergency mode not detailed	Medium	High
3	§164.528 - Accounting of Disclosures	Addressed but 6-year retention not implemented (currently 1 year)	Low	Medium

Moderate Gaps (Medium Priority - Enhancement Recommended)

Gap #	HIPAA Requirement	Current Status	Impact	Recommendation Priority
4	§164.310(a) - Facility Access Controls	Partial - Physical security not comprehensive	Medium	Medium
5	§164.310(b) - Workstation Use	Partial - Workstation-specific policies incomplete	Low	Medium
6	§164.308(a)(5)(ii)(B) - Malicious Software	Partial - Dedicated policy missing	Low	Medium
7	§164.312(c)(2) - Mechanism to Authenticate ePHI	Partial - ePHI authentication not explicit	Low	Medium
8	§164.502(a) - Privacy Rule General	Partial - Privacy Rule specifics not documented	Medium	Medium
9	§164.308(a)(3)(ii)(B) - Workforce Clearance	Partial - Background check procedures not detailed	Low	Medium
10	Privacy Rule Procedural Details	Patient rights procedures lack specific timelines and workflows	Low	Low

Minor Gaps (Low Priority - Future Enhancement)

Gap #	Area	Issue	Recommendation Priority
11	Documentation	Some procedures could be more detailed	Low
12	Audit Log Retention	1-year retention may be insufficient for ePHI access logs (6 years recommended for accounting)	Low
13	Physical Security	More comprehensive facility security documentation	Low
14	Transmission Integrity	Explicit transmission integrity controls	Low
15	ePHI-Specific Policies	More explicit ePHI handling throughout policies	Low
16	Breach Risk Assessment	4-factor breach determination methodology not documented	Low

---

Recommendations

Immediate Actions (0-30 Days)

1. Conduct HIPAA Security Risk Analysis

Priority: Critical HIPAA Reference: §164.308(a)(1)(ii)(A)

Actions: - Develop Risk Analysis Policy and Procedure - Conduct comprehensive enterprise-wide ePHI risk assessment - Document risk analysis methodology (consider NIST 800-30 or HHS SRA Tool) - Identify all systems that create, receive, maintain, or transmit ePHI - Assess threats, vulnerabilities, and likelihood for each system - Calculate risk levels and document findings - Create risk register with risk treatment plans - Establish annual risk analysis schedule

Deliverables: - Risk Analysis Policy document - Completed Risk Analysis Report - Risk Register with treatment plans - Risk Analysis schedule

---

2. Enhance Privacy Rule Operational Procedures

Priority: Medium HIPAA Reference: §164.524, §164.526, §164.528

Actions: - Develop detailed internal procedures for handling patient rights requests: - Access request procedures with 30-day timeline - Amendment request procedures with 60-day timeline - Accounting of disclosures procedures with 60-day timeline - Create request forms and workflow templates - Document decision-making criteria for approvals/denials - Establish tracking system for requests and responses - Train Privacy Officer and staff on procedures - Integrate with existing privacy commitments in policies/legal documents

Deliverables: - Patient Rights Request Procedures document - Request forms (access, amendment, accounting) - Request tracking system - Staff training materials - Updated internal operations manual

Note: Public-facing patient rights are already documented in policies/legal/hipaa-compliance.md. This recommendation focuses on internal operational procedures.

---

Short-Term Actions (30-90 Days)

3. Enhance Workforce Clearance Procedures

Priority: High HIPAA Reference: §164.308(a)(3)(ii)(B)

Actions: - Document comprehensive background check procedures - Define clearance levels based on ePHI access requirements - Specify background check scope and frequency: - Criminal background checks - Reference verification - Education verification (for technical roles) - Credit checks (for financial access roles) if permitted - Document pre-employment screening procedures - Annual background checks for privileged users (already mentioned, formalize) - Create workforce clearance approval and documentation process - Integrate with onboarding procedures (HR-002)

Deliverables: - Workforce Clearance Procedure document - Background check requirements matrix - Clearance approval workflow - Updated onboarding procedures

---

4. Document Emergency Mode Operations Plan

Priority: High HIPAA Reference: §164.308(a)(7)(ii)(C)

Actions: - Develop Emergency Mode Operations Plan specific to ePHI - Define procedures for ePHI access during emergencies - Document alternate authentication methods if primary unavailable - Define emergency authorization procedures - Specify minimum required safeguards during emergency operations - Document when normal operations resume - Integrate with existing Business Continuity Policy (OPS-002) - Test emergency mode procedures during DR drills

Deliverables: - Emergency Mode Operations Plan - Emergency ePHI access procedures - Updated Business Continuity Policy - Emergency mode testing scenarios

---

Medium-Term Actions (90-180 Days)

5. Enhance Physical Security Documentation

Priority: Medium HIPAA Reference: §164.310(a)

Actions: - Develop Facility Security and Physical Access Policy - Document physical access control procedures: - Badge issuance and management - Visitor management procedures - Physical access logging - Role-based physical access controls - Document facility security controls: - Perimeter security - Surveillance systems - Alarm systems - Environmental controls - Define workstation placement and security requirements - Document equipment disposal escort procedures - Create facility security testing procedures - Note: For cloud-based operations, document reliance on cloud provider physical security and obtain relevant attestations

Deliverables: - Facility Security and Physical Access Policy - Workstation Security Standards - Visitor management procedures - Physical security testing plan

---

6. Develop Malware Protection Policy

Priority: Medium HIPAA Reference: §164.308(a)(5)(ii)(B)

Actions: - Create dedicated Malware Protection Policy - Define approved anti-malware solutions and standards - Document malware detection procedures and tools - Create malware reporting procedures (integrate with incident response) - Define malware response and remediation procedures - Specify anti-malware update requirements - Document malware scanning requirements (frequency, scope) - Define quarantine and remediation procedures - Integrate with existing security policies (SEC-005)

Deliverables: - Malware Protection Policy - Malware response procedures - Anti-malware standards document - Updated incident response procedures

---

7. Document ePHI Integrity Authentication Mechanisms

Priority: Medium HIPAA Reference: §164.312(c)(2)

Actions: - Document ePHI authentication mechanisms: - Hash verification procedures - Digital signature implementation - Checksums for data integrity - Define ePHI integrity monitoring procedures - Create data integrity incident response procedures - Implement integrity checking for ePHI at rest and in transit - Document integrity verification frequency and methods - Integrate with existing monitoring (OPS-010)

Deliverables: - ePHI Integrity Authentication Procedures - Data integrity monitoring specifications - Updated System Monitoring Policy

---

8. Extend Audit Log Retention for ePHI

Priority: Medium HIPAA Reference: §164.316(b)(2)(i)

Actions: - Extend audit log retention from 1 year to 6 years for ePHI access logs - Implement long-term log archival solution - Document which logs require 6-year retention - Configure log retention policies in monitoring systems - Ensure archived logs remain accessible and searchable - Update relevant policies (SEC-002, OPS-010)

Deliverables: - Updated log retention policy - Log archival implementation - Updated monitoring and access control policies

---

---

Policy Development Recommendations

Policies Already in Place

Public-Facing Legal Documents (policies/legal/): - hipaa-compliance.md - Notice of Privacy Practices, patient rights, breach notification commitment - privacy-policy.md - Privacy practices, information handling, individual rights - terms-conditions.md - Legal framework for services

These documents address: Privacy Rule patient rights (§164.524, §164.526, §164.528), Notice of Privacy Practices (§164.520), Privacy Official designation (§164.530(a)), Complaints process (§164.530(e)), Breach notification commitment (§164.308(a)(6)(ii))

New Policies Needed

1. HIPAA Risk Analysis Policy (Critical Priority)
2. Enterprise-wide ePHI risk assessment
3. Annual risk analysis schedule

4. Risk register and treatment plans

5. Patient Rights Request Procedures (Medium Priority)

6. Internal operational procedures for access, amendment, accounting requests
7. Request forms and workflows with specific timelines

8. Decision criteria and tracking system

9. Physical Security and Facility Access Policy (High Priority)

10. Facility access controls
11. Physical security plan

12. Access validation procedures

13. Emergency Mode Operations Plan (High Priority)

14. ePHI access in emergency mode
15. Emergency authorization procedures

16. Partial system availability procedures

17. Workforce Clearance and Background Check Policy (Medium Priority)

18. Background check requirements and procedures
19. Clearance levels for ePHI access

20. Pre-employment screening

21. Malware Protection Policy (Medium Priority)

22. Malware detection and reporting procedures
23. Anti-malware software standards

24. Response procedures

25. ePHI Integrity Monitoring Policy (Medium Priority)

26. Digital signature implementation
27. Checksum verification
28. Integrity monitoring procedures

Policies Requiring Minor Updates

1. SEC-004: Incident Response and Reporting Policy
2. Add reference to public breach notification commitment in hipaa-compliance.md
3. Add 4-factor breach risk assessment methodology

4. Add specific breach notification timelines (60 days)

5. OPS-002: Business Continuity and Disaster Recovery Policy

6. Add emergency mode operations plan

7. Add ePHI access procedures during emergencies

8. HR-001: Employee IT Training and Awareness Policy

9. Add HIPAA-specific training content and requirements
10. Add training documentation requirements

11. Add 6-year training record retention

12. OPS-010: System Monitoring and Performance Management Policy

13. Extend audit log retention to 6 years for ePHI access

14. Add ePHI-specific monitoring requirements

15. SEC-002: Access Control and Authorization Policy

16. Extend audit log retention to 6 years
17. Add ePHI-specific access requirements
18. Add minimum necessary access determinations

---

Compliance Assessment Summary

Strengths

1. Strong Technical Safeguards: Excellent coverage of access control, authentication (multi-factor), encryption, and audit controls.

2. Comprehensive Administrative Safeguards: Well-documented access management, workforce security, incident response, and contingency planning.

3. Privacy Rule Compliance: Strong public-facing legal documents (policies/legal/) clearly communicate patient rights, privacy practices, breach notification commitment, and Privacy Officer designation. These documents provide the foundation for HIPAA Privacy Rule compliance.

4. Business Associate Management: Excellent BAA requirements and vendor management procedures exceeding baseline requirements.

5. Documentation and Version Control: All policies well-documented with version control, revision tracking, and regular review cycles.

6. Backup and Recovery: Comprehensive backup procedures with encryption, geographic redundancy, and regular testing.

7. Dual Policy Framework: Organization maintains both internal operational policies (policies/) and public-facing legal notices (policies/legal/), providing comprehensive coverage of HIPAA Security Rule and Privacy Rule requirements.

8. Security Awareness: Strong training program with phishing simulations and ongoing security reminders.

Remaining Gaps

1. Risk Analysis: No documented enterprise-wide HIPAA security risk analysis. This remains the most critical compliance gap.

2. Privacy Rule Operational Procedures: While patient rights, Privacy Officer designation, and breach notification commitment are publicly documented in policies/legal/hipaa-compliance.md, internal operational procedures for handling specific requests need detailed workflows, timelines, and tracking systems.

3. Physical Security: Physical safeguards less comprehensively documented (may be appropriate for cloud-based operations).

4. Emergency Mode Operations: ePHI access during emergency mode not explicitly addressed.

5. Audit Log Retention: Current 1-year retention may be insufficient for accounting of disclosures (6-year requirement).

Overall Compliance Rating

Category	Rating	Percentage
Administrative Safeguards	Strong	90%
Physical Safeguards	Moderate	65%
Technical Safeguards	Strong	90%
Organizational Requirements	Excellent	95%
Policies and Procedures	Strong	90%
Privacy Rule	Strong	92%
Overall HIPAA Compliance	Strong	87%

Assessment: The policy framework demonstrates strong comprehensive compliance with both HIPAA Security Rule and Privacy Rule requirements. The organization has implemented robust access controls, encryption, authentication, and business associate management. Public-facing legal documents (policies/legal/) effectively communicate patient rights, privacy practices, Privacy Officer designation, and breach notification commitment.

The most critical remaining gap is the formal enterprise-wide risk analysis, which is a foundational HIPAA requirement. Secondary priorities include developing internal operational procedures for patient rights requests and enhancing physical security documentation. With the recommended enhancements, particularly completing the risk analysis, the organization can achieve comprehensive HIPAA compliance exceeding 90% and demonstrate a mature, well-documented compliance program.

---

Next Steps

Immediate (Week 1-2)

1. Review this compliance matrix with leadership and compliance team
2. Prioritize gap remediation based on risk and regulatory requirements
3. Assign owners for each recommendation
4. Develop project plan with timelines and resources

Short-Term (Month 1-3)

1. Address all Critical priority recommendations
2. Conduct HIPAA Security Risk Analysis
3. Develop Breach Notification Policy
4. Designate Privacy Official
5. Begin Privacy Rule policy development

Medium-Term (Month 3-6)

1. Complete Privacy Rule Compliance Policy
2. Implement individual rights procedures
3. Enhance physical security documentation
4. Develop emergency mode operations plan
5. Implement HIPAA-specific training program

Long-Term (Month 6-12)

1. Conduct comprehensive HIPAA compliance evaluation
2. Address all remaining medium and low-priority gaps
3. Consider third-party HIPAA compliance audit
4. Implement continuous compliance monitoring
5. Establish ongoing HIPAA compliance program with regular assessments

---

Document Information

Prepared By: Policy Framework Compliance Assessment Team Review Frequency: Annual or upon significant regulatory changes Next Review Date: November 2026 Distribution: Executive Leadership, Compliance Team, IT Leadership, Legal Counsel Classification: Confidential - Internal Use Only

Disclaimer: This compliance matrix is based on review of the documented policy framework as of November 11, 2025. Actual compliance depends on implementation and operational practices. This assessment should be supplemented with technical security testing, operational audits, and legal review. This document does not constitute legal advice and should be reviewed by qualified HIPAA legal counsel.

---

Document Control - Version: 1.0 - Date: November 11, 2025 - Storage: product-docs/compliance/hipaa-compliance-matrix.md - Related Documents: All policy files in policies/ directory