Live Webinar | 26 June 2025 9AM PT
From Black Box to Boardroom: Operationalizing Trust in AI Governance

Frequently Asked Questions

All common questions, answered in one place – just for you.
HIPAA
What is HIPAA Compliance?

HIPAA was created to safeguard the confidentiality, integrity, and availability of protected health information (PHI). HIPAA compliance is the act of being on par with HIPAA regulations, standards, and implementation specifications, i.e., checking if entities are following HIPAA’s policies to meet its standards for data security and privacy.

What is covered under HIPAA compliance?

HIPAA requires “covered entities” to implement security and data privacy controls to protect patient’s health information from unauthorized access. HIPAA rules apply equally to all types of covered entities, including health plans, health care clearinghouses, and health care providers who are responsible for transmitting healthcare data in a HIPAA-compliant manner. HIPAA compliance is also required for Business Associates who create, access, process, or store PHI.

What is PHI (Protected Health Information)?

Information about a person’s past, present, or potential health condition that is gathered from them by a covered entity must be protected because it either identifies the person or there is a good reason to think that it can be used to find, identify, or get in touch with them.

Who needs to comply with HIPAA? Is it legally required?

HIPAA is a legal obligation under which all covered entities are mandated to establish security and data privacy controls to protect PHI from unauthorized access. Examples of covered entities required by law to abide by HIPAA regulations include healthcare providers, insurance providers, and clearinghouses. In this context, health care providers include physicians, hospitals, and medical, dental, and vision care facilities.

Is HIPAA applicable to wearables and medical devices?

It can be if the device collects, stores, or transmits PHI (for example, glucose levels associated with a specific person) to a Covered Entity or Business Associate organization. More medical devices, wearables, and IoT devices include built-in microprocessors and WiFi/Bluetooth, allowing them to store PHI data and transmit it to the cloud, where any healthcare entity can access it.

Are business associates and covered entities using the same HIPAA Compliance Software?

Any business adhering to HIPAA regulations can benefit largely from compliance software. It enables both covered entities and associates to audit their sensitive data and security measures to determine where they are already compliant, where they aren’t, and how to close remaining gaps.

What does a HIPAA violation include?

HIPAA violation violates actions such as failing to keep PHI private, inappropriately accessing PHI data, or sending PHI via insecure methods. Individual health information violations can result in fines of up to $250,000 or imprisonment for up to ten years.

How is HIPAA different from HITECH?

While the HIPAA Privacy Rule allows patients to access and manage their own PHI, the HITECH Act expands those rights by enabling patients to obtain electronic copies of their health records, provided that the covered entity keeps those records in that format. Additionally, HITECH forbids businesses from selling PHI unless very specific, limited circumstances apply. This successfully prevented service providers from making money off of treatment suggestions.

What does the HIPAA Security Rule mean?

The security standards meant for protecting the confidentiality, integrity, and availability of PHI are covered under the HIPAA security rule. It stipulates that covered entities must implement technical safeguards to prevent unauthorized access and related security incidents.

Why is HIPAA challenging?

Organizations that create, maintain, or transmit protected health information (PHI) are required by HIPAA to abide by its rules. HIPAA is mandatory, in contrast to SOC 2 and ISO 27001, and non-compliance with the framework can result in hefty fines.

Since HIPAA does not mandate a third-party audit, it is difficult to know your compliance status at any given time. With the help of Scrut Automation’s HIPAA compliance framework, you can maintain compliance easily.

Ready to see what security-first GRC really looks like?

The Scrut Platform helps you move fast, stay compliant, and build securely from the start.

Book a Demo
Book a Demo