HIPAA
HIPAAUS federal law requiring protection of electronic protected health information by covered entities and business associates.
What is HIPAA?
HIPAA (Health Insurance Portability and Accountability Act) Security Rule requires administrative, physical, and technical safeguards for ePHI. Unlike prescriptive frameworks, HIPAA specifies what must be achieved (like access controls and audit logging) but not specific technologies. Covered entities must conduct risk assessments and implement appropriate safeguards.
In Microsoft 365
Microsoft 365 provides technical safeguards for HIPAA compliance. Azure AD Conditional Access provides access controls, audit logs provide the required audit trails, and sensitivity labels can classify ePHI. Microsoft signs a Business Associate Agreement for M365 services.
Examples
- 1§164.312(d) - Authentication requirement
- 2§164.312(b) - Audit controls
- 3§164.312(a)(1) - Access control
Related TrueConfig Controls
These controls help implement and verify hipaa in your Microsoft 365 environment.