HIPAA · US Security Rule
HIPAA for US health data.
HIPAA protects health information in the United States. European companies that serve US healthcare organisations often have to meet the Security Rule as a business associate. With Basenorm you manage its safeguards on your ISO 27001 ISMS.
Hosted in the Netherlands. Your data stays in the EU.In brief
- Type
- US federal lawEnforced by the HHS Office for Civil Rights
- Applies to
- Covered entities and business associatesThat handle protected health information
- Security Rule
- Three types of safeguardsAdministrative, physical and technical
- Contract
- Business associate agreementBetween a covered entity and its suppliers
01 / What HIPAA asks
What HIPAA
asks of you.
The Security Rule asks for safeguards for electronic protected health information. The Breach Notification Rule sets out what to do after a breach.
- 1Risk analysis
Assess the risks to the confidentiality, integrity and availability of health information.
- 2Administrative safeguards
Security management, workforce training and contingency planning.
- 3Physical safeguards
Control access to facilities, workstations and devices.
- 4Technical safeguards
Access control, audit controls, integrity and transmission security.
- 5Breach notification
Notify affected individuals and the authority after a breach of unsecured health information.
- 6Business associate agreements
Contracts with suppliers that handle protected health information.
02 / With your ISMS
HIPAA on what you already have.
| Topic | Your ISO 27001 ISMS | What HIPAA adds |
|---|---|---|
| Risk | Information security risk assessment | A risk analysis focused on protected health information |
| Safeguards | Annex A controls | Mapping to the administrative, physical and technical safeguards |
| Incidents | Incident management | The breach notification rules |
| Suppliers | Supplier relationship controls | Business associate agreements |
ISO 27001 covers many of the safeguards. HIPAA adds specific requirements for health information and its own breach rules.
03 / The assessment
HIPAA SECURITY RULEHow HIPAA
is assessed.
There is no official HIPAA certification. Organisations show compliance through their own documentation, risk analysis and, where needed, independent assessments.
Read about ISO 27001Self-documented. You document your safeguards and risk analysis yourself.
Independent review. Customers sometimes ask for an independent assessment of your safeguards.
HHS Office for Civil Rights. Enforces HIPAA and investigates complaints and breaches.
HIPAA is a US federal law. The Security Rule and Breach Notification Rule are issued by the US Department of Health and Human Services.
04 / In Basenorm
How Basenorm supports you.
Unified Control Library
See which of your ISO 27001 controls also count for the HIPAA safeguards.
02Governance Graph
Connect systems with health information, suppliers, controls and owners.
03AskNorman
Ask what is still open for HIPAA, in Basenorm or via MCP from ChatGPT, Claude or Perplexity. You review the evidence yourself.
05 / Questions
Questions about
HIPAA.
Does HIPAA apply to a European company?
If you handle protected health information for a US covered entity, for example as a software supplier, you are usually a business associate and the Security Rule applies to you.
Is there a HIPAA certification?
No. There is no official certification. You show compliance through your documentation, risk analysis and, where needed, an independent assessment.
Is ISO 27001 enough for HIPAA?
Not on its own. Many safeguards overlap, but HIPAA has specific requirements for health information and its own breach rules.
Does Basenorm sign business associate agreements?
Ask our team about your specific situation. Basenorm itself is hosted in the Netherlands and processes your data under a data processing agreement.
Book a demo
Manage HIPAA on your ISMS.
In a demo we look at your US customers, your safeguards and what you can reuse.
- Which ISO 27001 controls count for HIPAA.
- How you document your risk analysis.
- How you manage HIPAA next to your other standards.
Hosted in the Netherlands. Your data stays in the EU.