Regulatory Standards · United States
HIPAA Security Rule
HIPAA safeguards, evidenced against the ePHI they protect.
HIPAA requires a documented risk analysis and safeguards for electronic protected health information. Astragar connects each safeguard to the systems holding ePHI, the vulnerabilities exposing them and the evidence behind them.
Book a HIPAA review✓ Available in Astragar GRC
3
Safeguard types: administrative, physical, technical
60 days
Maximum to notify affected individuals of a breach
Risk analysis
A required, documented, organisation-wide assessment
What HIPAA requires
The obligations, in brief.
Risk analysis
Assess risks to the confidentiality, integrity and availability of all ePHI.
Safeguards
Implement administrative, physical and technical safeguards proportionate to that risk.
Access & audit
Control access to ePHI and record activity on systems that hold it.
Breach notification
Notify individuals, HHS and, for larger breaches, the media.
How Astragar helps
From checklist to measurable risk.
01
Requirement → control mapping
Map every HIPAA requirement to controls, systems, assets and owners.
02
Evidence, continuously
Collect and maintain evidence, with sign-off from contributor to IT auditor, CISO and executive office.
03
Exposure behind the gaps
See which vulnerabilities and sensitive data put HIPAA controls at risk.
04
Risk in financial terms
Prioritise remediation by business and financial impact, not checklist order.
Health data is the most expensive data to lose. Astragar ranks gaps by the ePHI they expose, so remediation starts where breach impact is highest.
Sign-off workflow
Evidence Contributor
→IT Auditor
→CISO
→Executive Office
Find the data. Test the controls. Reduce the risk.
Start with a scoped HIPAA review: requirements mapped, evidence gaps found, remediation prioritised by financial impact.
Book a HIPAA reviewAstragar supports compliance programmes with technical evidence and risk analysis. It does not provide legal advice or issue certifications.
See your cyber risk in $ terms, not CVSS scores.
