HIPAA compliance, continuous not annual.
OCR doesn't accept “we did the risk analysis last March” anymore. Continuous controls monitoring across all four HIPAA Rules, BA register with subcontractor cascade, workforce training that includes BAs, and a risk-management cycle that runs after the risk analysis ships.
- All §164.308 administrative safeguards (9 standards)
- All §164.310 physical safeguards (4 standards)
- All §164.312 technical safeguards (5 standards)
- BAA register · OCR audit-ready exports
What is HIPAA compliance software?
OCR investigations follow breach reports. The auditor’s first question is the BAA cascade. RiskWatch tracks every direct BA’s contract for the 5 §164.504(e) terms, every subcontractor BAA per §164.308(b)(2), and the annual OCR-required risk analysis — surfacing the missing tier-2s before OCR does. The gap that turns a Tier 1 violation into a Tier 3.
Risk analysis exists. Risk management doesn't.
The 2025 HIPAA Journal Annual Survey is blunt: privacy programs have mixed maturity, training skips business associates, and OCR's #1 enforcement target is “knowing about risks and failing to address them.” Here's what the three biggest pain themes look like for the privacy/security officer running this program.
Risk analysis exists. Risk management doesn't.
OCR's most-penalized HIPAA violation is knowing about risks to PHI and failing to address them — risks identified in the §164.308(a)(1)(ii)(A) analysis but never tracked through to remediation. Findings convert to risk-management items per §164.308(a)(1)(ii)(B), tracked to closure with owner, due date, evidence-of-close. The risk analysis becomes a living artifact, not an annual deliverable.
Workforce trained annually. BAs not at all.
The 2025 survey found business associates are routinely excluded from HIPAA training programs — and yet covered entities are vicariously liable for BA actions. Workforce training cadence per §164.308(a)(5) extends to BAs through the BAA register — assignments, attestation, quiz scoring, all timestamped per workforce member regardless of org boundary.
BA breach happens. OCR doesn't care that the BA caused it.
A covered entity is liable when it “knew, or by exercising reasonable diligence, should have known” of a pattern of BA non-compliance. Subcontractor BAA cascade tracking, BA risk-monitoring feeds, and the “reasonable diligence” audit trail that proves you were paying attention before the breach.
Every module a HIPAA program needs — in one platform.
Sixteen modules sharing the §164 control library, BAA register, and PHI inventory. Built around the OCR-required risk analysis so the §164.308(a)(1)(ii)(A) deliverable updates continuously.
Privacy + security in one view
§164.308/310/312 rollups, top open findings, BAAs expiring, workforce-training rates, breach-readiness state.
All 168 controls pre-loaded
Administrative, physical, technical safeguards from the Security Rule plus Privacy Rule §164.500-§164.534 controls.
§164.308(a)(1)(ii)(A) as a living doc
Continuous, quarter-by-quarter scoring. Trended deltas. OCR-ready exports with methodology, scope, and findings.
Principals + subcontractors
Track BAAs, expirations, breach-notification clauses. Subcontractor BAA cascades flagged automatically.
Where PHI lives
EHR, claims, imaging, wearables, partner systems. Data flows mapped to systems and BAs.
§164.308(a)(5) attestation
Schedule, deliver, attest, quiz — with timestamped evidence per §164.308(a)(5)(ii)(A–D).
60-day clock starts now
Breach Notification Rule (§164.404–414) playbook, OCR breach portal templates, individual + media notification drafts.
NPP version control
§164.520 NPP authoring, posting, attestation. Every revision timestamped, every patient ack recorded.
HIPAA + HITRUST + ISO 27001
Each control links to HITRUST CSF v11, ISO 27001 Annex A, NIST 800-53. One assessment, multiple deliverables.
Workforce + BA screening
OIG LEIE, SAM exclusions, state Medicaid lists. Continuous screening with breach alerts on hits.
Security incidents → breaches
§164.308(a)(6) incident response procedures, evidence collection, breach assessment per §164.402(2)(i–iv).
Findings → tracked work
Convert findings into assigned tasks with owner, due date, evidence-of-close. Bidirectional Jira/ServiceNow sync.
What auditors actually ask for
Risk analysis, sanctions log, training records, BAA register, NPP versions, breach log — one ZIP, one click.
"Who changed this?" answered instantly
Timestamped log of every score change, BAA upload, training-completion mark, breach-classification decision.
Quarterly cadence per §164 family
Administrative every quarter, physical every 6 months, technical continuously. Reminders + escalation automatic.
Onboard 50 BAAs in 5 minutes
Bulk import workforce, BAs, PHI systems, prior risk analyses. CSV + API sync. Customize fields without IT.
Privacy · Security · Breach Notification · Omnibus.
Most HIPAA tools cover the Security Rule. RiskWatch covers all four — including the Privacy Rule's 80+ standards, the Breach Notification Rule's 60-day clock, and the Omnibus 2013 updates that brought BAs into direct OCR liability. Each rule maps to specific §164 sections, each section to specific controls.
- Privacy Rule §164.500–.534 — Notice of Privacy Practices, individual rights, minimum necessary, marketing & fundraising restrictions
- Security Rule §164.302–.318 — All 18 safeguard categories — administrative, physical, technical, plus organizational and policies/procedures
- Breach Notification §164.400–.414 — 60-day clock to individuals, OCR portal submission, media notification for 500+ affected
- Omnibus 2013 updates — BA direct liability, GINA additions, sale-of-PHI restrictions, marketing/fundraising tightening
HIPAA + HITRUST + ISO 27001 + SOC 2.
One control answer flows into HITRUST CSF v11, ISO 27001 Annex A, and SOC 2 trust services criteria simultaneously. The HITRUST authorization is the single highest-bar audit in healthcare — RiskWatch maps every HIPAA control to its HITRUST counterpart so progress on one is progress on both.
- HITRUST CSF v11 — every HIPAA control mapped to the corresponding CSF requirement statement
- ISO 27001:2022 Annex A — cross-mapping covering A.5–A.8 organizational, people, physical, technological controls
- SOC 2 trust services — CC1–CC9 plus PI / A / C principles for healthcare SaaS
- NIST 800-66 r2 implementation — the official HIPAA Security Rule implementation guide structure
- State law overlays — TX HB 300, NY SHIELD Act, CA CMIA — additional requirements layered on
The §164 Security Rule, organized.
9 standards covering risk analysis, workforce training, info access, contingency, evaluation, BAAs
4 standards covering facility access, workstation use/security, device and media controls
5 standards covering access control, audit, integrity, transmission, person/entity authentication
Business Associate Agreements + group health plan requirements
The BAA isn't the contract. It's the cascade.
OCR enforcement consistently flags missing subcontractor BAAs as a Tier 3 violation. §164.308(b)(2) makes you responsible for ensuring every business associate has BAAs with their subcontractors who handle PHI — and proving the chain holds. Most teams sign BAAs with their direct vendors and stop there. The cascade view makes the missing tier 2s impossible to miss.
- BAA register — every direct BA tracked with §164.504(e) required terms, renewal dates, and contact
- Subcontractor BAA cascade — §164.308(b)(2) cascade visible per BA; missing tier-2 BAAs flagged for action
- Renewal alerts — 60/30/7-day renewal alerts to the privacy officer + procurement
- OCR-ready export — BAA register + cascade map packaged as evidence in any OCR investigation
From first risk analysis to OCR-ready in five stages.
Most teams complete a baseline §164.308(a)(1)(ii)(A) risk analysis within their first week. Stage 4 runs continuously. Stage 5 is on-demand the moment OCR or your auditor asks.
Inventory PHI
Map ePHI to systems, BAs, and data flows. Bulk-import from SCCM/CMDB or upload an inventory spreadsheet.
Score §164 controls
Question-by-question scoring across all 168 Security Rule + Privacy Rule controls. Auto-fill from prior assessments.
Risk-rank findings
Findings ranked by likelihood × impact per §164.308(a)(1)(ii)(B). Top-N gaps surfaced for the OCR risk-mgmt deliverable.
Remediate and reassess
Findings convert to tasks. BAA renewals tracked. Workforce training scheduled. Quarterly re-scoring runs automatically.
Report and produce
OCR audit pack — risk analysis, sanctions log, training records, BAA register, NPP versions, breach log — in two clicks.
The OCR audit that stopped feeling existential.
Real privacy officers. Real OCR audit responses. Real corrective-action plans avoided.
The §164.308(a)(1)(ii)(A) risk analysis used to take six weeks of full-time work. Now it's a saved report we update quarterly.
“OCR walked in expecting a fire drill and walked out asking for our methodology. The audit-trail-per-control feature alone is what moved the conversation forward.”
“BAA register changed how we onboard vendors. We catch missing BAAs at intake instead of finding out two months later when something breaks.”
“HITRUST cross-mapping cut our second audit cycle in half. We were already 80% done with HITRUST when we started — because every HIPAA control had already been scored.”
Plus every framework healthcare orgs run alongside HIPAA — cross-mapped.
Score one HIPAA control, satisfy HITRUST CSF, ISO 27001, SOC 2, and NIST 800-66 simultaneously. Plus state-law overlays for the multi-state covered entity.
Take RiskWatch home before you sign anything.
Three downloads. Use them to evaluate, share with privacy/security teams, or build the OCR-readiness business case.
HIPAA Security Rule Risk Analysis Template
OCR-aligned §164.308(a)(1)(ii)(A) risk analysis template — covers all 18 safeguard categories, includes the §164.308(a)(1)(ii)(B) risk-management plan worksheet and a methodology statement.
- Aligned to NIST 800-66 r2 methodology
- All §164.308/310/312 controls
- Editable Word + branded PDF
Business Associate Agreement Template
OCR-aligned BAA template covering all required §164.504(e)(2) provisions plus the Omnibus 2013 sub-contractor flow-down clauses. Includes a redline-ready vendor BAA-comparison checklist.
- All §164.504(e)(2) required provisions
- Subcontractor flow-down clauses
- Vendor-comparison checklist
HIPAA Compliance Platform Buyer's Guide
Vendor scorecard, OCR audit-pack benchmarks, BAA-tracking comparison, pricing by org size, and HITRUST-readiness depth.
- Feature matrix · 6 vendors
- Scorecard template
- Pricing benchmarks
Common questions, answered up front.
About HIPAA compliance software, the §164 Security Rule, BAAs, OCR audit prep, and HITRUST — and how RiskWatch covers all of them.
What is HIPAA compliance software?
What's the difference between the HIPAA Privacy Rule and Security Rule?
What's the difference between the OCR risk analysis and risk management?
How does the BAA register work?
Does the platform produce OCR-ready audit responses?
How does HITRUST cross-mapping help?
Does the platform handle the Breach Notification Rule?
Is there a free trial?
Run your first §164.308 risk analysis this week.
Start a 30-day free trial — every §164 control, the BAA register, the OCR audit pack, HITRUST cross-mapping, and continuous reassessment cadences. No credit card required.
No credit card required · 30-day free trial · Cancel anytime