Security-first compliance
for HIPAA

You send 4 things, and Strac Comply builds them as you go.

First, a Trust portal page you send as a link. It shows your frameworks, your posture and the documents you choose to publish.

Second, an audit binder that pins every policy version, document, test result and written determination to the moment it was current. You download it as a package or share it by magic link. A reviewer then works in their own portal, not inside your account.

Third, a current risk analysis with a dated management approval. Fourth, the records a reviewer samples: training completions and policy acknowledgments per person, and Business Associate Agreements per vendor.

Most healthcare buyers also ask for a SOC 2 report, and the same evidence supports it.

Strac Comply covers the Security Rule (45 CFR Part 164, Subparts A and C). That means 18 standards and 36 implementation specifications across the Administrative, Physical and Technical Safeguards. It also covers §164.314 and §164.316.

Breach notification (§164.400 to §164.414) is a control set too, not only a policy. It covers the notice duties and the 4-factor risk assessment that decides whether you notify. It also covers the log of breaches that affect fewer than 500 people.

The individual notice is due without unreasonable delay and no later than 60 calendar days after discovery. That is a deadline, not a grace period.

The Privacy Rule (minimum necessary, notice of privacy practices, accounting of disclosures) is not run as a control program here. The AI vCISO can still answer questions about it.

Most health tech companies are business associates. A business associate owes the Security Rule, the breach notice duties and its own subcontractor agreements.

A covered entity also owes the Privacy Rule administrative requirements at §164.530: a privacy official, privacy training, a sanctions policy and a complaints process. Those stay yours to run.

An Addressable specification is not optional. It is never "not applicable" either. You decide whether it is reasonable and appropriate for you.

Where it is not, you write down why. You also put an equivalent alternative measure in place if one is reasonable and appropriate. You need that written rationale under §164.306(d)(3).

Under §164.316(b)(2)(i), you must keep it six years from creation or from the date it was last in effect, whichever is later. Strac Comply keeps each determination as a versioned document, so the decision is still there years later.

Encryption is where this comes up most. Both §164.312(a)(2)(iv) and §164.312(e)(2)(ii) are Addressable rather than Required. Implement it anyway.

ePHI encrypted to HHS guidance, with the key safe, is not a reportable breach at all.

Yes, and it is most of the work. The Technical Safeguards at §164.312 overlap heavily with SOC 2 CC6 and CC7 and ISO 27001 Annex A 8.x.

The same encryption, access control and audit logging tests count toward all 3, and you collect them once. If you already run SOC 2, HIPAA adds mostly scoping and documentation, not a second round of evidence collection.