HIPAA Security Overview
Administrative, physical and technical safeguards and the AssurIQ mapping approach.
- The customer has the HIPAA Security framework enabled
- Identification of which systems store, process or transmit protected health information
Overview
The HIPAA Security Rule requires covered entities and their business associates to protect the confidentiality, integrity and availability of electronic protected health information (ePHI). AssurIQ organizes this into the three safeguard categories the rule itself uses, restated here in AssurIQ's own words.
The three safeguard categories
| Category | Summary |
|---|---|
| Administrative | Governance of the security program: risk analysis, workforce training, access authorization, contingency planning and business associate oversight |
| Physical | Control over physical access to facilities and devices that hold ePHI, plus device and media disposal |
| Technical | Access control, audit logging, integrity controls, and transmission security for systems that touch ePHI |
AssurIQ control mapping
| Safeguard area | Representative AssurIQ controls |
|---|---|
| Risk analysis / governance | AIQ-RA-001, AIQ-GV-001 |
| Access authorization and management | AIQ-AC-001, AIQ-AC-002, AIQ-ID-001 |
| Privileged access and MFA | AIQ-ID-004, AIQ-ID-006 |
| Audit controls / monitoring | AIQ-MO-001, AIQ-MO-002 |
| Endpoint and system integrity | AIQ-EN-001, AIQ-EN-002, AIQ-AS-001 |
| Contingency planning | AIQ-BR-001 |
| Transmission security / network segmentation | AIQ-NS-001, AIQ-NS-002, AIQ-NS-003 |
| Business associate oversight | AIQ-SP-001, AIQ-SP-002, AIQ-SP-003 |
Example: BrightPath Dental
BrightPath Dental stores patient records in systems reachable from staff workstations, putting HIPAA technical safeguards directly in scope. Two findings illustrate how AssurIQ evidences safeguard gaps concretely rather than abstractly:
- A privileged Microsoft 365 account without MFA enrolled maps to AIQ-ID-004 and is scored PARTIAL until enforcement is confirmed for every privileged account, not just most of them.
- OAK-FRONTDESK-03, a front-desk workstation running an unsupported Windows version, maps to AIQ-EN-002 and is scored FAIL because an end-of-life OS can no longer receive security updates, directly threatening the integrity safeguard for any ePHI that endpoint touches.
What AssurIQ evidences vs. what needs policy work
AssurIQ automatically evidences the technical safeguards it can observe directly: MFA enforcement, patch state, endpoint protection status, network segmentation, and access configuration. It does not write or maintain the organization's written policies, workforce training records, business associate agreements, or physical facility access logs — those remain the customer's responsibility, though AssurIQ can accept them as manual evidence to complete the picture for administrative and physical safeguards.