HIPAA Security Rule readiness with a living risk analysis.
The Security Rule asks covered entities and business associates to protect electronic protected health information through administrative, physical and technical safeguards — grounded in an accurate, current risk analysis. AssurIQ keeps that analysis and its supporting safeguards evidenced continuously.
- Aug 04Evidence GapNo evidence on fileControl created from HIPAA pack mapping
- Aug 06PartialCollector · endpoint census3 of 41 workstations still on unsupported OS
- Aug 19PartialManual upload · lifecycle planReplacement schedule attached, exception requested
- Aug 27PassCollector · endpoint censusAll endpoints on supported OS · confidence 94
The requirement areas, in plain language.
Original AssurIQ summaries — not reproductions of the standard. Use the primary source for the authoritative text.
An accurate, thorough assessment of risks to ePHI, and measures that reduce them to a reasonable level — reviewed and updated as the environment changes.
Authorization, supervision, clearance and termination procedures; unique user identification; emergency access; automatic logoff.
Mechanisms to record and examine activity in systems containing ePHI; protection against improper alteration or destruction.
Verify that people and systems are who they claim; protect ePHI in transit.
Data backup, disaster recovery and emergency-mode operation plans, tested and revised.
Facility access, workstation and device controls; written agreements and oversight for business associates.
Universal controls that carry evidence into each requirement area.
Illustrative, high-level mapping. Inside the product every mapping is versioned and every control shows its live state, confidence and evidence.
| Requirement area | AssurIQ universal controls | Typical evidence | Example state |
|---|---|---|---|
| Risk analysis & management | AIQ-GOV-002 risk analysis currentRisk Register linkage to findings and controls | Register entries, finding history, control states | Partial |
| Access & authentication | AIQ-IAM-001 unique identitiesAIQ-IAM-002 privileged MFAAIQ-IAM-007 stale account review | Identity connector, AD posture | Fail |
| Audit controls | AIQ-LOG-001 central loggingAIQ-LOG-003 log review cadence | Log platform connector, review records | Partial |
| Device & media controls | AIQ-AST-001 inventory currentAIQ-END-004 supported OSAIQ-CRY-001 disk encryption | Collector discovery, endpoint connector | Partial |
| Transmission security | AIQ-CRY-003 TLS on exposed servicesAIQ-NET-003 segmentation | External surface scan, topology snapshot | Pass |
| Contingency planning | AIQ-BCK-001 tested restoresAIQ-BCK-002 backup coverage | Backup connector, restore test record | Evidence Gap |
| Business associates | AIQ-VND-001 provider inventoryAIQ-VND-003 agreements on file | Vendor records, agreements | Exception |
Example states are illustrative. An Evidence Gap means proof has not been collected yet — it is not a failed control.
What stays verified between assessments.
- Privileged MFA and identity hygiene re-read from the identity provider
- Device inventory and unsupported-OS findings refreshed by the collector
- Backup coverage and restore tests tracked with evidence and expiry
- Segmentation and exposure controls updated from topology snapshots
- Business-associate review dates tracked; overdue reviews change control state
- Risk Register kept linked to live findings so the risk analysis does not go stale
What AssurIQ does not do.
- AssurIQ does not certify HIPAA compliance; no such certification exists.
- AssurIQ does not perform breach risk assessments or notification determinations.
- AssurIQ is not designed to store or process patient records; it holds configuration state, metadata and proof of safeguards.
- Requirement summaries are original AssurIQ wording, not regulatory text.
Common questions
Does AssurIQ replace our risk analysis?+
We are a business associate, not a provider. Does this apply?+
How are proposed rule changes shown?+
AssurIQ supports HIPAA Security Rule readiness with evidence, risk analysis support and continuous verification. It does not certify compliance and does not make breach-notification determinations. Proposed rule changes are tracked separately from current requirements. Summaries are original AssurIQ wording.
Manage the endpoint. Understand the infrastructure. Prove the controls.
Explore the connected platform, or talk with the AssurIQ team about a controlled Windows RMM pilot. No production data is required to explore the fictional sandbox.