Question 1

Is encryption required?

Accepted Answer

Technically it's 'addressable' rather than 'required' under the Security Rule, but in practice every regulator expects it and lack of encryption is the most-cited cause of HIPAA fines. Encrypt at rest and in transit.

Question 2

Do we need a HIPAA-eligible cloud (AWS BAA, Azure BAA)?

Accepted Answer

Yes, if you're handling ePHI in the cloud. The cloud vendor signs a BAA with you and the BAA-eligible services are the only ones permitted for ePHI.

Question 3

What if a vendor refuses to sign a BAA?

Accepted Answer

You can't use them for ePHI workloads. There are HIPAA-friendly alternatives for almost every category now.

Question 4

What's the difference between HIPAA and HITRUST?

Accepted Answer

HIPAA is the law; HITRUST CSF is a certifiable framework that maps to HIPAA (and many other regulations) and provides third-party attestation. HITRUST is heavier and more expensive but more rigorous proof for customers.

Question 5

Do you work outside a framework engagement?

Accepted Answer

Yes. Penetration testing, network and cloud security, and infrastructure hardening are all standalone services. You don't need a compliance deadline to get more secure; many clients start with the security work and add the framework later.