GRCLibrary.ai

Annex

United States HIPAA Sector Requirements Annex

This annex describes how an organization subject to the US Health Insurance Portability and Accountability Act (HIPAA) can use the core GRC library to meet HIPAA's operational obligations, and where HIPAA requires artefacts and processes the library does not itself produce. It deepens the sector-generic healthcare annex into a rule-by-rule operational view: role determination, the Security Rule safeguard families, the Privacy Rule use-and-disclosure core, the Breach Notification Rule mechanics and timelines, the enforcement and penalty structure, and the mapping of these obligations to library documents through the NIST SP 800-66r2 implementation crosswalk.

Type
Annex
Version
0.0.4
Date
2026-10-26
Owner
Chief Compliance Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Compliance: Sector-Specific
Review frequency
Annual and upon material HIPAA rule (Security, Privacy, Breach Notification) or HHS OCR guidance change
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • Purpose
  • Applicability triggers
  • Role determination
  • Obligations by rule
  • Library coverage and gaps
  • Enforcement and penalties
  • Operating expectations
  • Framework alignment
  • Limitations

Frameworks it maps to

Related documents