Data handling and policy

Has the Applicant confirmed HIPAA compliance?

The threshold question is whether the rules apply to you at all, and organisations that serve healthcare clients are inside them more often than they expect.

Attested, not tenant-verifiable

What the carrier is actually asking

The carrier is asking whether you are subject to the health privacy and security rules and, if so, whether you have confirmed compliance. Covered entities are providers, plans, and clearinghouses. Business associates are the vendors that handle protected health information on their behalf, which includes a great many technology companies.

Why it is underwritten

Health information carries the highest notification costs and the most active regulatory enforcement of any common data type. The rules also impose specific obligations, including a documented risk analysis, that regulators ask for first after an incident. Carriers price both the notification exposure and the regulatory one.

Where the answer lives in Microsoft 365, Entra ID, and Azure

Compliance is evidenced by documents and a risk analysis rather than by configuration, so this is attested. Some supporting technical controls are measurable.

PlatformWhere the setting livesWhat has to be true
Compliance documentsSecurity risk analysis, dated and currentA completed risk analysis, which is the artefact regulators request first and the one most often missing
ContractsBusiness associate agreements with clients and with subcontractorsExecuted agreements in both directions, since a subcontractor handling health data needs one from you
PoliciesPrivacy and security policies, workforce training records, and sanction policyThe administrative safeguards, which are as much a part of the rule as the technical ones
Microsoft 365Encryption, audit logging, and access controls over systems holding health dataTechnical safeguards evidenced by configuration rather than by policy
Incident processBreach notification procedures with the applicable timelinesA defined process that meets the notification deadlines, which are shorter than many teams assume
The risk analysis is the artefact that matters

Organisations answer yes on the strength of policies and encryption. The security rule requires a documented, periodic risk analysis, and its absence is among the most frequently cited findings in enforcement actions. If you answer yes and cannot produce one, the answer is weaker than it looks.

What a defensible yes requires

  • Whether the rules apply has been determined by counsel rather than assumed.
  • A current, documented risk analysis exists and has been updated recently.
  • Business associate agreements are executed in both directions and inventoried.
  • Workforce training is delivered and recorded.
  • Breach notification procedures meet the statutory timelines and have been walked through.

How this answer goes wrong

A technology vendor serving healthcare clients answers not applicable because it is not a provider. Business associate status follows from handling protected health information on a covered entity's behalf, and the obligations attach directly. The clients' agreements usually say so, and nobody read them.

Frequently asked

Are we a business associate?

If you create, receive, maintain, or transmit protected health information for a covered entity, most likely yes. Hosting, support, and analytics vendors commonly are.

Is there a certification?

No official one. Independent assessments against the rule exist and are useful evidence, and none of them is an official certification, so describe what you actually hold.

What do carriers want to see?

The risk analysis, the agreements, and the training records. Those three cover most of what an enforcement inquiry would ask for first.

What about state health privacy laws?

Several states impose additional requirements, and they apply alongside the federal rule. Counsel should confirm the full set rather than the federal one alone.

Related questions

Stop answering this from memory

Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.

Assess your posture