Has the Applicant confirmed HIPAA compliance?
The threshold question is whether the rules apply to you at all, and organisations that serve healthcare clients are inside them more often than they expect.
What the carrier is actually asking
The carrier is asking whether you are subject to the health privacy and security rules and, if so, whether you have confirmed compliance. Covered entities are providers, plans, and clearinghouses. Business associates are the vendors that handle protected health information on their behalf, which includes a great many technology companies.
Why it is underwritten
Health information carries the highest notification costs and the most active regulatory enforcement of any common data type. The rules also impose specific obligations, including a documented risk analysis, that regulators ask for first after an incident. Carriers price both the notification exposure and the regulatory one.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Compliance is evidenced by documents and a risk analysis rather than by configuration, so this is attested. Some supporting technical controls are measurable.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Compliance documents | Security risk analysis, dated and current | A completed risk analysis, which is the artefact regulators request first and the one most often missing |
| Contracts | Business associate agreements with clients and with subcontractors | Executed agreements in both directions, since a subcontractor handling health data needs one from you |
| Policies | Privacy and security policies, workforce training records, and sanction policy | The administrative safeguards, which are as much a part of the rule as the technical ones |
| Microsoft 365 | Encryption, audit logging, and access controls over systems holding health data | Technical safeguards evidenced by configuration rather than by policy |
| Incident process | Breach notification procedures with the applicable timelines | A defined process that meets the notification deadlines, which are shorter than many teams assume |
Organisations answer yes on the strength of policies and encryption. The security rule requires a documented, periodic risk analysis, and its absence is among the most frequently cited findings in enforcement actions. If you answer yes and cannot produce one, the answer is weaker than it looks.
What a defensible yes requires
- Whether the rules apply has been determined by counsel rather than assumed.
- A current, documented risk analysis exists and has been updated recently.
- Business associate agreements are executed in both directions and inventoried.
- Workforce training is delivered and recorded.
- Breach notification procedures meet the statutory timelines and have been walked through.
How this answer goes wrong
A technology vendor serving healthcare clients answers not applicable because it is not a provider. Business associate status follows from handling protected health information on a covered entity's behalf, and the obligations attach directly. The clients' agreements usually say so, and nobody read them.
Frequently asked
Are we a business associate?
If you create, receive, maintain, or transmit protected health information for a covered entity, most likely yes. Hosting, support, and analytics vendors commonly are.
Is there a certification?
No official one. Independent assessments against the rule exist and are useful evidence, and none of them is an official certification, so describe what you actually hold.
What do carriers want to see?
The risk analysis, the agreements, and the training records. Those three cover most of what an enforcement inquiry would ask for first.
What about state health privacy laws?
Several states impose additional requirements, and they apply alongside the federal rule. Counsel should confirm the full set rather than the federal one alone.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture