--- title: "Has the Applicant confirmed HIPAA compliance?" url: https://insuranceposture.com/questions/data-handling/applicant-confirmed-hipaa-compliance category: "Data handling and policy" canonical_key: q_dat_004 evidence_state: attested updated: 2026-08-24 --- # Has the Applicant confirmed HIPAA compliance? URL: https://insuranceposture.com/questions/data-handling/applicant-confirmed-hipaa-compliance Section: Data handling and policy Evidence state: Attested, not tenant-verifiable The threshold question is whether the rules apply to you at all, and organisations that serve healthcare clients are inside them more often than they expect. ## What the carrier is actually asking The carrier is asking whether you are subject to the health privacy and security rules and, if so, whether you have confirmed compliance. Covered entities are providers, plans, and clearinghouses. Business associates are the vendors that handle protected health information on their behalf, which includes a great many technology companies. ## Why it is underwritten Health information carries the highest notification costs and the most active regulatory enforcement of any common data type. The rules also impose specific obligations, including a documented risk analysis, that regulators ask for first after an incident. Carriers price both the notification exposure and the regulatory one. ## Where the answer lives in Microsoft 365, Entra ID, and Azure Compliance is evidenced by documents and a risk analysis rather than by configuration, so this is attested. Some supporting technical controls are measurable. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Compliance documents | Security risk analysis, dated and current | A completed risk analysis, which is the artefact regulators request first and the one most often missing | | Contracts | Business associate agreements with clients and with subcontractors | Executed agreements in both directions, since a subcontractor handling health data needs one from you | | Policies | Privacy and security policies, workforce training records, and sanction policy | The administrative safeguards, which are as much a part of the rule as the technical ones | | Microsoft 365 | Encryption, audit logging, and access controls over systems holding health data | Technical safeguards evidenced by configuration rather than by policy | | Incident process | Breach notification procedures with the applicable timelines | A defined process that meets the notification deadlines, which are shorter than many teams assume | **The risk analysis is the artefact that matters** Organisations answer yes on the strength of policies and encryption. The security rule requires a documented, periodic risk analysis, and its absence is among the most frequently cited findings in enforcement actions. If you answer yes and cannot produce one, the answer is weaker than it looks. ## What a defensible yes requires - Whether the rules apply has been determined by counsel rather than assumed. - A current, documented risk analysis exists and has been updated recently. - Business associate agreements are executed in both directions and inventoried. - Workforce training is delivered and recorded. - Breach notification procedures meet the statutory timelines and have been walked through. ## How this answer goes wrong A technology vendor serving healthcare clients answers not applicable because it is not a provider. Business associate status follows from handling protected health information on a covered entity's behalf, and the obligations attach directly. The clients' agreements usually say so, and nobody read them. ## If this answer turns out to be wrong What regulated data you hold sets which covers respond, so an inaccurate answer here narrows the policy quietly rather than loudly. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how an application answer ends in a denied claim](https://insuranceposture.com/glossary/claim-denial). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Are we a business associate? If you create, receive, maintain, or transmit protected health information for a covered entity, most likely yes. Hosting, support, and analytics vendors commonly are. ### Is there a certification? No official one. Independent assessments against the rule exist and are useful evidence, and none of them is an official certification, so describe what you actually hold. ### What do carriers want to see? The risk analysis, the agreements, and the training records. Those three cover most of what an enforcement inquiry would ask for first. ### What about state health privacy laws? Several states impose additional requirements, and they apply alongside the federal rule. Counsel should confirm the full set rather than the federal one alone. ## Related questions - [Does the Applicant collect, store, process, transmit PII / PHI / PCI?](https://insuranceposture.com/questions/data-handling/applicant-collect-store-process-transmit-pii-phi-pci) - [Does the Applicant have written information security policy reviewed and updated annually?](https://insuranceposture.com/questions/data-handling/applicant-written-information-security-policy-reviewed-updated-annually) - [Do written agreements with third parties contain defense/indemnification + insurance requirements?](https://insuranceposture.com/questions/third-parties/written-agreements-third-parties-contain-defense-indemnification-insurance-requirements) - [Is the Applicant compliant with cross-border data transfer laws?](https://insuranceposture.com/questions/data-handling/applicant-compliant-cross-border-data-transfer-laws) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.