HIPAA Cheat Sheet — PHI Stakeholder Quick Reference

👤 Who Must Comply

Type	Examples
Covered Entity (CE)	Health plans, hospitals, clinics, insurers, clearinghouses
Business Associate (BA)	SaaS vendors, cloud providers, analytics platforms, billing services, benefits portals (like Lantern)
Sub-contractor	Vendors hired by BAs who touch PHI — must also sign BAA
Required: Business Associate Agreement (BAA) signed before any PHI is accessed or processed

🔴 18 PHI Identifiers (Safe Harbor)

Name Address (street, city, zip+4) Dates (DOB, admit, discharge) Phone / Fax Email SSN MRN / Health Plan # Account # Certificate / License # VIN / Device serial Web URL IP Address Biometrics Full-face photos Any unique identifier

Any of these + health/payment info = PHI → HIPAA applies

📋 Privacy Rule

Minimum necessary — only access/share PHI needed for the task
Patient rights — access, amend, restrict, accounting of disclosures
Permitted uses — Treatment, Payment, Operations (TPO) without consent
Authorization required for marketing, research, non-TPO disclosures
Notice of Privacy Practices (NPP) must be provided to patients

→ Implement data classification; train staff on minimum-necessary

🔒 Security Rule (ePHI only)

Administrative — policies, workforce training, risk analysis
Physical — facility access, workstation controls, device disposal
Technical — access control, audit logs, encryption, auto-logoff
Required vs. Addressable safeguards — addressable = implement or document why not
Annual Risk Analysis is mandatory (not optional)

→ Core focus for engineering/GRC teams building ePHI systems

🚨 Breach Notification Rule

60 days — notify affected individuals after discovery
60 days — notify HHS (Secretary)
500+ records — notify prominent media in affected state
<500 records — log and report to HHS annually
Breach = unauthorized access unless low probability of PHI compromise (4-factor test)

→ Maintain breach log; test IR plan annually; define discovery date precisely

⚙️ Technical & Administrative Controls to Implement

Control Area	What's Required	How to Implement (AWS / SaaS context)	Type
Access Control	Unique user IDs; role-based access; no shared accounts	→ IAM roles + least privilege; Okta SSO; MFA on all PHI systems; quarterly access reviews	Technical
Audit Controls	Log who accessed/modified ePHI; tamper-evident logs	→ CloudTrail + CloudWatch Logs; S3 Object Lock (WORM); 6-yr retention minimum	Technical
Encryption at Rest	Addressable but effectively required; AES-256	→ S3 SSE-KMS; RDS encryption; EBS volumes encrypted; KMS CMKs per PHI data store	Technical
Encryption in Transit	TLS 1.2+ for all ePHI transmission	→ Enforce HTTPS-only (S3 bucket policy, ALB redirect); disable TLS 1.0/1.1; cert rotation via ACM	Technical
Integrity Controls	Detect unauthorized alteration or destruction of ePHI	→ S3 versioning + Object Lock; file integrity monitoring (AWS Config rules); checksums on exports	Technical
Automatic Logoff	Terminate sessions after inactivity	→ Session timeout in app (15–30 min); Cognito/Okta idle session policies	Technical
Risk Analysis	Annual written risk assessment of all ePHI flows	→ Data flow diagram → threat modeling → risk register with likelihood/impact scores; review after major changes	Administrative
Workforce Training	All staff with PHI access trained at hire + annually	→ LMS tracking; phishing simulations; role-specific PHI handling modules; sign-off records	Administrative
Incident Response	Written IR plan; breach identification, containment, reporting	→ Playbooks per incident type; 60-day notification SLA tracked; tabletop exercise annually	Administrative
BAA Management	Signed BAA with every vendor touching ePHI	→ Vendor inventory with BAA status; AWS BAA auto-active for eligible services; annual renewal review	Administrative
Physical Safeguards	Workstation policy; device disposal; facility access	→ MDM + full-disk encryption on endpoints; secure wipe policy; AWS handles data center (inherit via SOC 2)	Physical
De-identification	Remove all 18 identifiers OR expert determination	→ Safe Harbor method in data pipelines; mask/tokenize in non-prod environments; never use real PHI in dev/test	Technical

👥 Stakeholder Responsibilities

Role	Key Obligations
CISO / Security	Own risk analysis; oversee technical controls; manage incident response
GRC / Compliance	Policy maintenance; BAA tracking; audit readiness; breach log; HHS reporting
Engineering	Implement encryption, access controls, audit logs; no PHI in logs/dev; secure SDLC
Product	Pre-deployment risk assessments; minimum-necessary data design; consent flows
Legal / Privacy	BAA negotiation; NPP drafting; patient rights responses; state law overlay
HR / People Ops	Workforce training records; sanction policy enforcement; background checks
Executive / Board	Designate Privacy & Security Officers; resource allocation; accountability

💰 Penalties & Enforcement

Tier	Cause	Per Violation	Annual Cap
Tier 1	Didn't know; reasonable diligence	$100–$50K	$25K
Tier 2	Reasonable cause; not willful neglect	$1K–$50K	$100K
Tier 3	Willful neglect — corrected	$10K–$50K	$250K
Tier 4	Willful neglect — not corrected	$50K+	$1.9M
Criminal — Knowing misuse: up to 10 years imprisonment

→ OCR (HHS Office for Civil Rights) enforces; state AGs can also pursue

✅ Must Do

Sign BAA before any vendor accesses PHI
Conduct annual written risk analysis
Encrypt ePHI at rest and in transit
Maintain audit logs; retain 6 years
Train all workforce at hire + annually
Respond to patient access requests within 30 days
Report breaches to HHS within 60 days
Appoint a Privacy Officer and Security Officer
Apply minimum-necessary standard to all disclosures

❌ Never Do

Use real PHI in dev, test, or staging environments
Log PHI in application error logs or debug output
Share PHI via unencrypted email or Slack
Allow shared/generic user accounts for PHI access
Store PHI in systems without a signed BAA (incl. free-tier cloud tools)
Delay breach discovery-to-report beyond 60 days
Sell PHI without explicit written authorization
Screenshot or copy PHI to personal devices

HIPAA Quick Reference — PHI Stakeholder Cheat Sheet