HIPAA Security Rule · 45 CFR § 164.302–318 · Active Monitoring HHS-OCR · NIST SP 800-66r2 · ASTP/ONC
H S
HIPAA SHIELD
HIPAA Compliance, Built In.
Vol. I · The HIPAA Compliance Reference
HIPAA Compliance, Built In.

Audit yourself before
OCR audits you.

The HHS Office for Civil Rights collected $144M+ in HIPAA settlements over the last two years. Almost every covered entity hit was certified, attested, or "HIPAA Compliant" on paper. The gap was never the paperwork — the gap was the architecture underneath.

HIPAAShield is the working compliance reference for healthcare technology built the right way. Reference architecture, failure-mode analysis, and a self-audit you can run before the regulator runs theirs. Maintained by a practicing physician. Powered by AscentShield™.

HIPAA COMPLIANCE SCAN · ACTIVE
45 CFR § 164.302–318 · NIST SP 800-66r2
H S HIPAA SHIELD
HIPAA Compliance, Built In.
Audit yourself before OCR audits you.
§ 1  ·  The Compliance Gap

Compliance is not a feature.
It is an architecture.

Every HIPAA settlement of the last five years tells the same story: a vendor checked the boxes, signed the BAA, claimed the certification — and shipped a system that could not actually enforce what it promised. The gap is not paperwork. The gap is structural.

88%
of HIPAA breach reports in the last 24 months involved business associates with signed BAAs and active "compliance" attestations.
HHS-OCR Breach Portal · 2024–2025
$2.3M
average HIPAA settlement when OCR finds the covered entity could not produce a complete, immutable audit log on demand.
Resolution Agreements · Aggregated
7×
higher breach probability for organizations using bolt-on compliance modules versus HIPAA-native platforms with foundational safeguards.
Verizon DBIR Healthcare · NIST 800-66r2
§ 2  ·  The Distinction That Matters

Two architectures. One survives the audit.

The difference between bolt-on and HIPAA-native is the difference between paint and structural steel. One is visible. The other holds when the building shakes.

Bolt-On Compliance

Compliance is a feature flag, a banner, an attestation page.

  • Audit logs as application records — mutable, deletable, query-only when convenient.
  • Encryption at rest declared, but key management lives in the same trust domain as the data.
  • BAAs signed downstream as a formality, with no technical enforcement of the obligations.
  • Access controls layered on top of a permissive default — least-privilege as configuration, not architecture.
  • Breach response written in a runbook that has never been executed end-to-end.
HIPAA-Native

Compliance is the substrate. Every component inherits it by existing.

  • Append-only audit ledger with cryptographic chain-of-custody, exported to a sink the application cannot touch.
  • KMS-managed envelope encryption with separate trust domains for data, keys, and key administrators.
  • Technical BAA gating — no module reaches PHI without verifiable downstream BAA presence.
  • Default-deny role architecture; every read of ePHI logs the why, not just the what.
  • Tabletop-tested breach pathway with measurable detection-to-notification windows.
§ 3  ·  The Three Safeguards

The HIPAA Security Rule, read literally.

45 CFR § 164.308–312 is not a vibe. It is a three-pillar framework — administrative, physical, technical — and every credible compliance architecture begins by mapping its controls to those pillars, not the other way around.

I.
§ 164.308  ·  Administrative

Policy, training, and accountability — the human substrate.

Risk analysis as living practice, not annual ritual. Workforce training tied to access roles. Sanction policies with teeth. Information access management governed by least privilege as a default.

Risk analysis · Workforce training
Sanction policy · Access management
Contingency planning · BAA governance
II.
§ 164.310  ·  Physical

Facility, device, and media — the boundary against the world.

Cloud-native does not eliminate physical safeguards; it inherits them from a provider with a HIPAA BAA. Workstation and device controls remain the covered entity's burden, fully and without delegation.

Facility access controls
Workstation security
Device & media controls
Disposal & reuse procedures
III.
§ 164.312  ·  Technical

Cryptography, audit, and integrity — the architecture itself.

Access control with unique user identification. Automatic logoff. Encryption of ePHI at rest and in transit. Audit controls that record activity in a form the application cannot tamper with. Integrity verification on every write.

Access control · Audit controls
Integrity verification
Person/entity authentication
Transmission security · Encryption
HIPAA · Native
§ 4  ·  The Patterns of Failure

How compliant systems fail.

Every breach is novel to the victim and identical to the regulator. These are the four architectural failures HHS-OCR sees most often — each survivable only by systems that designed against it from day one.

FAILURE MODE 01

The mutable audit log.

An "audit trail" stored in the application database, editable by any process with write access, retained at the convenience of the schema migration. When OCR asks for six years of activity on a single record, the answer is partial — and partial is non-compliant.

§ 164.312(b) · Civil penalty tier 4
FAILURE MODE 02

The phantom BAA.

A signed BAA exists in a folder. The integration with the third-party API that actually transmits ePHI was never inventoried. The vendor on the other end is, technically, not a business associate — they are an unbounded liability with a checkmark.

§ 164.502(e) · Disclosure violation
FAILURE MODE 03

The shared trust domain.

Data is encrypted at rest. The key management system runs in the same project, accessed by the same service account, governed by the same IAM policy as the application itself. A single compromised principal breaks both layers simultaneously.

§ 164.312(a)(2)(iv) · Encryption defect
FAILURE MODE 04

The 60-day clock that has never been started.

HHS-OCR requires breach notification within 60 days of discovery. Most organizations cannot answer when discovery would even occur — there is no monitoring tuned to detect unauthorized PHI access, and the clock is running before anyone knows it has begun.

§ 164.404 · Notification failure
§ 5  ·  The Reference Architecture

The HIPAA-native pattern, layer by layer.

Every layer is a control point. Every control point maps to 45 CFR § 164. Click any layer to read its citation, the failure mode it prevents, and the architectural principle that defines it.

INGRESS · TLS 1.3 CIPHER VALIDATION · CERTIFICATE PINNING BAA GATE DOWNSTREAM BAA VERIFICATION § 164.504(e) KMS ENVELOPE ENCRYPTION SEPARATE TRUST DOMAIN · CMEK § 164.312(a)(2)(iv) APPEND-ONLY AUDIT LEDGER EXTERNAL SINK · 7-YEAR RETENTION § 164.312(b) DEFAULT-DENY RBAC JUSTIFICATION LOGGING · MINIMUM NECESSARY § 164.308(a)(4) EPHI FLOW CONTROL POINTS
LAYER 02 OF 05
45 CFR § 164.504(e) · Business Associate Contracts

BAA Gate — verification, not assumption.

Every downstream API, SaaS endpoint, or third-party integration that touches ePHI must present a verifiable BAA before the gate opens. Verification happens technically — at request time — not contractually in a folder. The BAA inventory is the source of truth; without an entry, the request is denied at the perimeter, before any PHI is even fetched from storage.

⚠ Prevents Failure Mode 02 — The Phantom BAA
§ 6  ·  Architectural Patterns

Two patterns worth borrowing.

Patent-pending technical patterns developed in the AscentShield product family. Published here as architectural patterns — not implementations — because the principle survives the patent. If your stack does not enforce these patterns, your BAA is doing legal work that your code refuses to do.

PATTERN 01

BAA-Enforced Technical Deployment Gate

REQUEST EPHI BOUND BAA GATE VERIFY · LOG · ALLOW EPHI RELEASED NO BAA → REQUEST DENIED, AUDIT-LOGGED

The BAA exists in a folder. The integration that needs PHI exists in code. The gate exists between them — and refuses to open unless the runtime can prove the downstream relationship is BAA-covered. The contractual layer becomes a technical precondition. Auditors see proof of enforcement, not proof of intent.

PRINCIPLE · CONTRACT & CODE MUST AGREE AT RUNTIME
PATTERN 02

PHI-Zero Preference Persistence

USER PREF CLIENT-SIDE HASH · SCOPE SALT · DOMAIN-BOUND STORE PHI-ZERO NO IDENTIFIER, NO TIMESTAMP, NO LINKAGE

User preferences and personalization data are durable, but PHI is not — by construction. The persistence layer never receives an identifier, a timestamp range, or anything that could be re-associated with a person. Preferences scope by salted hash + domain. The system remembers what the user wants without ever recording who the user is.

PRINCIPLE · UTILITY WITHOUT IDENTIFIABILITY
HIPAA · Native
Now Available

HIPAA Alert

Real-time HIPAA compliance monitoring for SMB healthcare practices. The gaps this audit identifies — HIPAA Alert watches for them continuously, alerting you the moment something changes.

Real-Time Alerts
Failed logins, after-hours PHI access, bulk exports, admin changes — flagged the moment they happen.
BAA Tracker
Every vendor BAA tracked for expiration. Alerts fire 30 days before expiry — before you're in violation.
Training Compliance
Annual HIPAA training tracked per staff member. Overdue records surface automatically, no spreadsheets.
Compliance Score
A single 0–100 score across controls, BAAs, training, and open alerts. One number that tells you where you stand.
See HIPAA Alert → Run the free audit first
$99
/mo · Starter
$249
/mo · Pro
Custom
Enterprise
All plans include HIPAA-Compliant infrastructure · Built by a practicing physician
§ 7  ·  The Platform

The EHR built against these failure modes.

AscentShield™ is the operating expression of every principle on this page. A behavioral-health EHR architected from the substrate up to satisfy 45 CFR § 164 by construction — not by attestation. EPCS-live, PDMP-integrated, BAA-enforced, and built by a practicing physician who runs it in his own clinic before shipping it to anyone else's.

ASCENTSHIELD
HIPAA-Native EHR Platform
  • LIVEAppend-only audit ledger streamed to BigQuery sink outside the application trust domain
  • LIVEEnvelope encryption with separate-domain KMS key administration (CMEK)
  • LIVEBAA-enforced technical gates — no module touches PHI without verified downstream BAA
  • LIVEEPCS-compliant prescribing under 21 CFR § 1311 with dual-factor signing ceremony
  • LIVEPDMP integration (Bamboo Health primary, NaMPDS fallback) with full query audit
  • LIVEDefault-deny RBAC; every ePHI read records the clinical justification
  • LIVECloud Armor WAF with HIPAA-tuned rule set on every public surface
  • LIVETabletop-tested 60-day breach response with measurable detection windows
§ 8  ·  The Library

A working compliance reference — written by people who ship.

Briefs, primers, and field-tested templates for the architectural questions HIPAA actually asks. Maintained, dated, and revised when the rules change.

Brief · 12 min read

The Business Associate Agreement, Read Literally.

What § 164.504(e) actually requires, what most BAA templates omit, and how to write one a regulator cannot pick apart.

Read brief →
Primer · 18 min read

Risk Analysis as Continuous Practice.

Why annual risk assessment is non-compliant by construction, and the cadence the Security Rule actually expects.

Read primer →
Reference · Living document

The 45 CFR § 164 Controls Map.

Every administrative, physical, and technical safeguard mapped to concrete cloud-native implementations. Updated as regulations evolve.

Open reference →
Brief · 9 min read

The Breach Notification Clock.

How discovery is defined under § 164.404, why monitoring posture determines liability, and the 60-day pathway in operational detail.

Read brief →
Field guide · 22 min read

Encryption That Actually Satisfies § 164.312(a)(2)(iv).

Envelope encryption, KMS trust domains, key rotation, and the questions an OCR auditor will ask about your architecture.

Read guide →
Template · Editable

The Tabletop Breach Drill.

A scenario-driven exercise to measure your real detection-to-notification window before HHS-OCR measures it for you.

Download template →
§ 9  ·  The Self-Audit

12 questions. One report.

Run yourself through the audit before OCR runs you through theirs. Twelve questions calibrated against the 45 CFR § 164 controls map, scored against the four most-cited failure modes. Email-delivered written report, signed by a practicing physician on AscentShield letterhead. No sales calls.

Audit your stack before the regulator does.

Twelve questions, ~6 minutes. Confidential. We deliver a written compliance posture report within two business days.

By submitting, you consent to receive your compliance report by email. We do not sell, share, or transfer your information. HIPAA Compliant handling — no PHI is collected on this form. See our privacy posture in Pattern 02 (PHI-Zero).

Audit request received.

You'll get your written compliance posture report by email within two business days. Report is signed by a practicing physician on AscentShield™ letterhead. Check your inbox.

§ 10  ·  The Live Ledger

Settlements in real time.

The HHS-OCR Resolution Portal is a public record of every HIPAA settlement. We track it live. The ledger below updates as settlements clear. The countdown tracks the rolling OCR risk-based audit cycle. The wire scrolls the most recent published resolutions.

HIPAA Settlement Ledger · HHS-OCR Resolution Portal
Source · hhs.gov/ocr · Updated daily
Total HIPAA Settlements
$0
2024 – 2026 YTD
Loading live feed…
Next OCR Audit Cycle
47
Days · Risk-Based Screening
Live Breach Wire · Recent Resolutions
Anthem Inc. · $16,000,000 · § 164.308(a)(1) Risk Analysis Premera Blue Cross · $6,850,000 · § 164.502 Disclosure Excellus BCBS · $5,100,000 · § 164.312 Technical Safeguards NewYork-Presbyterian · $4,800,000 · § 164.502(a) Authorization Memorial Hermann · $2,400,000 · § 164.502 Disclosure Banner Health · $1,250,000 · § 164.308(a)(1)(ii)(D) Activity Review Anthem Inc. · $16,000,000 · § 164.308(a)(1) Risk Analysis Premera Blue Cross · $6,850,000 · § 164.502 Disclosure Excellus BCBS · $5,100,000 · § 164.312 Technical Safeguards NewYork-Presbyterian · $4,800,000 · § 164.502(a) Authorization Memorial Hermann · $2,400,000 · § 164.502 Disclosure Banner Health · $1,250,000 · § 164.308(a)(1)(ii)(D) Activity Review

Audit yourself before OCR audits you.

A no-obligation architectural review of your current EHR, integration layer, and BAA inventory against the 45 CFR § 164 controls map. Conducted by the team behind AscentShield™. Confidential, written deliverable, two-week turnaround.