HIPAA Module

Who this is for

Covered entities and business associates that use AI anywhere near protected health information. That includes clinical decision support, ambient documentation, patient-facing chat, claims and revenue-cycle automation, and any vendor tool that touches ePHI. Enable the module from organization settings; it activates the safeguard register, BAA tracking, and PHI mapping across the platform.

Security Rule safeguards

Administrative

Security management process, assigned security responsibility, workforce security, information access management, security awareness and training, incident procedures, contingency planning, evaluation, and business associate contracts.

Physical

Facility access controls, workstation use and security, and device and media controls.

Technical

Access control, audit controls, integrity, person or entity authentication, and transmission security.

Required versus addressable

HIPAA distinguishes required implementation specifications from addressable ones. RAIC preserves that distinction. Required specifications must be implemented and evidenced. Addressable specifications must be assessed: implement them, implement an equivalent alternative, or document why neither is reasonable and appropriate. Marking an addressable specification as not implemented without a written rationale leaves it flagged as a gap.

Business Associate Agreements

• BAA record per supplier, linked to the Suppliers register so one vendor entry serves both HIPAA and ISO 42001 A.10.3.
• Execution date, expiry, and renewal cadence with overdue alerting.
• Executed agreement stored as evidence against the supplier.
• Subcontractor visibility, so downstream processors handling ePHI are recorded rather than assumed.
• AI systems sourced from a supplier without a current BAA are flagged on the system record.

PHI data mapping

The module extends the Dataset Registry with a PHI classification. Mark a dataset as containing PHI or ePHI and it inherits stricter handling expectations: minimum-necessary review, retention limits, de-identification status, and transmission controls. Data lineage then shows every AI system and use case downstream of that dataset, which is how you answer the question of exactly where PHI has flowed.

Evidence, audit, and reporting

• Per-safeguard evidence uploads with server-enforced uploader identity.
• Risk analysis linkage: Security Rule risk analysis obligations map to Risk Register entries rather than a separate document.
• Branded DOCX HIPAA Security Rule assessment report and CSV export with RhindonCyber_ filename prefixes.
• Crosswalk to SOC 2 Trust Services and NIST CSF 2.0, so shared controls are evidenced once.
• Every safeguard status change and BAA action writes an org-scoped audit entry mirrored to the platform audit log.

Scope note

RAIC supports Security Rule work and BAA lifecycle tracking. Privacy Rule obligations such as notices of privacy practices and individual rights requests are recorded as documented information rather than managed as a workflow. Breach notification decisions remain a legal determination — record the outcome and its rationale in the incident record.