HIPAA · Security, Breach & Privacy

HIPAA governs how covered entities and business associates protect Protected Health Information (PHI). Its Security Rule safeguards are what most technology vendors need to demonstrate.

92

requirements tracked

Core plans

Access

Add-on from $29/mo

Start free with HIPAA See pricing

Scope

How much of the standard Keel models

Models its declared scope in full

Keel authors every leaf requirement in the scope declared below — all 92 of them, with nothing inside that scope left out. A test fails the build if the authored count and the declared count ever diverge, so this framework cannot quietly lose requirements after the fact.

Authored in Keel: 92 requirements
In Keel’s scored scope: 92 leaf requirements

Checked against

45 CFR Part 164, Subparts C (Security), D (Breach Notification) and the duty-imposing sections of E (164.520-164.530), counted leaf by leaf from the eCFR XML of Part 164 (version 2026-08-01): 48 leaves in Subpart C, 12 in Subpart D and 32 in Subpart E. Two classes of paragraph are deliberately outside that count, and the distinction between them is the part worth reading. First, the permitted-use and disclosure provisions 164.502, .506, .508, .509, .510, .512 and .514 are FREESTANDING permissions: each authorises a use or disclosure a covered entity is free never to make, and an entity that never makes it owes nothing under the provision, so there is no duty for a workspace to implement and scoring one would load every readiness denominator with an item it cannot satisfy. "It says may" is NOT the test, and stating it that way was wrong: 164.520(d) (joint notice), 164.522(a)(2) (terminating a restriction) and 164.522(b)(2) (conditions on confidential communications) also say "may" and ARE scored here, because each is a permission attached to a duty the entity already holds - it sets the terms on which the notice duty, an agreed restriction, or the accommodation duty may be discharged or released, and an entity holding the underlying duty must operate inside those terms. Second, applicability paragraphs - which state only to whom the section’s other provisions apply - are not requirements: 164.520(a)(3) (group health plans), 164.520(a)(4) (inmates) and 164.530(k) (group health plans) redirect who is bound rather than adding a duty, so there is nothing to implement, mark or evidence against them. 164.530(k) was ruled out of scope on 2026-08-17 on that basis, which is what moved this count from 93 to 92. None of this claims the excluded provisions do not apply: a covered entity is bound by all of Part 164, and Keel scores the part that is implementable rather than pretending to measure the rest.

Keel publishes this for every framework it ships, complete or not, so a readiness percentage can be read against a denominator you can see. Compare every framework

Who it is for

Who needs HIPAA?

Health-tech companies and any business associate handling PHI
Vendors asked to sign a Business Associate Agreement (BAA)
Teams needing administrative, physical, and technical safeguards in place

What Keel does

How Keel helps with HIPAA

The HIPAA Security Rule safeguards as a control set you can implement and evidence
Crosswalk to SOC 2 and ISO 27001 so overlapping controls count once
Readiness tracking so you can answer a BAA request with confidence

Collect once, comply everywhere

HIPAA shares canonical controls with ISO/IEC 27001, NIST SP 800-53 and SOC 2 and others in the catalog. Implement one of those controls and it counts toward every framework it satisfies, so adding HIPAA rarely means starting from scratch.

Shares canonical controls with

ISO/IEC 27001
CIS Critical Security Controls
PCI DSS
SOC 2
SOX (Sarbanes-Oxley) Section 404
NIST Cybersecurity Framework
NIST SP 800-53
NIST SP 800-171
GDPR
COPPA
Google Play Families
Amazon Appstore Child-Directed Apps
Apple App Store Kids Category
ISO 9001
AI Governance Essentials
ISO/IEC 42001
NIST AI Risk Management Framework
EU AI Act
ESG Essentials
US Employment Law - Federal Baseline

Features that help with HIPAA: Policy management · Controls & crosswalk · Security awareness training

Other frameworks: ISO/IEC 27001 · CIS Critical Security Controls · PCI DSS · SOC 2 · SOX (Sarbanes-Oxley) Section 404 · NIST Cybersecurity Framework · All frameworks