Effivity HIPAA guide: how the software runs your compliance programme and keeps its evidence

What HIPAA expects you to prove, and why the proof scatters

A hospital's vendor audit, a health plan's questionnaire and an Office for Civil Rights investigation all end in the same request: show us the risk analysis for the claims platform, the agreement with the hosting provider, the training record for last quarter's new agents, and the assessment behind the incident you judged not reportable.

Section 164.316 requires Security Rule policies and the actions they describe to be documented and kept for six years. The evaluation standard at 164.308(a)(8) calls for periodic review of whether safeguards still work. Under the Breach Notification Rule, the covered entity or business associate carries the burden of proving that notices went out or that no breach occurred. And OCR considers whether recognised security practices were in place over the previous twelve months, so a programme started the week before a review counts for little.

Usually the pieces exist but live apart: assets with IT, agreements with legal, training in an HR spreadsheet, incidents in a ticketing tool. Effivity, Sterling's ISO and GRC software, used in 50+ countries, holds them as one programme, each record owned, dated and linked to its decision. HIPAA prescribes no software; it needs proof that holds together.

Where each HIPAA rule runs in Effivity

Effivity has no module labelled HIPAA. Sterling configures its management system modules for the four rules and, where no module fits, builds a workflow with a form, an owner and reminders. The rules themselves are set out in HIPAA requirements explained, rule by rule; the table shows where the work is done and what it leaves behind.

Access reviews, activity log reviews, device disposal and patient or member requests passed on by a covered entity run as configured workflows. Dashboards show overdue risk treatments, unsigned agreements and incidents awaiting a breach decision.

Worked example: an agent account left open

The quarterly access review for a billing team shows that an agent who resigned still had an active remote login nine days later. The reviewer logs it in Incident Management, dating the record from discovery. IT disables the account; the privacy official records the four-factor assessment and, because the logs show no sign-in after the last working day, documents a low probability of compromise. The root cause, a leaver notice that went to HR but never reached IT, becomes a Non-Conformance with a corrective action linking the two steps, and the risk entry for that system is updated. A client auditor sampling leavers later finds the whole chain, dated and owned. The example is illustrative.

What Sterling sets up in the first weeks

Effivity is configured as the gap analysis begins, so the programme is built where it will run rather than moved there later.

• Status settled per contract. Whether you act as a covered entity, a business associate or a subcontractor of one decides which obligations apply to each service, so it is recorded before anything else.
• PHI traced with the people who handle it. Operations, IT and account teams walk through where PHI enters, where it is stored and where it leaves; each system found goes into Information Asset with an owner.
• The risk analysis built on that inventory. Every system holding ePHI is assessed in Risk Management, so the analysis cannot quietly skip one; The Security Rule risk analysis: how to conduct one covers the method.
• An agreement register from real contracts. Client agreements and vendor agreements are listed in Purchase, gaps are flagged and subcontractor flow-down is checked; see Business associate agreements: what to sign and what to issue.
• Documents sorted, not multiplied. Policies that match practice move into Documented Information with an owner; the rest are rewritten from Effivity's pre-built templates, adapted to your operation. HIPAA documentation: what you need and what you do not explains the set.

Answering customers, vendor auditors and OCR

With no HIPAA certification to show, the test arrives as a questionnaire before signature, a vendor audit or, less often, an OCR enquiry.

With the programme in Effivity, most of these become a report rather than a project. The agreement register shows which vendors hold the client's PHI, the incident log shows how each event was assessed and when, and training records show who was trained on what. The same evidence carries into a SOC 2 examination, a HITRUST assessment or ISO/IEC 27001 certification if you choose one; HIPAA vs SOC 2, HITRUST and ISO/IEC 27001 compares the routes.

Keeping the programme alive with Sustain™

HIPAA programmes erode quietly: a new analytics tool, a second delivery site, a vendor that starts storing call recordings, none of it reaching the risk analysis. Effivity counters this with review dates on every asset, risk and agreement and with escalating reminders; the internal audit and management review test whether those triggers worked.

Under Sustain™, Sterling continues with risk analysis updates as systems change, refresher training, breach drills, business associate reviews and preparation for the proposed Security Rule changes, all in the same system. The proposal leans heavily on recurring, documented activity at fixed intervals, which is exactly what review dates and reminders are for; The proposed Security Rule update, explained sets out its status.

Where Effivity stops

Effivity manages the programme; your PHI stays in the systems that process it. The software does not encrypt your databases, enforce multi-factor authentication or collect your logs. Those controls live in your own technology, whose configuration and logs remain the primary proof, while Effivity holds the decision, the owner, the review date and the confirmation. Decisions on addressable specifications remain your people's to make and explain.

Three habits undo a good configuration:

• Copying PHI into incident records. The log needs references, dates and decisions, not patient details or screenshots of records.
• Logging only reportable breaches. The low-probability decisions need their assessments too; they are what an auditor checks first.
• Agreements filed but never re-verified. A signed agreement shows intent, not that the vendor still protects the data.

Effivity HIPAA guide: questions buyers ask