BY NEURABYTE
FRAMEWORKS/PRIVACY/HIPAA
HIPAA
PRIVACY · US Dept. of Health and Human Services

HIPAA

Safeguards for protected health information.

HIPAA's Security Rule requires administrative, physical, and technical safeguards for electronic protected health information (ePHI). There is no official HIPAA certification; covered entities and business associates self-assess and can be audited by the Office for Civil Rights. Business associate agreements extend obligations to vendors.

AT A GLANCE
ISSUERUS Dept. of Health and Human Services REGIONUnited States CATEGORYPrivacy CROSSWALKVersioned mapping onto the 15-control registry
EVIDENCE, NOT CERTIFICATION
01. WHO IT APPLIES TO

Is this one yours?

01Providers, payers, and clearinghouses
02Vendors handling ePHI as business associates
03AI systems that read or write clinical or claims data
02. KEY REQUIREMENTS

The parts of HIPAA that touch what agents do.

§164.312(a) Access control
Technical policies allow access only to persons or software programs granted rights.
§164.312(b) Audit controls
Mechanisms record and examine activity in systems containing ePHI.
§164.312(c) Integrity
ePHI is protected from improper alteration or destruction, and alterations can be detected.
§164.308(a)(4) Information access management
Access is authorized and established consistent with the minimum necessary standard.
03. HOW LORE MAPS TO IT

Enforcement controls, read against the requirement.

These controls exist because the platform needs them to run safely. The crosswalk reads their signed evidence against HIPAA. Where there is no evidence, the report says gap.

LORE CONTROL HIPAA REFERENCE
Blocking authorization gate§164.312(a)(1), §164.308(a)(4)
Signed, hash-chained receipts§164.312(b), §164.312(c)(2)
Context disclosure record§164.502(b) minimum necessary
Maker–checker approval§164.308(a)(3)
Illustrative references. The shipped crosswalk carries exact clause citations, its version, and the review date.
04. OUT OF SCOPE

What Lore will not claim.

Physical safeguards, workforce training, and the risk analysis are organizational.
Breach notification decisions are legal determinations.
05. QUESTIONS
Does an agent count as a user?
Under the Security Rule an agent is a software program granted access rights, which is why per-action authority and attribution matter.
Is the disclosure record useful here?
It is the minimum-necessary evidence: exactly which PHI fields reached which model, and under what policy.
← PREVIOUSGDPR ALL FRAMEWORKS NEXT →US state privacy
HIPAA · EARLY ACCESSEVIDENCE COLLECTED ONCE

Start building the record your auditor will read.

Every receipt Lore signs today is evidence for HIPAA tomorrow. Turn the crosswalk on when you are ready; nothing needs re-collecting.

Also from Neurabyte: Cupel
Lore's core mechanisms are patent-pending. Product names are trademarks of their respective owners; listing an integration doesn't imply a partnership.
© 2026 NEURABYTE INC.