> There's actually, I think, more than most people think, its just as lot less in the way of unambiguous, blanket, technical requirements that a product can che

> There's actually, I think, more than most people think, its just as lot less in the way of unambiguous, blanket, technical requirements that a product can check off. (Which means that saying that a technical component in isolation is "HIPAA Compliant" means almost nothing, and particularly does not mean that it is practically usable by any particular HIPAA covered entity while maintaining their compliance with HIPAA.) More often than not I see people think the HIPAA regulations are in fact some gargantuan list of checkboxes and red tape like PCI. So, no, I think generally speaking following HIPAA regulations is far easier than most think. > Complying with the HIPAA Security Rule is insufficient for HIPAA compliance, however, especially when building a system that you want a HIPAA covered entity to use while maintaining their compliance. No, but when it comes to developing software in a covered entity or business associate it's the one people make such a big deal out of and I see the most misinformation on. > Particularly, in addition to the security rule itself, one needs to also considered the Breach Notification Rule (45 CFR Part 164 Subpart D) and the related guidance on encryption methods [0]. Absolutely. But while this in particular ties into the security rule due to the definition of "Unsecured personal health information", it's hardly difficult or shocking. > Also, to the extent you are building something which generates or processes electronic transactions used in health care (or works with components of electronic transactions) for which standards exists, the Transactions and Code Sets rule (45 CFR Part 162 Subpart I & J) and the associated rules for specific identifiers and transactions (so, potentially, all of 45 CFR Part 162) become relevant, including all the separately published standards incorporated by reference, and all the additional standards incorporated by reference in those standards. Maybe it's just because I've worked in healthcare for nearly 7 years, but there's just nothing shocking about NPI, CPT, ICD, and other relevant identifiers. Thanks to the HIPAA mandate they are industry standard, so if you're dealing with anything that uses these identifiers you will learn pretty quick (speaking from experience here, but I also work for a medical billing firm so I get an extreme amount of exposure as getting claims and bills out the door is our entire purpose).