Your PM was probably referencing the fact there is no audit requirement — HIPAA is self attestation. HIPAA compliance can be boiled down to “implement best sec

Your PM was probably referencing the fact there is no audit requirement — HIPAA is self attestation. HIPAA compliance can be boiled down to “implement best security practices, record every request & transaction, and enforce zero trust to the truest exist possible.” Once you've done your due diligence with this, you can self attest compliance.