Framework pack in trustlynce
HIPAA
HIPAA Security Rule (45 CFR Part 164, Subpart C)
The HIPAA Security Rule requires administrative, physical, and technical safeguards for ePHI. There is no official HIPAA certification; organizations document a risk analysis, implement safeguards, and sign business associate agreements (BAAs) with vendors that touch ePHI.
Applies to: US covered entities and their business associates that handle electronic protected health information (ePHI).
What to Know
- Technical safeguards are defined in 45 CFR 164.312: access control, audit controls, integrity, authentication, and transmission security.
- A documented, current risk analysis (164.308(a)(1)) is the most common gap in enforcement actions.
- Self-hosting keeps ePHI out of third-party AI and observability services entirely.
Controls Lionhouse Helps With
The engineering-owned controls where continuous evidence saves the most time. Policies, training, and physical controls are tracked in trustlynce too.
| Reference | Control | How Lionhouse helps | Products |
|---|---|---|---|
| 164.312(a)(1) | Access control | Single sign-on and roles apply across all four products; trustlynce runs periodic access reviews and keeps the evidence. | trustlynce |
| 164.312(b) | Audit controls | aiAxonIQ records and retains activity logs; MITHUNAI keeps a record of which sources each AI answer used. | aiAxonIQ, MITHUNAI |
| 164.308(b) | Business associate contracts | trustlynce tracks BAAs and data processing agreements as part of vendor risk management. | trustlynce |
| 164.308(a)(1)(ii)(A) | Risk analysis | trustlynce keeps the risk register and links each risk to its controls and evidence, so the analysis stays current. | trustlynce |
Lionhouse helps you prepare and maintain evidence. Your auditor or certification body makes the final determination.
Other Frameworks
Talk to an Architect
See the Four Products Running in Your Environment.
A technical session with a Lionhouse architect covering your stack, your deployment model, and a pilot plan.