HIPAA Readiness Accelerator

The whole of HIPAA, in one workbook. Most HIPAA products cover one rule or one programme. This covers the obligation end to end — the Privacy Rule, Breach Notification, and all three safeguard sets — and then the parts of a modern healthcare estate that the rules reach but generic templates never model: connected medical devices, telemedicine, clinical AI, biometric PHI and paediatric data.

23 tabs, the largest product in the catalogue.

Entity Classification — covered entity, business associate or hybrid entity, determined rather than assumed. Everything downstream scopes from this.

Administrative (§164.308), Physical (§164.310) and Technical Safeguards (§164.312) — the full current safeguard set, each control with its status and evidence.

Privacy Rule Controls (§164.500–534) and Breach Notification (§164.400–414) — the complete notification matrix: HHS, individual, media and the state-law overlay, against the 60-day HHS deadline.

IoMT / Medical Device Risk Register — roughly 7M connected devices by 2026, double 2021, and 53% carry a known vulnerability. Pre-seeded device categories with KEV exposure tracking.

Telemedicine & Remote Care — platform security, consent documentation and cross-state licensing exposure.

AI / Clinical Decision Support — algorithmic bias documentation, FDA SaMD classification and the EU AI Act overlap.

Biometric PHI, Digital Twin & Advanced Tech, and Paediatric & Children's Health with its COPPA and state-minor-privacy overlay — the specialist registers that exist nowhere else in the catalogue.

BAA Tracker pre-seeded with 8 common business-associate categories, plus Evidence Tracker, Risk Register, Incident & Breach Log, Training Tracker, Common Findings Prevention built from OCR's audit focus areas, and an Executive Dashboard.

Why it matters now, on the current rule. The healthcare breach average reached $10M in 2026, up from $7.42M. 31% of all ransomware attacks hit healthcare, 96% of them involve data exfiltration, and 93% of US healthcare organisations experienced at least one attack. 2025 OCR fines exceeded $6.6M with individual penalties up to $3M — and OCR's recurring findings are risk analysis, asset inventory and access control, all of which live in this workbook.

On the proposed Security Rule. The Security Rule NPRM published 6 January 2025 would end "addressable" and make twelve safeguards mandatory. It has not been finalised — OMB's current target for final action is July 2027 — so nothing here is presented as binding. The 2026 Final Rule Readiness tab maps those proposed requirements against your current state with auto-scored status, which is exactly the right use of a proposal: a gap list you can work now, on the safe assumption that most of it lands.

If preparing for that rule is the job — the crosswalk with NPRM citations, the asset inventory in its prescribed fields, the 72-hour restoration plan, the annual audit workplan and the business-associate verification pack — that is a different and more specific product: the HIPAA Security Rule 2027 Readiness Kit. This workbook is the programme; that kit is the change.

The Ecosystem Map tab integrates the five compliancehub properties: devicerisk.compliancehub.wiki, digitaltwin.compliancehub.wiki, biometric.myprivacy.blog, childrenprivacylaws.com and compliancehub.wiki.

Pairs with the HIPAA Compliance Checklist as a starting point, and I've Been Breached for the incident itself.