What HIPAA compliance means for a Dispur team
- Instrument45 CFR Parts 160, 162 and 164
- CertificationNone recognised by HHS; evidence is what counts
- RetentionSix years, under 45 CFR 164.316(b)(2)
- Top penalty tierUp to $2,190,294, from 28 January 2026
For a team in Dispur, the practical shape of HIPAA is narrower than the literature suggests. You are rarely making privacy policy decisions: the covered entity decides what may be done with the data and writes it into the agreement. Your part is more testable. Can you show which systems hold protected health information? Can you produce a current risk analysis? Can you evidence that access is limited, logged and removed the day someone leaves? Can you notify inside the clock you signed?
That testability is why HIPAA work looks like security work with a paper trail attached. Almost every remediation item is something a competent engineering team half-does already, and the gap that fails an audit is usually the documentation of it rather than the control itself.
Evidence pack What the programme produces
Each deliverable answers a specific question a covered entity asks during due diligence, and each one is asked for by name.
- Role determination and a data flow map of every PHI location
- The risk analysis and a dated risk management plan
- Safeguard gap closure across 164.308, 164.310 and 164.312
- BAA review and subcontractor agreements down the chain
- Policies, procedures and a six year retention schedule
- Training records and a breach drill against your contractual clock
On the phrase "HIPAA certified"
It has no legal meaning, in Dispur or anywhere else. HHS does not certify, endorse or accredit any organisation, product or consultant as HIPAA compliant, and no certificate protects you in an investigation. Vendors do sell HIPAA seals, and covered entities have learned to ignore them. What a client accepts is a current risk analysis, documented safeguards, signed BAAs, training records and a tested breach procedure, often alongside a SOC 2 report mapped to the HIPAA rules.
The business associate agreement is the real standard
The regulation sets a floor. Your BAA usually sets something stricter, and it is the document a client will hold your Dispur team to first.
| Required term | What it says | What to check before signing |
|---|---|---|
| Permitted uses and disclosures | You may use protected health information only as the agreement and the rules allow | Whether product improvement, analytics or model training is actually permitted |
| Appropriate safeguards | You will use safeguards to prevent impermissible use or disclosure | That the safeguards named are ones you operate today, not aspirations |
| Reporting | You will report security incidents and breaches to the covered entity | The clock: 24 or 48 hours is common in contracts, against 60 days in the rule |
| Subcontractors | Subcontractors must agree to the same restrictions and conditions | Whether prior written approval is needed for each vendor you add |
| Access, amendment and accounting | You will help the covered entity meet individual rights requests | Your internal timeline for producing records, and who owns it |
| Availability to HHS | You will make records available to the Secretary for compliance review | That your documentation is organised enough to hand over |
| Return or destruction | At termination you will return or destroy protected health information | Whether backups and logs can actually be purged, and by when |
| Termination for breach | The covered entity may terminate for material breach | What counts as material, and whether cure periods exist |
Check the arithmetic in your contract chain
If your client requires breach notice within 24 hours of discovery, every subcontractor between you and the data has to be contractually faster, and detection in Dispur has to be faster still, across the time difference with a US client. Chains signed one at a time, without anyone adding up the clocks, are the most common reason a notification lands late, and lateness is what turns an incident into a contract problem.
The three families of Security Rule safeguards
Administrative at 45 CFR 164.308, physical at 164.310, technical at 164.312. Specifications are either required or addressable, and addressable never means optional.
| Safeguard | Rule | What it means in practice |
|---|---|---|
| Security management process | 164.308(a)(1) | Risk analysis, risk management, sanction policy and information system activity review |
| Assigned security responsibility | 164.308(a)(2) | A named security official accountable for policies and procedures |
| Workforce security | 164.308(a)(3) | Authorisation, clearance and termination procedures, evidenced per joiner and leaver |
| Information access management | 164.308(a)(4) | Role-based access to protected health information, reviewed periodically |
| Security awareness and training | 164.308(a)(5) | Reminders, malware protection, log-in monitoring and password management, with records |
| Security incident procedures | 164.308(a)(6) | Identify, respond, mitigate and document, with an escalation path to the client |
| Contingency plan | 164.308(a)(7) | Backup, disaster recovery, emergency mode operation and testing of the plan |
| Facility access controls | 164.310(a) | Access to the Dispur floor, visitor handling and records of entry to restricted areas |
| Workstation and device controls | 164.310(b) to (d) | Clean desk, screen locks, print and USB rules, secure disposal or re-use of media |
| Access control | 164.312(a) | Unique user IDs, emergency access, automatic logoff, encryption and decryption |
| Audit controls | 164.312(b) | Logs of activity in systems holding protected health information, and review of them |
| Integrity and authentication | 164.312(c) and (d) | Protection against improper alteration, and verification of who is accessing data |
| Transmission security | 164.312(e) | Integrity controls and encryption for protected health information in transit |
| Documentation and retention | 164.316 | Written policies and records kept for six years from creation or last effective date |
The addressable and required distinction confuses more teams than any other part of the rule. A required specification must be implemented. An addressable one must be implemented where reasonable and appropriate, and where it is not, you document why and what equivalent measure you used. Encryption is addressable, which some read as optional. In practice it is expected, it is what your client's questionnaire asks about, and it underpins the safe harbour for information that is not left unsecured.
The risk analysis is the whole programme in miniature
Required by 45 CFR 164.308(a)(1)(ii)(A), the most frequently cited failure in enforcement, and the first document a client or a regulator asks to see.
Complete scope
Every location of electronic protected health information across the Dispur operation, including backups, logs, test data, ticket queues and endpoints.
Real threats and vulnerabilities
Identified against how your systems are actually built and operated, with likelihood and impact assessed rather than asserted.
Current controls, honestly stated
What is genuinely in place today, so the residual risk left over is what your risk management plan addresses.
Kept current
Refreshed annually and whenever a product, hosting region, subcontractor or office in Assam changes the picture. Stale is treated as absent.
What a weak risk analysis looks like
A spreadsheet of generic threats with no reference to your systems, no likelihood or impact reasoning, no owner, no dates, and a scope that quietly excludes the environments where the interesting data sits. It reads as complete until someone asks how the test database copied from production in March was assessed. That question has ended more vendor relationships than any technical finding.
How a Dispur business associate becomes HIPAA compliant
Ten steps in dependency order. A company of up to about 200 people with a normal cloud stack completes this in 6 to 10 weeks.
Establish your role and read the BAA
Decide whether you are a business associate or a subcontractor, then read the agreement already signed. Its breach clock, permitted uses, subcontractor rules, audit rights and termination triggers set the standard you are actually held to.
Map where protected health information flows
Inventory every system, integration, vendor, ticket queue and workstation in Dispur that touches protected health information, including support tools, logs, analytics, backups and test environments. Production data copied into test is the most commonly missed location.
Run the risk analysis
Complete the assessment required by 45 CFR 164.308(a)(1)(ii)(A) across all electronic protected health information: threats, vulnerabilities, likelihood, impact and current controls. This is the most cited failure in enforcement, so it must be real, current and complete.
Close administrative safeguard gaps
Workforce clearance and termination procedures, role-based authorisation, security awareness training, sanction policy, incident procedures, contingency planning with backup and recovery, and periodic evaluation under 45 CFR 164.308, each evidenced.
Close physical safeguard gaps on the floor
Facility access controls for the Dispur premises, visitor handling, workstation use rules, and device and media controls for disposal, re-use and movement under 45 CFR 164.310. Clean-desk, print, USB and camera rules become concrete here.
Close technical safeguard gaps
Unique user identification, emergency access, automatic logoff, encryption and decryption, audit controls, integrity controls and transmission security under 45 CFR 164.312. Encryption is addressable, not optional: implement it or document the equivalent.
Fix the contract chain
Put the required terms in place with the covered entity and mirror them to every subcontractor touching protected health information, including cloud, support and analytics vendors. Subcontractor clocks must be faster than the clock you promised your client.
Write policies, procedures and retention rules
Produce the policy set the rules expect and design retention so documents, risk analyses, training logs and incident records survive the six years required by 45 CFR 164.316(b)(2). Default tooling deletes long before six years.
Train the workforce and record it
Deliver security awareness and training under 45 CFR 164.308(a)(5) plus Privacy Rule training on your policies to every workforce member with access in Dispur, and keep completion records, including for joiners between cycles.
Drill the breach process, then keep it current
Rehearse the four factor breach risk assessment and the notification chain against your contractual clock, allowing for the time difference with a US client. Then refresh the risk analysis annually and on every material change.
Find out what your BAA commits your Dispur team to
Send us the agreement. Our healthcare compliance experts will map its obligations against what you operate today and give you a prioritised gap list before a client audit does it for you.
The breach clocks and who starts them
Breach duties run in a chain: you tell your client, your client tells individuals and HHS. Every link has a deadline, and yours is usually shorter in the contract than in the rule.
| Event | Who acts | Deadline | Rule |
|---|---|---|---|
| Business associate discovers a breach | You notify the covered entity | Without unreasonable delay, no later than 60 days from discovery | 45 CFR 164.410 |
| Breach clock written into your BAA | You notify the covered entity | Commonly 24 to 48 hours, whichever the contract states | Contractual, and stricter than the rule |
| Covered entity confirms a breach | Covered entity tells affected individuals | Without unreasonable delay, no later than 60 days from discovery | 45 CFR 164.404 |
| Breach affecting 500 or more individuals | Covered entity tells HHS | Within 60 days of discovery | 45 CFR 164.408(b) |
| Breach affecting fewer than 500 | Covered entity logs and reports annually | Within 60 days after the end of the calendar year | 45 CFR 164.408(c) |
| Breach affecting 500 or more in a state or jurisdiction | Covered entity notifies prominent media | Without unreasonable delay, no later than 60 days | 45 CFR 164.406 |
| Specified cyber incident on Indian infrastructure | Your Indian entity reports to CERT-In | 6 hours of noticing | CERT-In directions of 28 April 2022 |
The presumption you have to rebut
An impermissible use or disclosure is presumed to be a breach unless you demonstrate a low probability that protected health information was compromised, using the four factor assessment: the nature and extent of the information, the unauthorised person who used or received it, whether it was actually acquired or viewed, and the extent to which risk has been mitigated. Document that assessment every time, including when the conclusion is that no notification is required.
What non-compliance costs
Four tiers of civil money penalty by culpability, adjusted for inflation each year, plus the commercial consequences that reach a vendor first.
| Tier | Culpability | Penalty range per violation, from 28 January 2026 |
|---|---|---|
| Tier 1 | The entity did not know and could not reasonably have known | $145 to $73,011 |
| Tier 2 | Reasonable cause, not wilful neglect | $1,461 to $73,011 |
| Tier 3 | Wilful neglect, corrected within 30 days | $14,602 to $73,011 |
| Tier 4 | Wilful neglect, not corrected | $73,011 to $2,190,294 |
| Annual cap | For identical violations in a calendar year | $2,190,294 |
Penalty amounts move each year under the federal inflation adjustment legislation while the tier structure stays put. For a business associate in Dispur, though, the number that actually bites is rarely a federal penalty. It is the indemnity clause in the BAA, the termination right that triggers on material breach, and the due diligence failure that quietly removes you from a shortlist. Those arrive faster, and cost more contracts, than any enforcement action.
What survives a client audit, and what does not
Drawn from what covered entities and their auditors ask for when they examine an offshore business associate in detail.
Survives due diligence
- A risk analysis dated within the last year that names your actual systems and hosting regions
- Access provisioning and removal evidenced per person, with leaver revocation on the same day
- Audit logs that are not only collected but demonstrably reviewed, with the review recorded
- BAAs with every subcontractor, and clocks faster than the one you promised your client
- A contingency plan that has been tested, with the test recorded and the gaps closed
- Physical controls on the Dispur floor that are evidenced, not just written into a policy
- Retention designed for six years, covering policies, training, incidents and risk records
Fails on the first question
- A risk analysis inherited from a template, describing infrastructure you never ran
- Access granted broadly because role-based control was too much work to set up
- Test environments holding production data that nobody included in scope
- Encryption described as optional because the specification is labelled addressable
- A subcontractor added mid-contract with no BAA and no security review
- Training completed by most of the team, with no record of who was missed
- A breach discovered on a Friday evening in Dispur, with nobody named to declare it
HIPAA terms, defined
The vocabulary that appears in business associate agreements and client questionnaires, in the sense the rules give it.
- Protected health information
- Individually identifiable health information held or transmitted in any form by a covered entity or business associate, including identifiers such as names, dates, contact details and account numbers when linked to health information.
- Covered entity
- A health plan, healthcare clearinghouse, or healthcare provider that transmits health information electronically in connection with a covered transaction.
- Business associate
- A person or organisation that creates, receives, maintains or transmits protected health information to perform a function for a covered entity, which is the usual status of a healthcare services company in Dispur.
- Addressable specification
- A Security Rule requirement that must be implemented where reasonable and appropriate, or otherwise documented with an equivalent alternative. Never a licence to skip the control silently.
- Unsecured protected health information
- Information not rendered unusable, unreadable or indecipherable through encryption or destruction to the standards HHS specifies. Only unsecured information triggers breach notification.
- Minimum necessary
- The rule at 45 CFR 164.502(b) limiting uses, disclosures and requests to the minimum needed for the purpose. In a delivery centre it is an access design requirement rather than a policy statement.
- De-identification
- Removing identifiers so information is no longer protected health information, either through the safe harbour list of eighteen identifiers or through an expert determination of very small re-identification risk.
- Security incident
- The attempted or successful unauthorised access, use, disclosure, modification or destruction of information, or interference with system operations. Broader than a breach, and reportable on the terms your BAA sets.
HIPAA guides and resources
Deeper reading on HIPAA as it lands on Indian healthtech and BPO teams, the security certifications covered entities accept as evidence, and the Indian privacy framework that applies alongside them.
FAQs about HIPAA compliance in Dispur
35 questions taken from real search queries, covered entity due diligence checklists, HHS guidance and the rules themselves.
Start with the agreement you already signed
Our healthcare compliance experts read your BAA, map its obligations against what your Dispur team operates today, run the risk analysis the Security Rule requires, and give you a scoped plan your covered entity clients will recognise.
Nebin Binoy 
