HIPAA: controles y responsabilidades
Conozca obligaciones, controles técnicos y responsabilidades organizativas.
HIPAA: controles y responsabilidades · En vigor
Esta página explica controles AI-FW sin reemplazar las responsabilidades de cumplimiento o auditoría.
Dónde encaja AI-FW
- Nota: The gateway can inspect prompts/responses, apply configured health-data rules, associate calls with identities and restrict model destinations. It does not make an organisation compliant by itself.
Lo que el producto no hace
- Nota: Determining covered-entity or business-associate status.
- Nota: Signing a Business Associate Agreement.
- Nota: Defining all administrative, physical and technical safeguards.
- Nota: Classifying all health information or replacing risk analysis.
- Nota: Guaranteeing each workflow complies with HIPAA.
Controles relacionados
- Nota: Access: Nota: Limit access to authorised users and systems. AI-FW: Nota: Agent/user authentication and identity/role policies.
- Nota: Audit: Nota: Record and review activity in systems containing ePHI. AI-FW: Nota: Transaction and administrative logs, exportable by configuration.
- Nota: Integrity: Nota: Protect ePHI against unauthorised changes. AI-FW: Nota: Inspection policies and auditable configuration changes.
- Nota: Transmission: Nota: Protect ePHI over electronic networks. AI-FW: Nota: TLS on configured connections and gateway inspection.
Evidencias
- Nota: Identity configuration: Nota: Authentication methods and policies in use.
- Nota: Audit logs: Nota: Transactions, events and export destinations.
- Nota: Health-data rules: Nota: Enabled rules and actions.
Responsabilidades de la organización
- Nota: Determine applicability and ePHI use.
- Nota: Maintain risk analysis, policies and agreements.
- Nota: Approve providers and execute BAAs where required.
- Nota: Operate workforce, physical and technical safeguards.
- Nota: Validate detection for each workflow.
Preguntas frecuentes
Nota: Does AI-FW make a model provider HIPAA compliant?
Nota: No. The organisation evaluates provider authorisation for ePHI and required agreements.
Nota: Is Health Data Risk a compliance certification?
Nota: No. It is a heuristic signal for review.
Nota: Can audit evidence avoid full prompt storage?
Nota: Yes, depending on logging configuration and policy.
Información general, no es asesoramiento legal ni de auditoría.