HIPAA compliance

How Aikyam Identity Platform supports HIPAA compliance

• Role-based and permission-based enforcement for administrative operations, so that actions affecting identity and access can be controlled by authorized personas.
• Administrative logging and audit trails to support investigations and compliance reporting by tracking user and administrator activity and access changes.
• Security controls during onboarding and authentication, including identity verification and layered safeguards to reduce unauthorized access risks.

Understanding HIPAA regulations

1. HIPAA Privacy Rule: The HIPAA Privacy Rule sets national standards for patients’ rights to PHI. The HIPAA Privacy Rule only applies to covered entities, not business associates.
2. HIPAA Security Rule: The HIPAA Security Rule sets national standards for the secure maintenance, transmission, and handling of ePHI. The HIPAA Security Rule applies to both covered entities and business associates because of the potential sharing of ePHI. The Security Rule outlines standards for the integrity and safety of ePHI, including physical, administrative, and technical safeguards that must be in place in any healthcare organization.
3. HIPAA Breach Notification Rule: The HIPAA Breach Notification Rule is a set of standards that covered entities and business associates must follow in the event of a data breach containing PHI or ePHI.
4. HIPAA Omnibus Rule: The HIPAA Omnibus Rule is an addendum to HIPAA regulation that was enacted to apply HIPAA to business associates, in addition to covered entities.

How HIPAA compliance is reinforced in Aikyam Identity Platform

1. Registration and onboarding: Registration workflows are secured using layered controls and identity verification to help prevent unauthorized access at account creation time. Aikyam Identity Platform documentation also describes the use of identity verification tooling during registration workflows to reduce fraud and protect accounts that may later access sensitive healthcare resources.
2. Authentication and account recovery: Authentication and recovery are treated as high-risk points in the user journey. Aikyam Identity Platform documentation positions multi-layered controls (e.g., MFA-related processes, session controls) and risk-aware checks as part of protecting accounts from takeover.
3. Authorization and administrative actions: HIPAA expectations strongly depend on ensuring the "right people have the right access." Aikyam Identity Platform documentation includes role-driven administration, access governance concepts, and activity monitoring/audit logs to support traceability of access changes.
4. Monitoring and auditability: Audit visibility is a core part of compliance readiness. Aikyam Identity Platform documentation includes monitoring and audit access activity as part of the security story, supporting reviews and evidence collection when needed.

Healthcare context and Optum implementation

• Encrypting PHI and ePHI during storage and transmission.
• Implementing multi-layered security controls including access management, audit logging, and intrusion detection.
• Using identity verification tools like Aikyam Identity Console and TMX to prevent unauthorized access during registration workflows.
• Conducting regular risk assessments and compliance audits to maintain HIPAA standards.
• Training employees on HIPAA policies and breach response procedures.