What is the HIPAA Security Rule?

The HIPAA Security Rule establishes national standards to protect the confidentiality, integrity, and availability of electronic protected health information (ePHI) through administrative, physical, and technical safeguards.

What is considered a HIPAA violation in cybersecurity?

A HIPAA violation occurs when PHI or ePHI is impermissibly used or disclosed or insufficiently safeguarded. Common causes include weak access controls, missing risk analyses, unencrypted devices, improper workforce training, and delayed breach reporting.

What are administrative, physical, and technical safeguards?

Administrative safeguards are policies, procedures, and training. Physical safeguards protect facilities and devices. Technical safeguards include access controls, audit logging, transmission security, and encryption.

Is a HIPAA risk assessment required annually?

HIPAA requires a regular and thorough risk analysis but does not mandate a specific frequency. Many organizations perform it annually and whenever significant changes occur, such as new systems, vendors, or workflows.

What should a HIPAA risk assessment include?

It should identify where ePHI resides, evaluate threats and vulnerabilities, assess likelihood and impact, review current controls, document risk levels, and define prioritized remediation steps and timelines.

What is the role of encryption in HIPAA compliance?

Encryption is an addressable implementation specification. If reasonable and appropriate, it should be implemented for data at rest and in transit. If not implemented, the decision must be documented and an equivalent alternative safeguard applied.

What is a Business Associate under HIPAA?

A Business Associate is any person or organization, other than a workforce member of a covered entity, that creates, receives, maintains, or transmits PHI on behalf of a covered entity. Examples include cloud providers, IT support, billing services, and certain consultants. A Business Associate Agreement (BAA) is required before PHI access.

Do business associates need to be HIPAA compliant?

Yes. Business associates must implement appropriate safeguards for PHI, comply with applicable HIPAA requirements, enter into a BAA, report incidents and breaches, and ensure their subcontractors that handle PHI also comply.

What happens if a business associate causes a breach?

Both the covered entity and the business associate have obligations. The business associate must investigate, mitigate, and notify the covered entity. Breach notifications to individuals, HHS, and in some cases the media may be required based on the incident size and circumstances.

How do I secure remote access to ePHI?

Use VPN or zero-trust access, require multi-factor authentication, enforce least-privilege access, encrypt devices, manage endpoints and patches, disable local data storage when possible, and monitor logs for suspicious activity.

Can employees use personal devices under HIPAA?

Yes, if governed by a BYOD policy that enforces device encryption, screen locks, remote wipe, mobile device management, separation of work data, and prohibits storing ePHI in unsecured apps or locations.

What is considered a HIPAA data breach?

A breach is an impermissible use or disclosure of unsecured PHI that compromises its security or privacy, such as ransomware, lost or stolen devices, misdirected emails, or unauthorized access, unless a documented risk assessment shows a low probability of compromise.

How soon must a HIPAA breach be reported?

Affected individuals must be notified without unreasonable delay and no later than 60 days after discovery. Reporting to HHS depends on the number of affected individuals; large breaches (500 or more) require more immediate reporting and, in some cases, media notice.

What are the penalties for HIPAA violations?

HIPAA penalties vary by tier based on level of culpability, with per-violation amounts and annual caps per violation type. Enforcement may include corrective action plans, settlement amounts, and monitoring. Actual amounts depend on the facts and current HHS guidance.

Can my practice be audited for HIPAA compliance?

Yes. HHS’s Office for Civil Rights conducts audits and investigations, particularly after breaches or complaints. Maintaining documentation, training records, and current risk analyses helps demonstrate compliance readiness.

What documentation is required to prove HIPAA compliance?

Keep current risk analyses, remediation plans, security and privacy policies, workforce training logs, incident response procedures, business associate agreements, access audit logs, and evidence of ongoing monitoring and evaluations.

Does a SOC 2 Trust Center Replace Security Questionnaires?

Jul 2

Written By L Trotter II

A SOC 2 Trust Center does not replace security questionnaires. Enterprise buyers use Trust Centers as a starting point not a finish line. Even companies with SOC 2 Type 2 certifications and published Trust Centers still receive detailed questionnaires from large enterprise buyers who need to evaluate vendor risk against their specific requirements. What reduces questionnaire burden isn't a certification…it's a centralized response library, a security owner, and a compliance story that matches every document, answer, and call.

A CIO at a growth-stage health tech company asked me something on a discovery call last week.

"Once we have SOC 2 and a Trust Center, we won't have to fill out all these questionnaires anymore, right?"

He'd been through enterprise security reviews before.

Got through all of them without SOC 2.

Now he has an AI-forward platform.

Customers are asking for SOC 2.

He assumed the certification plus a Trust Center would shortcut the process.

It won't.

This is the most common misconception I hear from growth-stage companies pursuing SOC 2.

And it costs them time, budget, and deals when they find out the hard way.

What a Trust Center Actually Does

A Trust Center is a centralized repository of your security posture.

Policies. Certifications. Sub-processors. Penetration test summaries.

It's valuable.

It builds credibility.

Smaller buyers may accept it as sufficient.

Enterprise buyers won't.

Enterprise security teams evaluate one thing...

Whether your security posture fits their specific risk profile.

A Trust Center gives them a starting point.

The questionnaire is how they go deeper.

I worked with Johnson & Johnson's medical software division.

They had a Trust Center.

They still got pulled into live questionnaire calls with hospitals on a consistent basis — to clarify specifics, reconcile details, and prove that what was published matched what was actually in place.

A Trust Center doesn't replace the conversation.

It makes the conversation faster.

👉If you're fielding enterprise security questionnaires right now, the Security Review Playbook breaks down what buyers are actually evaluating and how to respond with confidence. Request it here.

Why AI Made This Worse

The CIO's instinct made sense two or three years ago.

AI changed the calculation.

Enterprise buyers are watching third-party vendor breaches accelerate.

AI is helping their procurement teams process questionnaire responses faster...which means they can go deeper, not less deep.

The volume of questionnaires isn't going down.

The depth of scrutiny is going up.

If your product uses AI...and his does...expect more questions specifically about:

Where customer data goes inside the model
Whether data is used for AI training
Who your AI sub-processors are
.How model drift is monitored

AI features expand the questionnaire.

A Trust Center doesn't answer those questions by default.

The SOC 2 Type 2 Truth

He also assumed SOC 2 Type 2 had a three-month observation period.

It doesn't.

The standard observation period is six months and most auditors are holding firm on that timeline.

Here's what that means in practice:

SOC 2 Type 1 tells buyers you had the right controls in place on a specific date.

SOC 2 Type 2 tells buyers your controls operated consistently over time.

Enterprise buyers want Type 2.

Which means the realistic timeline from "we decided to pursue SOC 2" to "enterprise buyers trust our certification" is 9–12 months for most growth-stage companies.

Not 3.

Not 6.

Plan accordingly.

What Actually Reduces Questionnaire Burden

The goal isn't to eliminate questionnaires.

It's to make them faster, more consistent, and less dependent on your CTO's time.

Three things that actually move the needle:

A centralized repository

Vetted, consistent answers to the most common questions your buyers ask.

Look for features that enable you to create a SLM of your previous security questionnaire responses that your team can pull from every time a new questionnaire comes in.

This stops reinventing answers across prospects and creates consistency across every deal.

A security owner (vCISO)

Someone whose job is to own the questionnaire process.

Not the CTO.

Not whoever has bandwidth this week.

A dedicated owner...even fractional... who responds consistently and knows your security posture inside out.

A compliance story that matches everywhere

What you say verbally needs to match your policies.

Your policies need to match your SOC 2 report.

Your SOC 2 report needs to match your questionnaire responses.

Enterprise buyers are now cross-referencing all three.

One inconsistency raises a flag.

A pattern of inconsistencies stops the deal.

👉 The Security Review Playbook breaks down what enterprise buyers score in every vendor review and how to build a compliance story that holds up under scrutiny. Request it here.

What This Means for Growth-Stage Tech Companies

If you're pursuing SOC 2 to eliminate questionnaire burden, reset your expectations now.

SOC 2 will make you more credible.

It won't make buyers stop asking questions.

The companies that move through enterprise reviews fastest aren't the ones with the most certifications.

They're the ones with the most consistent story across every document, answer, and call.

Build that first.

Your compliance report makes it more defensible.

👉 If you want to know exactly where your compliance program stands before your next enterprise review, the Security Review Playbook walks through what buyers evaluate and how to prepare. Request it here.

L Trotter II

As Founder and CEO of Inherent Security, Larry Trotter II is responsible for defining the mission and vision of the company, ensuring execution aligns with the business purpose. Larry has transformed Inherent Security from a consultancy to a cybersecurity company through partnerships and expert acquisitions. Today the company leverages its healthcare and government expertise to accelerate compliance operation for clients.

Larry has provided services for 12 years across the private industry developing security strategies and managing security operations for Fortune 500 companies and healthcare organizations. He is influential business leader who can demonstrate the value proposition of security and its direct link to customers.

Larry graduated from Old Dominion University with a bachelor’s degree in Business Administration with a focus on IT and Networking. Larry has accumulated certifications such as the CISM, ISO27001 Lead Implementer, GCIA and others. He serves on the Board of Directors for the MIT Enterprise Forum DC and Baltimore.

https://www.inherentsecurity.com