{"head":{"title":"HIPAA for Software Teams: Rules and Controls | OceanLab","description":"What HIPAA means for software: who it covers, the Security Rule safeguards, BAAs, breach rules and the engineering controls behind them. Not legal advice.","canonical":"https://oceanlab.in/compliance/hipaa"},"slug":"hipaa","stats":{"builds":8,"industries":6,"countries":2},"featured":[{"meta":{"slug":"sutura","industry":"healthdata","projectType":"Patient data hub","country":"us","tags":["healthcare","enterprise"],"compliances":["HIPAA Privacy Rule","HIPAA Security Rule","42 CFR Part 2","21st Century Cures Act (information blocking)","HL7 v2","HL7 FHIR R4 and US Core","SMART on FHIR","HL7 DS4P security labels","TEFCA","CMS Conditions of Participation"],"cover":{"src":"/case-studies/sutura/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Sutura - HIPAA-Compliant Patient Data Hub over HL7 and FHIR","description":"Designed and built a clickable patient data hub for a US health system running Epic, Oracle Health, athenahealth and eClinicalWorks: a live monitor for every HL7 v2, FHIR and HIE feed, one matched enterprise patient with a provenance-tagged record, and a duplicates queue where a person decides every uncertain match.","category":"Health Data / Patient Data Hub","client":"Northfork Valley Health"}}},{"meta":{"slug":"loupe","industry":"clinics","projectType":"Specialty EHR","country":"us","tags":["healthcare","enterprise","ai"],"compliances":["HIPAA","21st Century Cures Act","ONC certification (FHIR R4, US Core)","DEA EPCS","FTC Eyeglass Rule","FTC Contact Lens Rule","ICD-10-CM and CPT","CMS MIPS","DICOM"],"cover":{"src":"/case-studies/loupe/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Loupe - Ophthalmology EHR with Per-Eye Charting and Laterality-Aware Coding","description":"Designed and built a clickable ophthalmology EHR for a US eye care group with seven clinics: a clinician's day at a glance, a live patient flow board with dilation timers, patient search with break-the-glass access, a chart summary with right-eye and left-eye findings side by side, and a structured exam workspace per eye.","category":"Healthcare / Specialty EHR","client":"Cedar Hollow Eye Associates"}}},{"meta":{"slug":"headgate","industry":"healthdata","projectType":"Claims & EHR integration API","country":"us","tags":["healthcare","enterprise"],"compliances":["CMS-9115-F","CMS-0057-F","HIPAA Privacy and Security Rules","HIPAA X12 transactions","HL7 FHIR R4 and US Core","SMART App Launch","FHIR Bulk Data","Da Vinci CRD, DTR and PAS","CARIN Blue Button"],"cover":{"src":"/case-studies/headgate/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Headgate - FHIR Interoperability API Platform for Claims, Clinical Data and Prior Authorization","description":"Designed and built a clickable console for the FHIR APIs a US regional health plan must run under federal interoperability rules: API health across Patient Access, Provider Directory, Formulary, Provider Access, Payer-to-Payer and Prior Authorization, a security review queue for third-party apps, and one clock for every prior authorization request, however it arrived.","category":"Health Data / Interoperability","client":"Juniper Basin Health Plan"}}},{"meta":{"slug":"waypost","industry":"telehealth","projectType":"Remote patient monitoring","country":"us","tags":["healthcare","iot","enterprise"],"compliances":["HIPAA","Medicare RPM billing (CPT 99453-99458)","FDA medical device rules","ACC/AHA BP guideline","HEDIS CBP","WCAG 2.1 AA","HHS Section 504"],"cover":{"src":"/case-studies/waypost/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Waypost - Remote Patient Monitoring Platform with Risk-Sorted Alerts","description":"Designed and built a clickable remote patient monitoring platform for a US cardiology and primary care group: home blood pressure, weight and SpO2 readings from cellular devices, a risk-sorted alert queue for nurses, triage with the practice's protocol on screen, and live progress toward each patient's Medicare RPM billing requirements.","category":"Healthcare / Remote Patient Monitoring","client":"Brightwater Ridge Medical Group"}}},{"meta":{"slug":"sidehill","industry":"hr","projectType":"Benefits administration","country":"us","tags":["enterprise","saas"],"compliances":["ERISA","ACA employer mandate (IRC 4980H)","IRS Forms 1094-C and 1095-C","HIPAA","Section 125","COBRA","ANSI X12 834","Colorado FAMLI","Medicare Part D notice"],"cover":{"src":"/case-studies/sidehill/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Sidehill - Benefits Administration Platform for Enrollment, Life Events and Carrier Feeds","description":"Designed and built a clickable benefits administration platform for a Colorado outdoor gear manufacturer with about 1,800 employees: open enrollment with completion by location and language, one queue for new hires and life events, event decisions checked against Section 125 rules, and an employee benefits record that ties elections to carrier files, ACA codes and payroll deductions.","category":"HR & Payroll / Benefits Administration","client":"Granite Saddle Outfitters"}}},{"meta":{"slug":"chaffline","industry":"legal","projectType":"E-discovery search","country":"us","tags":["enterprise","ai"],"compliances":["FRCP 26 and 34","FRE 502","FRCP 5.2","HIPAA","Illinois BIPA","Illinois PIPA","CCPA","ABA Model Rules","Sedona Principles"],"cover":{"src":"/case-studies/chaffline/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Chaffline - E-Discovery Search and Document Review Platform","description":"Designed and built a clickable e-discovery platform for a Chicago litigation support firm that hosts and reviews data for US law firms: a dashboard across every matter, each matter's path from collection to production, Boolean, proximity and concept search, and a review pane where contract reviewers code documents with the privilege basis recorded at the moment of the call.","category":"LegalTech / E-Discovery","client":"Kedzie Row Discovery Services"}}}],"all":[{"slug":"pylon","title":"Building Pylon - Insurance operations console"},{"slug":"chaffline","title":"Chaffline - E-discovery search"},{"slug":"clinica","title":"Clinica - Clinic operations platform"},{"slug":"headgate","title":"Headgate - Claims & EHR integration API"},{"slug":"loupe","title":"Loupe - Specialty EHR"},{"slug":"sidehill","title":"Sidehill - Benefits administration"},{"slug":"sutura","title":"Sutura - Patient data hub"},{"slug":"waypost","title":"Waypost - Remote patient monitoring"}],"byIndustry":[{"id":"clinics","label":"Hospitals & clinics","href":"/case-studies/industry/clinics","count":2},{"id":"healthdata","label":"Health data & interoperability","href":"/case-studies/industry/healthdata","count":2},{"id":"hr","label":"HR & payroll","href":"/case-studies/industry/hr","count":1},{"id":"insurance","label":"Insurance","href":"/case-studies/industry/insurance","count":1},{"id":"legal","label":"LegalTech","href":"/case-studies/industry/legal","count":1},{"id":"telehealth","label":"Telehealth & patient apps","href":"/case-studies/industry/telehealth","count":1}]}