.%20TODO(brand):%20replace%20with%20the%20master%20vector%20from%20the%20brand%20files.%20--%3e%3cdefs%3e%3clinearGradient%20id='rudratic-mark'%20x1='0'%20y1='195'%20x2='0'%20y2='828'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20offset='0'%20stop-color='%235a0bd8'%20/%3e%3cstop%20offset='1'%20stop-color='%23a5157c'%20/%3e%3c/linearGradient%3e%3c/defs%3e%3cg%20fill='url(%23rudratic-mark)'%3e%3cpath%20d='M253%20448%20545%20195l60%2070-292%20252z'%20/%3e%3cpath%20d='M348%20558%20473%20450v200L348%20768z'%20/%3e%3cpath%20d='M523%20405%20640%20305l83%2097-141%20120%20153%20128-102%2087-110-97z'%20/%3e%3cpath%20d='m663%20763%2072-61v126z'%20/%3e%3c/g%3e%3c/svg%3e){kind=small}
Compliance supportHIPAA Security Rule
Evidence for HIPAA technical safeguards
The HIPAA Security Rule’s technical safeguards in 45 CFR 164.312 cover access control, audit controls, integrity and authentication for systems holding electronic protected health information. SWOT DAM and SWOT PAM produce evidence for each.
The products help produce evidence for these controls. Whether a control is met depends on your configuration, scope and independent assessment.
What the technical safeguards ask for
- 01
Access control
Only authorised people and software can reach ePHI, each with a unique identity.
- 02
Audit controls
Activity in systems that hold ePHI is recorded and can be examined.
- 03
Integrity and authentication
ePHI is protected from improper change, and people are who they claim to be.
See it work
Safeguard by safeguard
Choose a HIPAA technical safeguard to see the SWOT evidence that supports it.
164.312(a)(1)
Access control
The clause asks
Allow access to ePHI only to persons or software programs that have been granted access rights.
SWOT evidence
Just-in-time, approved grants to named targets; temporary database accounts for each session.
SWOT PAM164.312(a)(2)(i)
Unique user identification
The clause asks
Assign a unique name or number for identifying and tracking user identity.
SWOT evidence
SSO sign-in per person; sessions stay tied to the named user even on shared accounts.
SWOT PAM164.312(a)(2)(ii)
Emergency access
The clause asks
Procedures for obtaining necessary ePHI during an emergency.
SWOT evidence
Break-glass access, logged and alerted at high priority.
SWOT PAM164.312(a)(2)(iii)
Automatic logoff
The clause asks
Terminate a session after a predetermined time of inactivity.
SWOT evidence
Time-bound grants end on their own when the approved window closes, and admins can end a live session.
SWOT PAM164.312(b)
Audit controls
The clause asks
Mechanisms that record and examine activity in systems that contain or use ePHI.
SWOT evidence
Activity from each database’s native audit, scored per identity, with a filterable forensic audit log.
SWOT DAM164.312(c)(1)
Integrity
The clause asks
Protect ePHI from improper alteration or destruction.
SWOT evidence
Alerts on unauthorised schema changes and mass reads; PAMGuard can drop destructive commands before they run.
SWOT DAM164.312(d)
Person or entity authentication
The clause asks
Verify that a person seeking access to ePHI is the one claimed.
SWOT evidence
SSO with TOTP multi-factor authentication for every privileged session.
SWOT PAM164.308(a)(1)(ii)(D)
Information system activity review
The clause asks
Regularly review records of information system activity, such as audit logs and access reports.
SWOT evidence
Signed CSV and PDF audit exports with a SHA-256 receipt, and session replay for review.
SWOT DAM1 of 8 clauses viewed
The products help produce evidence for these controls. Whether a control is met depends on your configuration, scope and independent assessment.
Does SWOT make us HIPAA compliant?
No product does on its own. SWOT DAM and SWOT PAM produce evidence relevant to the HIPAA Security Rule’s technical safeguards; whether you meet them depends on your configuration, scope, policies and assessment.
Which HIPAA safeguards does it support?
Mainly the technical safeguards in 45 CFR 164.312: access control, audit controls, integrity and person or entity authentication, plus information system activity review under 164.308.
Can it find where ePHI lives?
Yes. SWOT DAM’s Sensitive Data Sentinel classifies new database columns, including health record columns, every 24 hours from the catalogue.
See it on your own systems
A walk-through of SWOT DAM and SWOT PAM with the team that builds them.