HIPAA Compliance GuideⒸ2024 Withings

v2 - January 2024

HIPAA Compliance Guide

CONTENT
●
●
●
●
●
●
●

●

Ⓒ2024 Withings

Notices
Purpose and intended audience
Definitions
WITHINGS vision
What is HIPAA?
To whom does HIPAA apply?
What are the HIPAA requirements?
○
Overview○
Privacy obligations of a business associate○
De-identification of health information○
Security obligations of a business associate○
Breach notifications obligations of a business associate
HIPAA compliance at WITHINGS○
Overview○
WITHINGS Information Security Management System and scope■
History■
Purpose■Scope○
WITHINGS Compliance Program○
WITHINGS Compliance Program mapping to HIPAA requirements■
HIPAA Security rules - Administrative safeguards■
HIPAA Security rules - Physical safeguards■
HIPAA Security rules - Technical safeguards■
HIPAA Security rules - Organizational safeguards■
HIPAA Privacy rules■
HIPAA Breach Notification rules

3
3
4
6
6
7
8
8
8
9
9
10
11
11
12
12
13
14
15
19
19
24
27
29
32
35
HIPAA Compliance Guide

2

NOTICESNOTICES
Customers are responsible for making their own independent assessment of the information in this document. This guide is (a)for informational purposes only, (b) does not intend the information or recommendations in this guide to constitute legal advice,(c) does not create any commitments or assurances from WITHINGS and its suppliers or licensors, and (d) represents current
WITHINGS offerings and practices, which are subject to change without notice.

PURPOSE AND INTENDED AUDIENCE
The purpose of this guide is to help WITHINGS customers to improve their knowledge of HIPAA standards and help them to comply
with these standards. It will also provide all the necessary information to assure customers that WITHINGS meets its obligations
and requirements with regards to HIPAA. This guide is intended to apply to security officers, compliance officers, or any otherresources who are in charge of HIPAA implementation and compliance at their companies.

Ⓒ2024 Withings

HIPAA Compliance Guide

3

DEFINITIONSDEFINITIONS
Any capitalized terms used but not otherwise defined in this document have the same meaning as in HIPAA.
AFNOR Certification
WITHINGS Certification Body for the ISO 27001:2017, ISO 27701:2019 and HDS certifications of WITHINGS ISMS. Description: AFNOR
Certification was the first French certification body to be awarded COFRAC (French Accreditation Committee) accreditation. The
scope of this accreditation is regularly extended in order to secure greater confidence in AFNOR Certification certificates, equallyspanning inspection, business management system certification, competency certification, product certification and services
certification or qualification of firms. More information on AFNOR.
Business Associates
A “business associate” is an entity that accesses, uses, processes or discloses PHI on behalf of a covered entity for a service
described in HIPAA regulations. WITHINGS cloud services hosted on WITHINGS Medical(s) Platform(s), such as WITHINGS RPM or
WITHINGS API, could make WITHINGS a business associate when WITHINGS provides these services to HIPAA-covered entities, orto a business associate of a HIPAA-covered entity if the covered entities were leveraging the online services to store andtransmit PHI.
Business Associate Agreements
The HIPAA Privacy Rule and the HIPAA Security Rule require covered entities to obtain written assurances from their businessassociates that the business associates will appropriately safeguard the PHI they receive or create on behalf of the covered
entity. These assurances typically are provided in a contract between the covered entity and business associate, known as a“business associate agreement,” or “business associate addendum.”Ⓒ2024 Withings

HIPAA Compliance Guide

4

DEFINITIONSDEFINITIONS
Covered Entities
HIPAA “covered entities” are:• healthcare providers that engage in certain electronic transactions, including any healthcare provider that makes
claims against a patient’s health insurance;• health plans, including health insurers and group health plans; or• healthcare clearinghouses, which are entities that translate electronic health transactions formats.
Software vendors are not identified as covered entities, but they may be business associates to covered entities, depending on
the services offered and how they are used.
Protected Health Information (PHI)
PHI is a subset of health information, in any media, including demographic information collected from an individual, that is:• created or received by a healthcare provider, health plan, employer, or healthcare clearinghouse;• relates to an individual’s health, provision of healthcare to the individual, or payment for the provision of healthcare;and• identifies an individual or could reasonably be used with other available information to identify an individual; and• is not specifically excluded from the definition of PHI (generally, education, and employment records are excluded fromHIPAA coverage).
PHI includes many common identifiers, such as name, address, and Social Security Number, and can be in any form or media,
whether electronic, paper, or oral. When used in an electronic form, PHI is also defined as “electronic protected healthinformation” (ePHI).
Ⓒ2024 Withings

HIPAA Compliance Guide

5

WITHINGS VISIONWITHINGS VISION
It is now well-known by healthcare industry professionals that the rate of chronic disease is increasing and will reach the
majority of the population. Remote patient monitoring, defined as the use of wireless technology to collect and track medical
information from an individual outside of a healthcare provider’s office or facility, is slated to become the future of modern
medicine.
By providing medical-grade hardware products with clinical validation, and healthcare industry-compliant applications andservices, WITHINGS is actually the world leader in connected health, with more than ten (10) years of expertise, and will be thebest and most valuable partner for any covered entity.
WITHINGS wants to be a trusted partner for any of its customers by committing to protect the data of its customers. Customers’
trust is essential, especially in the healthcare industry, where healthcare providers need to deliver high-quality patient care with
innovations, proactively engaging their patients and controlling their costs. WITHINGS compliance program includes theword-reference standards in terms of privacy and security of PHI, allowing WITHINGS customers to manage their health andtrack progress in this increasingly challenging industry and ensure their compliance.

WHAT IS HIPAA?
The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) is a U.S. federal law that mandates national standards toprotect the privacy and security of health information, and the Health Information Technology for Economic and Clinical Health
Act (the “HITECH Act”) is a 2009 law that increases the obligations and penalties under HIPAA. These laws place the onus ofcompliance with security and privacy regulations in healthcare on the shoulders of what have been termed covered entities andby extension, their business associates or suppliers that come into contact with electronic Protected Health Information (ePHI).

Ⓒ2024 Withings

HIPAA Compliance Guide

6

HIPAATO WHOM DOES HIPAA APPLY?
Healthcare
providers

Healthcare providers who conduct certain financial and administrative transactions
electronically for which HHS has adopted a standard. Such providers include:●
Doctors;●
Clinics;●
Psychologists;●
Dentists;●
Nursing homes;●
Pharmacies.

Health plans

Individual and group plans that provide or pay the cost of medical care.
Such plans include:●
Medicare, Medicaid, and Medicare supplement insurers;●
Health, dental, vision, and prescription drug insurers;●
Health maintenance organizations (HMOs);●
Employer-sponsored group health plans;●Multiemployer health plans;●
Government and church-sponsored health plans.

Entities that process non-standard health information they receive from another
Healthcare
entity into a standard format, or the converse. Such entities might include:
clearinghouse●
Billing services;s●
Repricing companies;●
Community health management information systems.

Ⓒ2024 Withings

To learn more, refer to HHS’
covered entities guidance.
If a covered entity engages a
vendor, or supplier, called abusiness associate to help it
carry
out
its
healthcare
activities and functions, theBusiness Associate needs toadhere to and comply with the
HIPAA standard as well. Thisagreement is contractually
defined in a written Business
Associate Agreement (BAA).
Therefore, the two parties arethen bound by a shared
responsibility agreement toprotect
theprivacy
andsecurity of protected healthinformation.

HIPAA Compliance Guide

7

HIPAA REQUIREMENTS

WHAT ARE THE HIPAA REQUIREMENTS?
Overview

WITHINGS wants to share its knowledge about HIPAA regulations to help its customers in their strategies and increase theirknowledge of information security and privacy. It is also very important that everyone clearly understands roles and responsibilities.
WITHINGS has provided a brief overview of this matter in this section.
HIPAA’s principal components concern the standards set by the Privacy, Security, and Breach Notification Rules, which govern theprotection of PHI. HHS’ Office for Civil Rights is authorized to enforce these rules. Covered entities and their business associates mustcomply with the following HIPAA rules by implementing adequate safeguards.
Privacy obligations of a business associate
Privacy rules are very similar to the EU GDPR rules, as they both relate to granting individuals greater control over their PHI. They aim
to safeguard the privacy of individuals and their PHI, while allowing appropriate uses and disclosures of the data without patients’approval to improve the healthcare system and overall public health by using the de-identification process. The ISO/IEC 27018
standard covers the majority of the HIPAA Privacy Rules.
More information on Privacy Rules.
Business associate agreements must include certain requirements of the HIPAA rules. Specifically, business associates must:●abide by the limitations on the use and disclosure of PHI set forth in the agreement;●
not use or further disclose PHI other than as permitted or required by the agreement or as required by law;●
use appropriate safeguards to prevent a use or disclosure of PHI other than as provided for by the agreement;●comply with certain requirements with respect to individuals’ right to access, amend, and receive an accounting of
disclosures of PHI;●
return or destroy PHI upon termination of the agreement.
Ⓒ2024 Withings

HIPAA Compliance Guide

8

HIPAA REQUIREMENTS
De-identification of health information
As mentioned, the Privacy Rules allow the use of health information from individuals without patients’ prior approval, as long as
the information is de-identified. De-identification is the process of removing identifiers from protected health information to
mitigate the privacy risks to individuals. Covered entities or their business associates are allowed to use de-identified healthinformation without adhering to HIPAA requirements, such as when anonymized patient data is used for medical research
purposes. For more information on de-identification of health information, please refer to this link.
Security obligations of a business associate
Basically, the goal of the Security Rules is to ensure the protection of the Privacy Rule with appropriate and proportionate
technical and non-technical measures or controls. As for the Privacy Rules, the Security Rules only apply to protected healthinformation in electronic form (ePHI). More information on Security Rules.
The HIPAA Security Rule requires that a covered entity or business associate implements different types ofsafeguards—mechanisms, processes, or procedures used to mitigate security vulnerabilities and reduce security risks—toprotect electronic PHI. These safeguards include:●
administrative safeguards (e.g., security management process, security awareness training);●
physical safeguards (e.g., facility access controls, device and media controls);●
technical safeguards (e.g., access control, transmission security);●
organizational safeguards (e.g., contracts)
These security measures must be documented and kept current, and the business associate must retain such documentation
for at least six years.
The best way to comply with the Security Rules is to implement an Information Security Management System (ISMS) that iscompliant with the ISO/IEC 27001 standard.
Ⓒ2024 Withings

HIPAA Compliance Guide

9

HIPAA REQUIREMENTS
Breach notifications obligations of a business associate
The HIPAA Breach Notification Rule requires business associates notify covered entities following the discovery of a breach of
unsecured PHI. This notification must be made without unreasonable delay and no later than 60 days after discovery of thebreach. The business associate agreement may require a shorter time frame. The rule also requires that business associates
have reasonable measures in place to detect breaches of unsecured PHI.
More information on Breach Notification Rules.
The business associate must also notify the affected individuals, the HHS Secretary, and, in certain cases, the media.
An unsecured PHI is defined as a PHI that has been disclosed to unauthorized persons, or a PHI where there was a breach ofavailability, integrity or traceability. For example, it could be indecipherable information.

Ⓒ2024 Withings

HIPAA Compliance Guide

10

HIPAA COMPLIANCEHIPAA COMPLIANCE AT WITHINGS
Overview
While the U.S. Department of Health and Human Services (HHS) does not recognize a formal certification process for HIPAA
compliance, WITHINGS has launched its Compliance Program to ensure the compliance of its Information Security Management
System (ISMS) with regards to international standards. Therefore, WITHINGS regularly undergoes several independent audits toassess the security, privacy, operational, and compliance controls implemented at WITHINGS. This means that an independentcertification body has examined the controls present in ISMS based on global standards that encompass requirements outlined
in HIPAA.
It is essential to understand that HIPAA compliance is a shared responsibility between WITHINGS and its customers, and
WITHINGS works continuously to ensure the highest level of controls. As part of the ISMS, WITHINGS has appointed specific task
forces to work on compliance with standards and regulations around the world. They are also in charge of facilitating andsupporting independent audits and assessments by third parties in order to earn a sufficient level of trust.

Ⓒ2024 Withings

HIPAA Compliance Guide

11

HIPAA COMPLIANCESCOPE - WITHINGS ISMS / PIMS

History
WITHINGS was registered in June 2008. WITHINGS is headquartered (HQ) in Issy-les-Moulineaux (France), with offices in Boston(Massachusetts, USA) and Hong Kong, and distributes products worldwide.
WITHINGS designs, develops, manufactures and sells connected health devices for home monitoring. WITHINGS has
implemented a Quality Management System (QMS) and passed the international standards certification ISO 13485:2016 forConnected Medical Electronic Devices.
WITHINGS also designs, develops and sells a wide range of B2C and B2B services, including web applications (mainly SaaS),
Apple iOS & Android applications, Apple iOS & Android Software Development Kit (SDK).
More recently, developing health services for B2C customers such as product reimbursement by healthcare systems, and B2B
services for care providers and medical professions, such as patient remote monitoring platforms, is one of the key parts of the
WITHINGS strategy. It appears pretty obvious that WITHINGS would need strong technical and organizational safeguards andprocesses in place to be compliant with industry standards.
WITHINGS has therefore implemented different cloud platforms hosted on different physical infrastructures in order to separate
historical consumer activities from new activities that would require more advanced certification:●
WITHINGS Consumer Cloud;●
WITHINGS Certified Cloud(s), also called WITHINGS Medical Cloud(s).
In order to meet international regulations for those activities and customers expectations, WITHINGS has decided
to implement:●
An Information Security Management System (ISMS) that is compliant with ISO 27001:2017;●
A Privacy Information Management System (PIMS) that is compliant with ISO 27701:2019.
Ⓒ2024 Withings

HIPAA Compliance Guide

12

HIPAA COMPLIANCESCOPE - WITHINGS ISMS / PIMS

PurposeWITHINGS is committed to protecting the security and privacy of its business information in the face of incidents and unwanted
events and has implemented both an Information Security Management System (ISMS) and a Privacy Information Management
System which are respectively compliant with ISO/IEC 27001:2017 and ISO 27701:2019, the international standards for information
security and privacy (see below the full Withings Compliance Program).
The purposes of the ISMS/PIMS are to:
1. Understand the organization’s needs and the necessity for establishing information security/privacy management
policy and objectives;
2. Implement and operate controls and measures for managing the organization’s overall capability to manage
information security/privacy incidents;
3. Monitor and review the performance and effectiveness of the ISMS;
4. Continually improve the organization’s information security and privacy based on objective measurement.

Ⓒ2024 Withings

HIPAA Compliance Guide

13

HIPAA COMPLIANCESCOPE - WITHINGS ISMS / PIMS

Scope
The scope of the ISO 27001:2017, ISO 27701:2019 and HDS certifications of WITHINGS Information Security and Privacy Management
System (ISMS & PIMS) includes all systems, people and processes that are involved in the design, development, operations,validation and support of applications and services that are hosted on the WITHINGS Medical Cloud(s), and processing or
disclosing Protected Health Information (PHI). Locations include the WITHINGS headquarters in Issy-les-Moulineaux, France.
As a non-exhaustive list, the following products and services are within the scope of the ISMS/PIMS, when they are hosted in
Medical Cloud(s), along with the data contained or collected by those offerings:●
WITHINGS RPM;●
WITHINGS API;●
Data Collection Service, using WITHINGS IoT and/or WITHINGS Mobile Application and/or WITHINGS SDK;●
All other future products and services that are hosted on the certified cloud.
The departmental scope for this ISMS/PIMS comprises:●
Product Management team (HQ);●
Software Development team (HQ);●
Cloud Engineering team (HQ);●
Software Quality Assurance team (HQ);●
Customer Support Team (HQ);●
Research & Development team (HQ);●
Data Science team (HQ);●
Legal team (HQ);●
Human Resources team (HQ).

Ⓒ2024 Withings

HIPAA Compliance Guide

14

WITHINGS Compliance Program

WITHINGS Compliance Program
In addition to documenting our approach to security and privacy design, WITHINGS undergoes several independent third-party
audits on a regular basis to provide customers with external verification. WITHINGS also performs self-assessment when there is
no formal certification recognized by the regulatory body, such as HIPAA or GDPR.
To avoid any confusion, external certifications by certification bodies and self-assessments are explicitly mentioned below.

Ⓒ2024 Withings

HIPAA Compliance Guide

15

WITHINGS Compliance Program
Standard
ISO/IEC
27001:2017

HDS v1.1 2018

Compliance

AFNOR
Certification
N° 2020 / 86561.1

AFNOR
Certification
N° 2020 / 86563.5

Description

Security

The ISO/IEC 27001:2017 is a security world-class standard that outlines and provides
the requirements for an information security management system (ISMS).
WITHINGS has passed the certification with the independent certification body, AFNOR.
Certificate available on our website.

All

Introduced by the French governmental agency for health, ASIP Santé (Agence
Française de la Santé Numérique), HDS provides a framework to strengthen the
security and protection of PHI. For more information.
HDS certification provides the necessary assurance of information security forcompanies who wish to host the healthcare data of French citizens in the cloud andvalidates that WITHINGS ensures data confidentiality, integrity, and availability to its
customers and partners.
HDS framework is based on several ISO standards that guarantee global
equivalences:●
ISO/IEC 27001:2017: the full standard requirements are included in HDS●
ISO/IEC 27018:2014: the full standard requirements are included in HDS●
ISO/IEC 20000-1:2011: the part 1 of the standard is included in HDS●
Additional controls
WITHINGS has passed the certification with the independent certification body, AFNOR.
Certificate available on our website.

Ⓒ2024 Withings

HIPAA Compliance Guide

16

WITHINGS Compliance Program
Standard
ISO/IEC
27701:2019

Compliance

AFNOR
Certification
N° 2023/104367.1

Description

Privacy

The ISO/IEC 27701:2019 is a privacy world-class standard that outlines andprovides the requirements for a Privacy Information Management System(PIMS).
WITHINGS has passed the certification with the independent certification
body, AFNOR.
Certificate available on our website.

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a
U.S. federal law that mandates national standards to protect the privacy andsecurity of protected health information (PHI).

HIPAA
Self assessmentAll

As a business associate, WITHINGS has assessed its HIPAA compliance on all
Security Rules, Privacy Rules and Breach Notification Rules based on the
cross-correlation with its ISO 270001, ISO 27701 and HDS certifications.
There is no formal certification recognized by the regulatory body.

Ⓒ2024 Withings

HIPAA Compliance Guide

17

WITHINGS Compliance Program
Standard

Compliance

Description

The General Data Protection Regulation (GDPR) is a regulation in EU law on dataprotection and privacy in the European Union (EU) and the European Economic Area
(EEA). It also addresses the transfer of personal data outside the EU and EEA areas. The
GDPR aims primarily to give control to individuals over their personal data and tosimplify the regulatory environment for international business by unifying the regulation
within the EU.
GDPR
Self assessment

Privacy

WITHINGS complies with GDPR regulation in all its activities by:●
Receiving the informed consent of the data subject to process the information.
The consent is specific to the exposed purpose of treatment and is an
unambiguous affirmation given by the data subject;●
Maintaining transparent information, communication and modalities for the
exercise of the rights of the data subject (access, rectification, erasure,
limitation, transfer, etc.);●
Maintaining a Privacy Policy, a Data Protection Addendum, a Processing
Register, and several Privacy Impact Assessment;●
Appointing a Data Protection Officer (DPO).
GDPR compliance is enforced by the ISO 27001, ISO 27701 and HDS certifications. HDS
certification also ensures ISO/IEC 27018 and ISO/IEC 20000-1 control implementations.
There is no formal certification recognized by the regulatory body.

Ⓒ2024 Withings

HIPAA Compliance Guide

18

HIPAA Mapping

WITHINGS Compliance Program mapping to HIPAA
requirements
The cross-reference matrix below presents how WITHINGS Compliance Program is covering the HIPAA rules and requirements. It
shows that the WITHINGS ISMS, which is certified ISO 27001:2017, ISO 27701:2019 and HDS v1.1:2018, is the best tool to manage
information security in compliance with HIPAA/HITECH and HHS guidelines. As a reminder, HDS is the regulatory framework toprocess electronic Protected Health Information (ePHI) in France.
This matrix is provided for informational purposes only. The content herein is correct as of the time it was written. National andinternational standards may change due to law modification or WITHINGS internal policies, and measures may change as
WITHINGS continually improves its ISMS/PIMS for better customer protection. Customers are responsible for making their own
independent assessment of HIPAA. WITHINGS cannot be held responsible for any assessment performed based on the following
table.
HIPAA Security rules - Administrative safeguards

HIPAA Rules References
Security
rulesⒸ2024 Withings

Administrative
safeguards

164.308(a)(1)(i) - Security
Management Process

ISO 27001:2017 / ISO 27018:2014 // ISO 20000-1:2011 References
5.2 Information Security Policy
A.5.1.1 Policies for information security
A.5.1.2 Review of the policies for information security
HIPAA Compliance Guide

19

HIPAA Mapping

Administrative safeguards

Security
rules

Administrative
safeguards

164.308(a)(1)(ii)(A) - Risk
Analysis8.1 Operational planning and control
8.2 Information security risk
assessment
8.3 Information security risktreatment

Security
Rules

Administrative
safeguards

164.308(a)(1)(ii)(A) - Risk
Analysis

A.12.7.1 Information systems audit
controls
A.18.2.3 Technical compliance review

164.308(a)(1)(ii)(B) - Risk
Management

6.1 Actions to address risks andopportunities
A.9.1.1 Access control policy
A.9.2.1 User registration and deregistration
A.9.2.2 User access provisioning
A.9.2.3 Management of privileged
access rights
A.9.2.4 Management of secretauthentication information of users
A.9.2.5 Review of user access rights
A.9.2.6 Removal or adjustment ofaccess rights
A.12.2.1 Controls against malware
A.12.6.1 Management of technicalvulnerabilities
A.13.1.1 Network controls
A.13.1.2 Security of network services

Security
RulesⒸ2024 Withings

Administrative
safeguards

HIPAA Compliance Guide

20

HIPAA Mapping

Security
rules

Administrative safeguards

Administrative
safeguards

164.308(a)(1)(ii)(C) - Sanction
PolicyA.7.2.1 Management responsibilities
A.7.2.3 Disciplinary process
A.13.2.4 Confidentiality or
nondisclosure agreements

Security
Rules

Administrative
safeguards

164.308(a)(1)(ii)(D) Information System Activity
Review

9.1 Monitoring, measurement,
analysis and evaluation
9.2 Internal audit
9.3 Management review
A.18.2.1 Independent review of
information security
A.18.2.2 Compliance with security
policies and standards

Security
Rules

Administrative
safeguards

164.308(a)(2) - Assigned
security responsibility

5.3 Organizational roles,
responsibilities and authorities
A.6.1.1 Information security roles andresponsibilities

164.308(a)(3)(i) - Workforce security

A.6.1.2 Segregation of duties
A.7.1.1 Screening
A.7.1.2 Terms and conditions of
employment
A.7.2.1 Management responsibilities
A.7.3.1 Termination or change of
employment responsibilities

Security
RulesⒸ2024 Withings

Administrative
safeguards

HIPAA Compliance Guide

21

HIPAA Mapping

Administrative safeguards

Security
rules

Administrative
safeguards

164.308(a)(4)(i) - Information
access management

A.7.1.2 Terms and conditions of
employment
A.9.1.1 Access control policy
A.13.2.4 Confidentiality or nondisclosureagreements

Security
Rules

Administrative
safeguards

164.308(a)(5)(i) - Security
awareness and training

7.3 AwarenessA.7.2.2 Information security awareness,
education and training

164.308(a)(6)(i) - Security
incident procedures

A.16.1.1 Responsibilities and procedures
A.16.1.2 Reporting information security
eventsA.16.1.3 Reporting information security
weaknesses
A.16.1.4 Assessment of and decision on
information security events
A.16.1.5 Response to information security
incidents
A.16.1.6 Learning from information security
incidents
A.16.1.7 Collection of evidence

Security
RulesⒸ2024 Withings

Administrative
safeguards

HIPAA Compliance Guide

22

HIPAA Mapping

Security
rules

Security
Rules

Security
RulesⒸ2024 Withings

Administrative safeguards

Administrative
safeguards

Administrative
safeguards

Administrative
safeguards

164.308(a)(6)(i) - Security
incident procedures

ISO 27018 4.4.3.2 PII disclosure
notification
ISO 27018 4.4.3.3/4 Recording of PII
disclosures
ISO 27018 4.4.5.1 Notification of a data
breach involving PII
ISO 27018 4.4.6.12 Contract measures

164.308(a)(7)(i) Contingency plan

A.12.1.3 Capacity management
A.17.1.1 Planning information security
continuity
A.17.1.2 Implementing information
security continuity
A.17.1.3 Verify, review and evaluate
information security continuity
A.17.2.1 Availability of information
processing facilities
ISO20000 6.3 Management ofservice continuity and availability
ISO20000 6.5 Capacity
management

164.308(a)(8) - Evaluation

9.1 Monitoring, measurement,
analysis and evaluation
9.2 Internal audit
9.3 Management review
10.1 Nonconformity and corrective
action10.2 Continual improvement

HIPAA Compliance Guide

23

HIPAA Mapping

Physical safeguards

HIPAA Security rules - Physical safeguards
HIPAA Rules References

Security
rulesⒸ2024 Withings

Physicalsafeguards

164.310(a)(1) - Facility access
controls

ISO 27001:2017 / ISO/IEC 27018:2014/ ISO 20000-1:2011 References
A.11.1.1 Physical security perimeter
A.11.1.2 Physical entry controls
A.11.1.3 Securing offices, rooms andfacilities
A.11.1.4 Protecting against externaland environmental threats
A.11.1.5 Working in secure areas
A.11.1.6 Delivery and loading areas

HIPAA Compliance Guide

24

HIPAA Mapping

Security
rulesⒸ2024 Withings

Physicalsafeguards

Physical safeguards

164.310(b) - Workstation use

A.6.2.1 Mobile device policy
A.6.2.2 Teleworking
A.9.2.4 Management of secretauthentication information of users
A.9.2.5 Review of user access rights
A.9.2.6 Removal or adjustment of accessrightsA.9.3.1 Use of secret authentication
information
A.9.4.1 Information access restriction
A.9.4.2 Secure log-on procedures
A.9.4.3 Password management system
A.10.1.1 Policy on the use of cryptographic
controls
A.10.1.2 Key management
A.11.2.1 Equipment siting and protection
A.11.2.4 Equipment maintenance
A.11.2.5 Removal of assets
A.11.2.6 Security of equipment and assets
off-premises
A.11.2.7 Secure disposal or reuse of
equipment
A.11.2.8 Unattended user equipment
A.11.2.9 Clear desk and clear screen policy
A.12.2.1 Controls against malware
A.12.5.1 Installation of software on
operational systems
A.12.6.2 Restrictions on software
installation
A.18.1.2 Intellectual property rights
HIPAA Compliance Guide

25

HIPAA Mapping

Security
rules

Security
RulesⒸ2024 Withings

Physicalsafeguards

Physicalsafeguards

Physical safeguards

164.310(d)(1) - Device andmedia controls

A.8.1.1 Inventory of assets
A.8.1.2 Ownership of assets
A.8.1.3 Acceptable use of assets
A.8.1.4 Return of assets

164.310(d)(2)(iv) - Data
backup and storage

A.12.3.1 Information backup
A.17.1.1 Planning information security
continuity
A.17.1.2 Implementing information
security continuity
A.17.1.3 Verify, review and evaluate
information security continuity
A.17.2.1 Availability of information
processing facilities
A.18.1.3 Protection of records
ISO 27018 4.4.6.3 Control andlogging of data restoration
ISO20000 6.3 Management ofservice continuity and availability
ISO20000 6.5 Capacity
management

HIPAA Compliance Guide

26

HIPAA MappingTechnical safeguards

HIPAA Security rules - Technical safeguards
HIPAA Rules References
Security
rules

Security
rules

Security
rulesⒸ2024 Withings

Technical
safeguards

Technical
safeguards

Technical
safeguards

164.312(a)(1) - Access control

ISO 27001:2017 / ISO/IEC 27018:2014/ ISO 20000-1:2011 References
A.7.1.2 Terms and conditions of employment A.9.1.1
Access control policy A.13.2.4 Confidentiality or
nondisclosure agreements

A.10.1.1 Policy on the use of cryptographic controls
A.10.1.2 Key management
164.312(a)(2)(iv) - Encryption and
A.18.1.5 Regulation of cryptographic controls ISO
decryption
27018 4.4.6.6 Encryption of PII transmitted overpublic data transmission networks

164.308(a)(1)(ii)(D) and
164.312(b) - Audit controls

A.7.3.1 Termination or change of employment
responsibilities
A.9.1.2 Access to networks and network services
A.12.4.1 Event logging
A.12.4.2 Protection of log information
A.12.4.3 Administrator and operator logs
A.12.4.4 Clock synchronization

HIPAA Compliance Guide

27

HIPAA Mapping

Security
rulesⒸ2024 Withings

Technical
safeguards

Technical safeguards

164.312(e)(2)(ii) - Encryption

A.8.2.1 Classification of information
A.8.2.2 Labeling of information
A.8.2.3 Handling of assets
A.10.1.1 Policy on the use of
cryptographic controls
A.10.1.2 Key management
A.18.1.5 Regulation of cryptographic
controls
ISO 27018 4.4.6.6 Encryption of
PII transmitted over public data transmission
networks

HIPAA Compliance Guide

28

HIPAA Mapping

HIPAA Security rules - Organizational safeguards
HIPAA Rules References

Security
rulesⒸ2024 Withings

Organizationalsafeguards

164.314(a)(2)(i) - Businessassociate contracts

ISO 27001:2017 / ISO/IEC 27018:2014/ ISO 20000-1:2011 References
A.13.2.4 Confidentiality or
nondisclosure agreements
A.15.1.1 Information security policy forsupplier relationships
A.15.1.2 Addressing security within
supplier agreements
A.15.1.3 Information andcommunication technology supply
chain
A.15.2.1 Monitoring and review ofsupplier services
A.15.2.2 Managing changes tosupplier services
A.18.1.1 Identification of applicablelegislation and contractual
requirements
A.18.1.4 Privacy and protection of
personally identifiable information
ISO 27018 4.4.4.1 Disclosure of subcontracted PII
processing
ISO 27018 4.4.6.12 Contract
measures
ISO 27018 4.4.6.13 Sub-contracted
PII processing
HIPAA Compliance Guide

29

HIPAA Mapping

Security
rulesⒸ2024 Withings

Organizational safeguards

Organizationalsafeguards

164.314(a)(2)(iii) - Businessassociate contracts with
subcontractors

A.13.2.4 Confidentiality or
nondisclosure agreements
A.15.1.1 Information security policy forsupplier relationships
A.15.1.2 Addressing security within
supplier agreements
A.15.1.3 Information andcommunication technology supply
chain
A.15.2.1 Monitoring and review ofsupplier services
A.15.2.2 Managing changes tosupplier services
A.18.1.4 Privacy and protection of
personally identifiable information
ISO 27018 4.4.4.1 Disclosure of subcontracted PII
processing
ISO 27018 4.4.6.12 Contract
measures
ISO 27018 4.4.6.13 Sub-contracted
PII processing

HIPAA Compliance Guide

30

HIPAA Mapping

Securityrules

Organizational safeguards

Organizationalsafeguards

164.314(a)(2)(iii) - Businessassociate contracts with
subcontractors

A.13.2.4 Confidentiality or nondisclosureagreements A.15.1.1 Information security policy forsupplier relationships
A.15.1.2 Addressing security within supplier
agreements
A.15.1.3 Information and communication
technology supply chain
A.15.2.1 Monitoring and review of supplier services
A.15.2.2 Managing changes to supplier services
A.18.1.4 Privacy and protection of personallyidentifiable information ISO 27018 4.4.4.1 Disclosureof sub- contracted PII processing
ISO 27018 4.4.6.12 Contract measures
ISO 27018 4.4.6.13 Sub-contracted PII processing

Securityrules

Organizationalsafeguards

164.314(a)(2)(i) - Businessassociate contracts

A.15.1.1 Information security policy for supplier
relationships
A.15.1.2 Addressing security within supplier
agreements
A.15.1.3 Information and communication
technology supply chain
A.15.2.1 Monitoring and review of supplier services
A.15.2.2 Managing changes to supplier services

Securityrules

Organizationalsafeguards

164.316 - Policies
and procedures anddocumentation requirements

5.2 Information Security Policy ISO 27018 4.4.6.12
Contract measures+ almost all referencesⒸ2024 Withings

HIPAA Compliance Guide

31

HIPAA Mapping

HIPAA Privacy rules
HIPAA Rules References

Privacyrules

Privacy
RulesⒸ2024 Withings

Uses anddisclosures:
Organizational
requirements

Uses anddisclosures:
Organizational
requirements

ISO 27001:2017 / ISO/IEC 27018:2014/ ISO 20000-1:2011 References

164.504(e)(2) - Implementation
Specifications: Business
Associate Contracts

ISO 27018 4.4.5.3 PII return, transfer and disposal

164.504(e)(2) - Implementation
Specifications: Business
Associate Contracts

A.8.3.1 Management of removable media
A.8.3.2 Disposal of media
A.8.3.3 Physical media transfer
A.11.2.4 Equipment maintenance
A.11.2.5 Removal of assets
A.11.2.6 Security of equipment and assets
off-premises
A.11.2.7 Secure disposal or reuse of equipment
ISO 27018 4.4.5.3 PII return, transfer and disposal
ISO 27018 4.4.6.2 Restriction of the creation of hard
copy material
ISO 27018 4.4.6.4 Protecting data on storage
media leaving the premises
ISO 27018 4.4.6.5 Use of unencrypted portablestorage media and devices
ISO 27018 4.4.6.7 Secure disposal of hard copy
materials

HIPAA Compliance Guide

32

HIPAA Mapping
Privacy
Rules

Uses anddisclosures:
Organizational
requirements

Privacy
Rules

Uses anddisclosures:
Organizational
requirements

164.504(e)(2) - Implementation
Specifications: Business
Associate Contracts

ISO 27018 4.4.7.1 Geographical location of PII
Additional Requirements 4.5.5. Regionalization

164.504(e)(2) - Implementation
Specifications: Business
Associate Contracts

7.3 AwarenessA.7.2.2 Information security awareness, educationand training
A.7.1.2 Terms and conditions of employment
A.13.2.4 Confidentiality or nondisclosureagreements
A.7.1.2 Terms and conditions of employment
A.13.2.4 Confidentiality or nondisclosureagreements
A.16.1.7 Collection of evidence
A.18.1.1 Identification of applicable legislation andcontractual requirements
ISO 27018 4.4.2.1 Public cloud PII processor’s
purposeISO 27018 4.4.2.2 Public cloud PII processor’s
commercial use

Privacy
Rules

Uses anddisclosures:
Organizational
requirements

164.504(e)(4) - Implementation
Specifications: Other
Requirements for Contracts andOther Arrangements

Privacy
Rules

Access ofindividuals toprotected
healthinformation

ISO 27018 4.4.1.1 Obligation to cooperate regarding
164.524 - Access of Individuals to
PII principals’ rights
Protected Health Information
ISO 27018 4.4.5.3 PII return, transfer and disposalⒸ2024 Withings

HIPAA Compliance Guide

33

HIPAA Mapping

Privacy
Rules

Amendment ofprotected
healthinformation

164.526 - Amendment ofProtected Health Information

ISO 27018 4.4.1.1 Obligation to cooperate regarding
PII principals’ rights
ISO 27018 4.4.5.3 PII return, transfer and disposal

Privacy
Rules

Accounting of
disclosures ofprotected
healthinformation

164.528(a) - Right to an
Accounting of Disclosures

A.16.1.7 Collection of evidence
A.18.1.1 Identification of applicable legislation andcontractual requirementsⒸ2024 Withings

HIPAA Compliance Guide

34

HIPAA Mapping
HIPAA Breach Notification rules

HIPAA Rules References
BreachNotification
Rules
BreachNotification
Rules
BreachNotification
RulesⒸ2024 Withings

Notification

Notification

Notification

164.404 - Notification toindividuals

ISO 27001:2017 / ISO/IEC 27018:2014/ ISO 20000-1:2011 References
ISO 27018 4.4.3.2 PII disclosure notification
ISO 27018 4.4.3.3/4 Recording of PII disclosures
ISO 27018 4.4.5.1 Notification of a data breachinvolving PII

ISO 27018 4.4.3.2 PII disclosure notification
ISO 27018 4.4.3.3/4 Recording of PII disclosures
164.406 Notification to the media
ISO 27018 4.4.5.1 Notification of a data breachinvolving PII
164.408 - Notification to theSecretary

ISO 27018 4.4.3.2 PII disclosure notification
ISO 27018 4.4.3.3/4 Recording of PII disclosures
ISO 27018 4.4.5.1 Notification of a data breachinvolving PIIHIPAA Compliance Guide

35

HIPAA Mapping

BreachNotification
Rules

Notification

164.410 - Notification by abusiness associate

BreachNotification
Rules

Law
enforcement

164.412 - Law enforcement delay

Administrative
Breachrequirements
Notification
and burden of
Rules
proof

Ⓒ2024 Withings

164.414 - Administrativerequirements and burden of
proof

ISO 27018 4.4.3.2 PII disclosure notification
ISO 27018 4.4.3.3/4 Recording of PII disclosures
ISO 27018 4.4.5.1 Notification of a data breachinvolving PII

10.1 Nonconformity and corrective action

A.16.1.7 Collection of evidence A.18.1.1 Identificationof applicable legislation and contractual
requirements

HIPAA Compliance Guide

36