Compliance Management — SuperHIPAA Platform

One dashboard for every §164 requirement, the control that satisfies it, the evidence behind it, and the person who owns it.

What this module does

Live compliance score mapped to the Security, Privacy, and Breach Notification Rules
Task queue with owners, due dates, and Slack/Teams nudges
Evidence library with automatic freshness expiry
Policy manager with version history and workforce acknowledgement
Auditor and customer share links — read-only, time-boxed, watermarked

What it replaces

Manual spreadsheet trackers that go stale the week after the audit
Screenshot folders in Drive with no timestamps
Not knowing which of the 54 implementation specifications you have actually met

How it maps to the rule

Every item above is linked to a specific implementation specification in 45 CFR §164. Open any control and you see the citation, whether it is required or addressable, what you have implemented, and the evidence proving it. If a specification is addressable and you chose not to implement it, the platform makes you record the rationale — because that rationale is the thing an investigator asks for.

Included in every plan

Starter, Growth, and Enterprise all include this module. We do not price HIPAA modules separately, because a partial Security Rule implementation is not a product, it is a liability.

What happens after you fill the form

You get the deliverable immediately. No “a rep will contact you to unlock your download.”
We read your answers before we call. The scoping call starts with what you told us, not a discovery script.
You get a fixed-scope, fixed-price proposal in 2 business days — or a straight “you don’t need us yet,” which we say more often than you’d expect.

On the word “certified.” There is no government HIPAA certification. Any vendor selling you a “HIPAA Certificate” is selling a PDF they printed themselves. What regulators, customers, and insurers actually accept is a documented risk analysis, implemented safeguards, and evidence that both are maintained. That is what SuperHIPAA produces.

Questions

Does Compliance Management work if we are a business associate, not a covered entity?

Yes. The module ships with both scopes. Business associates get the subcontractor and downstream-BAA views turned on by default; covered entities get patient-rights workflows turned on.

Can we export everything if we leave?

Yes — policies as DOCX, evidence as a timestamped ZIP, registers as XLSX. No export fee, no lock-in clause.

Is this the same platform as LowerPlane?

It runs on the LowerPlane compliance engine. SuperHIPAA is the HIPAA-specific configuration of it, so you can add SOC 2, ISO 27001, or GDPR later without re-implementing anything.

Does it distinguish required from addressable specifications?

Yes, and it treats addressable correctly: not optional. You either implement the specification or document why an alternative is reasonable and appropriate — and the platform forces that documentation instead of letting the item quietly disappear.

Can we manage multiple legal entities in one workspace?

Yes. Each entity gets its own scope and risk register while shared policies and controls are managed once. Useful for groups running both covered-entity and business-associate lines.

What happens when the HIPAA rules change?

We update the control mappings and flag every policy, task, and control affected, so you see exactly what changed and what needs your attention — not a vague changelog.

Is evidence collection manual or automated?

Both. Integrations pull what they can automatically; recurring tasks with named owners cover the rest. Either way, every item is timestamped and mapped to the specification it supports.

Compliance Management built for HIPAA, not bolted onto it