Evidence is what separates a defensible HIPAA program from a hopeful one. Evidence Management is the ledger — every control, every artefact, every date — and the thing you hand an OCR investigator or a customer’s security team on request.
What it does
- Attaches a timestamped evidence file to every §164 control, with the hash and source captured.
- Flags expiring evidence before it goes stale, so the review calendar never surprises you.
- Produces an indexed Evidence Package on demand, scoped by rule, date range, or vendor.
- Retains six-year history per §164.316(b)(2)(i), including superseded versions.
How it maps to HIPAA
The store directly satisfies §164.316(b)(1) (documentation) and (b)(2) (retention), and feeds every other standard: a control without a current evidence file is a finding in waiting. For addressable specifications the store also captures the documented rationale — the artefact that keeps “addressable” from reading as “ignored”.
Where it fits
Evidence Management is a backbone capability of the Compliance Management module. Automated collection runs through AI Evidence Collection, and the exportable artefact is the Evidence Package report.