HIPAA architecture
HIPAA safeguards for a customer data platform (CDP)
This customer data platform (CDP) architecture guide helps security teams map a proposed deployment to HIPAA safeguards. It covers control ownership and evidence; Healthcare addresses buyer workflows and the HIPAA comparison addresses vendor selection.
Confirm hosting, support and destination scope
Approved sources
Restricted profiles
Access and audit
Permitted destinations
Scope and evidence
Map the Security Rule to operating owners
HHS describes administrative, physical and technical safeguards for electronic protected health information. Assess the actual system, responsible parties and evidence rather than relying on a private-hosting label.
Primary source: HHS Security Rule overview.
Administrative safeguards
Assign access, training, risk-management, incident and contingency responsibilities. Document how those procedures apply to the proposed customer-managed system.
Physical safeguards
Identify the facility and hosting owners, access procedures and equipment lifecycle. Review the actual hosting service and agreements rather than assuming a deployment label settles the controls.
Technical safeguards
Test authorized access, denied access, audit records, integrity checks and transmission protections. Retain the configuration and result; a feature description is not evidence that a safeguard is enabled.
Trace PHI through hosting, support and activation
List the records, identifiers and permitted purposes, then map every source, destination, log and backup. Identify parties that process or maintain PHI on behalf of the covered entity and review their responsibilities. HHS guidance explains that cloud use can be permissible with appropriate safeguards and agreements; this page does not assert that shared hosting is categorically prohibited or that encryption alone removes business associate obligations. HHS cloud computing guidance.
Prepare deployment-specific acceptance evidence
Use synthetic patient records to test a least-privilege account, revoked access, consent restriction, approved export and failed destination. Confirm how the evidence is retained and who can inspect it. Have the privacy and security owners review the agreements and unresolved gaps before production. No claim is made that every control is enabled by default or that a PrivyCDP deployment has been independently certified.
This page covers safeguard mapping. The healthcare hub covers buyer workflows, and the HIPAA vendor comparison covers PHI, BAA and tracking evidence. For privacy engineering context, read privacy-first martech.
Discuss your deployment with engineers.
Bring your data flow, operating owners and evaluation questions.
Frequently asked questions
Is a self-hosted customer data platform HIPAA compliant?
Self-hosting alone does not establish compliance. Assess the covered workflow, safeguards, operating procedures and agreements with your privacy and security owners. Primary source
Can a cloud service process PHI?
HHS describes conditions for cloud use, including appropriate agreements and safeguards. Review the exact service and data flow rather than excluding every hosted service. Primary source
Does encryption remove business associate obligations?
Do not assume encryption alone removes obligations. HHS addresses cloud providers that maintain encrypted PHI without holding the decryption key. Primary source
Which access controls should our pilot test?
Test least-privilege roles, privileged access, revoked users and audit export with synthetic records. Retain configuration-specific results for the security review. Primary source
Does PrivyCDP publish a HIPAA certification here?
No certification is presented. Request evidence for your selected release and have the responsible reviewers determine whether the proposed workflow meets applicable requirements. Primary source
Where should healthcare buyers start?
Start with the healthcare industry hub, map PHI and destinations, then use the HIPAA comparison to request vendor and business associate evidence. Primary source
Further reading
- Customer data regulation guides
- HIPAA-Compliant CDP: What It Takes
- DORA and Your Marketing Stack: Register
- CDP for Healthcare: PHI On-Prem
- Security and ownership
Published: · Updated:
Editorial dates describe content changes. Confirm current sources before making legal, security or purchasing decisions.