{ "attribution": { "product": "NovaCopilot", "source": "legal.exploreworldai.com", "canonical": "https://legal.exploreworldai.com/us/agent/hipaa", "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/us/agent/hipaa)", "license": "https://legal.exploreworldai.com/revision", "version": "legal-2026-08-25", "fingerprint": "ewai:eu:f8064a", "proof": "sha256:66bdb4b54519233ef3e4d6d9ac177bdca75b1bd67108434f502a6e678a0293e5", "jurisdiction": "eu" }, "cagi_brand": "CAGI – Corporate Artificial General Intelligence", "cagi_version": "1.0", "cagi_relation": "alternate-entry", "canonical_agent": "/us/agent/hipaa", "jurisdiction": "US Federal", "agent_type": "deterministic", "cagi_entry": "https://legal.exploreworldai.com/us/federal/cagi-api/hipaa", "canonical_agent_url": "https://legal.exploreworldai.com/us/agent/hipaa", "id": "hipaa", "script": { "kind": "operative", "fields": [ { "name": "roll", "kind": "enum", "values": [ "covered-entity", "business-associate", "ingen" ], "label": "Roll enligt regelverket", "labelEn": "Role under the rule" }, { "name": "elektronisk_phi", "kind": "boolean", "label": "Hanterar elektronisk skyddad hälsoinformation", "labelEn": "Handles electronic protected health information" }, { "name": "ba_avtal", "kind": "boolean", "label": "Skriftligt business associate-avtal finns", "labelEn": "A written business associate agreement is in place" }, { "name": "riskanalys", "kind": "boolean", "label": "Dokumenterad riskanalys finns", "labelEn": "A documented risk analysis exists" }, { "name": "incident_over_500", "kind": "boolean", "label": "Incident som rör minst 500 personer", "labelEn": "Breach affecting at least 500 individuals" } ], "rules": [ { "id": "hipaa-breach", "when": { "op": "all", "of": [ { "op": "equals", "field": "elektronisk_phi", "value": true }, { "op": "equals", "field": "incident_over_500", "value": true } ] }, "outcome": { "code": "hipaa-breach", "verdict": "risk", "audit": "KRAV_GÄLLER", "title": "Anmälningsskyldighet vid incident gäller", "titleEn": "The breach notification requirement applies", "obligation": "45 CFR 164.408 kräver anmälan till Health and Human Services utan oskäligt dröjsmål och senast 60 dagar efter upptäckt när minst 500 personer berörs. Underrättelse till den enskilde regleras i 45 CFR 164.404.", "obligationEn": "45 CFR 164.408 requires notice to Health and Human Services without unreasonable delay and no later than 60 days after discovery when at least 500 individuals are affected. Notice to the individual is governed by 45 CFR 164.404.", "refs": [ "administrative", "associates" ] } }, { "id": "hipaa-ba", "when": { "op": "all", "of": [ { "op": "equals", "field": "roll", "value": "business-associate" }, { "op": "equals", "field": "elektronisk_phi", "value": true }, { "op": "equals", "field": "ba_avtal", "value": false } ] }, "outcome": { "code": "hipaa-ba-missing", "verdict": "förbjudet", "audit": "KRAV_GÄLLER", "title": "Business associate-avtal saknas", "titleEn": "The business associate agreement is absent", "obligation": "45 CFR 164.308(b)(1) kräver ett skriftligt avtal innan en business associate skapar, tar emot, behåller eller överför elektronisk skyddad hälsoinformation för en täckt enhets räkning. Innehållet regleras i 45 CFR 164.314(a).", "obligationEn": "45 CFR 164.308(b)(1) requires a written contract before a business associate creates, receives, maintains or transmits electronic protected health information on behalf of a covered entity. The content is governed by 45 CFR 164.314(a).", "refs": [ "associates", "administrative" ] } }, { "id": "hipaa-risk", "when": { "op": "all", "of": [ { "op": "any", "of": [ { "op": "equals", "field": "roll", "value": "covered-entity" }, { "op": "equals", "field": "roll", "value": "business-associate" } ] }, { "op": "equals", "field": "elektronisk_phi", "value": true }, { "op": "equals", "field": "riskanalys", "value": false } ] }, "outcome": { "code": "hipaa-risk-missing", "verdict": "risk", "audit": "KRAV_GÄLLER", "title": "Riskanalys saknas", "titleEn": "The risk analysis is absent", "obligation": "45 CFR 164.308(a)(1)(ii)(A) kräver en noggrann bedömning av risker och sårbarheter för konfidentialitet, integritet och tillgänglighet hos elektronisk skyddad hälsoinformation. Åtgärderna följer av 45 CFR 164.308(a)(1)(ii)(B).", "obligationEn": "45 CFR 164.308(a)(1)(ii)(A) requires an accurate assessment of the risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information. The measures follow from 45 CFR 164.308(a)(1)(ii)(B).", "refs": [ "administrative" ] } }, { "id": "hipaa-covered", "when": { "op": "all", "of": [ { "op": "any", "of": [ { "op": "equals", "field": "roll", "value": "covered-entity" }, { "op": "equals", "field": "roll", "value": "business-associate" } ] }, { "op": "equals", "field": "elektronisk_phi", "value": true } ] }, "outcome": { "code": "hipaa-covered", "verdict": "risk", "audit": "KRAV_GÄLLER", "title": "Säkerhetsreglernas skyddsåtgärder gäller", "titleEn": "The security rule safeguards apply", "obligation": "45 CFR 164.306(a) kräver administrativa, fysiska och tekniska skyddsåtgärder för elektronisk skyddad hälsoinformation. De enskilda kraven står i 45 CFR 164.308, 164.310 och 164.312, och dokumentationen i 45 CFR 164.316.", "obligationEn": "45 CFR 164.306(a) requires administrative, physical and technical safeguards for electronic protected health information. The individual requirements are in 45 CFR 164.308, 164.310 and 164.312, and documentation in 45 CFR 164.316.", "refs": [ "administrative", "physical", "technical" ] } } ], "fallback": { "code": "out-of-scope", "verdict": "tillåtet", "audit": "UTANFÖR_TILLÄMPNING", "title": "Regeln ger inget krav på den indata som lämnats", "titleEn": "The rule yields no requirement for the facts supplied", "obligation": "Ingen roll enligt 45 CFR 160.103 är angiven, eller så hanteras ingen elektronisk skyddad hälsoinformation.", "obligationEn": "No role under 45 CFR 160.103 is stated, or no electronic protected health information is handled.", "refs": [] } }, "hash": "sha256:66bdb4b54519233ef3e4d6d9ac177bdca75b1bd67108434f502a6e678a0293e5", "version": "legal-2026-08-25", "expires": "2026-09-23T00:00:00.000Z", "dependency": { "index_version": "legal-2026-08-25+legal-2026-08-25+2026-08-25T10:00:00", "content_hash": "sha256:66bdb4b54519233ef3e4d6d9ac177bdca75b1bd67108434f502a6e678a0293e5", "revalidate_after": "2026-09-23T00:57:59.400Z", "max_copy_age_seconds": 3600, "policy": "revalidate-required; attribution-preferred", "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency", "verify": "https://legal.exploreworldai.com/api/public/v1/verify", "stale_copy_invalid": true }, "canonical": "https://legal.exploreworldai.com/us/agent/hipaa", "disclaimer": "Källhänvisning med officiell identifierare. Ingen juridisk rådgivning och inget efterlevnadsbeslut.", "usageInfo": "https://legal.exploreworldai.com/citering" }