Security review should match the proposed services, data, systems, people, subprocessors, and contractual responsibilities. This page explains the questions and evidence to verify before protected health information is exchanged.
A marketing statement is not a substitute for contracting, evidence review, risk analysis, or the safeguards required for the actual relationship.
This page does not claim that Revyn has been certified as HIPAA compliant. HHS says certification cannot replace a required business-associate contract. HHS also says private Security Rule evaluations may be performed, but it does not recognize those certifications as establishing compliance or preventing later enforcement findings.
Nothing on this page is a signed business associate agreement. Whether a BAA is required and acceptable must be determined from the parties, services, data, and applicable requirements.
Policies, controls, systems, access, subprocessors, incident terms, continuity, data return, and contract language should be reviewed for the specific proposed engagement.
The exact evidence depends on the work and systems in scope. These categories organize the review without asserting that a control has been tested or certified.
Map what information is created, received, maintained, transmitted, viewed, exported, retained, and returned—and why each access path is needed.
Review authorization, role design, account provisioning, authentication, privileged access, access review, termination, logging, and exception handling.
Review assigned responsibility, risk analysis and management, policy governance, workforce training, sanctions, documentation, and periodic evaluation.
Review system boundaries, transmission and storage safeguards, device and workspace controls, audit controls, integrity processes, and approved tools.
Review identification, escalation, containment, documentation, notification responsibilities, restoration, backups, downtime procedures, and testing evidence.
Identify downstream parties and obligations, then confirm access removal, data return or destruction, transition support, retention, and surviving responsibilities.
Last content review: August 6, 2026. HHS materials provide the authoritative federal context cited here. This page is general information, not legal advice or proof that a particular agreement or safeguard satisfies an organization’s obligations.
Start with the services, systems, data, access, parties, and responsibilities under consideration, then identify the evidence and agreements that require review.