Does HIPAA apply to your company?
Required by law when: We do business in the United States + We handle health data (PHI)
HIPAA Security Rule (45 CFR 164) — binds only a US covered entity or business associate handling PHI; BAA chain (§164.308(b))
See the full list for this profileA prioritization aid, not legal advice. Every basis is shown so your counsel can check it.