HIPAA Inheritance

Wildfire Labs partners with Datica for HIPAA compliant and HITRUST CSF certified hosting. Datica's Platform-as-a-Service ("PaaS") allows customers such as Wildfire Labs to inherit certain administrative, physical, technical, organizational, and policy controls as required by HIPAA and HITECH. This section outlines HIPAA and HITECH requirements that Wildfire Labs inherits from Datica (all Datica policies can be found here):

Administrative Controls

HIPAA Rule	Datica Policy Link	Wildfire Labs Inheritance
Security Management Process - 164.308(a)(1)(i)	Risk Management Policy​	Yes
Assigned Security Responsibility - 164.308(a)(2)	Roles Policy​	Partially
Workforce Security - 164.308(a)(3)(i)	Employee Policies​	Partially
Information Access Management - 164.308(a)(4)(i)	System Access Policy​	Yes
Security Awareness and Training - 164.308(a)(5)(i)	Employee Policy​	No
Security Incident Procedures - 164.308(a)(6)(i)	IDS Policy​	Yes
Contingency Plan - 164.308(a)(7)(i)	Disaster Recovery Policy​	Yes
Evaluation - 164.308(a)(8)	​Auditing Policy​	Yes

Technical Safeguards

HIPPA Rule	Datica Policy Link(s)	Wildfire Labs Inheritance
Access Control - 164.312(a)(1)	System Access Policy	Partially
Audit Controls - 164.312(b)	Auditing Policy	Yes
Integrity - 164.312('c’)(1)	System Access, Auditing, and IDS Policies	Yes
Person or Entity Authentication - 164.312(d)	System Access Policy	Yes
Transmission Security - 164.312(e)(1)	System Access and Data Management Policies	Yes

Organizational Requirements

HIPAA Rule	Datica Policy Link(s)	Wildfire Labs Inheritance
Business Associate Contracts or Other Arrangements - 164.314(a)(1)(i)	Business Associate Agreements and 3rd Party Policies	Partially

Policies and Procedures and Documentation Requirements

HIPAA Rule	Datica Policy Link(s)	Wildfire Labs Inheritance
Policies and Procedures - 164.316(a)	Management Policy	Partially
Documentation - 164.316(b)(1)(i)	Management Policy	Partially

HITECH Act - Security Provisions

HIPAA Rule	Datica Policy Link(s)	Wildfire Labs Inheritance
Notification in the Case of Breach - 13402(a) and (b)	Breach Policy	Partially
Timelines of Notification - 13402(d)(1)	Breach Policy	Partially
Content of Notification - 13402(f)(1)	Breach Policy	Partially