Isolating Health care Clearinghouse Function

frameworkHIPAA Security Rule section§164.308 Administrative safeguards statusRequired csf 2.0ID.AM-03 PR.AA-05 PR.DS-01 PR.DS-02 PR.DS-10 topics— frameworks1 0 0

Official textIf a healthcare clearinghouse is part of a larger organization, the clearinghouse must implement policies and procedures that protect the ePHI of the clearinghouse from unauthorized access by the larger organization.45 CFR Part 164 Subpart C, via NIST SP 800-66r2 (public domain)

gap from HIPAA → gap to HIPAA →

Wrong or missing mapping? Report it

Equivalents of §164.308(a)(4)(ii)(A) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.AM-03 PR.AA-05 PR.DS-01 PR.DS-02	Representations of the organization's authorized network communication and internal and external network data flows are maintained; Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties…	Loosely related	No mapping. Only shares CSF ID.AM-03, PR.AA-05, PR.DS-01, PR.DS-02: related, not a mapping +1 more loosely related (not mappings) PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected Loosely related Only shares CSF PR.DS-10: related, not a mapping
ISO 27001	A.5.14 A.5.3 A.5.15 A.8.2	Information transfer; Segregation of duties…	Loosely related	No mapping. Only shares CSF ID.AM-03, PR.AA-05, PR.DS-01, PR.DS-02…: related, not a mapping +36 more loosely related (not mappings) A.8.3 Information access restriction Loosely related Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.8.4 Access to source code Loosely related Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.8.22 Segregation of networks Loosely related Only shares CSF ID.AM-03, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.10 Acceptable use of information and other associated assets Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 32 more in the downloads
CIS v8.1	CIS 3.3 CIS 3.8 CIS 3.10 CIS 3.11	Configure Data Access Control Lists; Document Data Flows…	Loosely related	No mapping. Only shares CSF PR.AA-05, ID.AM-03, PR.DS-02, PR.DS-01: related, not a mapping +35 more loosely related (not mappings) CIS 5.1 Establish and Maintain an Inventory of Accounts Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 6.8 Define and Maintain Role-Based Access Control Loosely related Only shares CSF PR.AA-05: related, not a mapping CIS 3.1 Establish and Maintain a Data Management Process Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.4 Enforce Data Retention Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 31 more in the downloads
SOC 2	CC6.7 C1.2 CC6.1 CC6.5	Restricting transmission, movement and removal of information; Disposing of confidential information…	Loosely related	No mapping. Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping +4 more loosely related (not mappings) CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF ID.AM-03, PR.AA-05: related, not a mapping CC6.2 User registration, authorization and removal Loosely related Only shares CSF PR.AA-05: related, not a mapping CC6.3 Role-based access, least privilege and segregation of duties Loosely related Only shares CSF PR.AA-05: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Loosely related Only shares CSF PR.DS-02: related, not a mapping
PCI DSS	7.2.2 1.2.3 1.2.4 2.3.1	Access assigned by job function and least privilege; Accurate network diagram maintained…	Loosely related	No mapping. Only shares CSF PR.AA-05, PR.DS-10, ID.AM-03, PR.DS-02: related, not a mapping +31 more loosely related (not mappings) 3.2.1 Account data storage minimised, with retention and disposal Loosely related Only shares CSF PR.DS-10: related, not a mapping 3.3.1 Sensitive authentication data not kept after authorisation Loosely related Only shares CSF PR.DS-01: related, not a mapping 3.4.1 PAN masked when displayed Loosely related Only shares CSF PR.DS-10: related, not a mapping 3.5.1 PAN rendered unreadable wherever stored Loosely related Only shares CSF PR.DS-01: related, not a mapping …and 27 more in the downloads
CMMC	AC.L2-3.1.13 AC.L2-3.1.19 MP.L2-3.8.6 SC.L2-3.13.1	Remote Access Confidentiality; Encrypt CUI on Mobile…	Loosely related	No mapping. Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping +35 more loosely related (not mappings) SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.4 Shared Resource Control Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.5 Public-Access System Separation Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.6 Network Communication by Exception Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 31 more in the downloads
800-53	AC-5 AC-6 CA-3	Separation of Duties; Least Privilege…	Crosswalk	NIST HIPAA → SP 800-53 crosswalk 43 loosely related (not mappings) SC-4 Information in Shared System Resources Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-7 Boundary Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-13 Cryptographic Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-43 Usage Restrictions Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI-3 Malicious Code Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI-4 System Monitoring Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI-7 Software, Firmware, and Information Integrity Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping AC-2 Account Management Loosely related Only shares CSF PR.AA-05, PR.DS-10: related, not a mapping …and 35 more in the downloads
GDPR	Art.32(1)(b)Art.5(1)(e)Art.5(1)(f)Art.32(1)(a)	Security of processing; Principles relating to processing of personal data…	Loosely related	No mapping. Only shares CSF PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping +2 more loosely related (not mappings) Art.34(3)(a) Communication of a personal data breach to the data subject Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.25(2) Data protection by design and by default Loosely related Only shares CSF PR.AA-05: related, not a mapping
NIS2	9.1 4.3 11.1 11.2	Cryptography; Crisis management…	Loosely related	No mapping. Only shares CSF PR.DS-01, PR.DS-02, ID.AM-03, PR.AA-05: related, not a mapping +5 more loosely related (not mappings) 11.5 Identification Loosely related Only shares CSF PR.AA-05: related, not a mapping 11.6 Authentication Loosely related Only shares CSF PR.AA-05: related, not a mapping 12.3 Removable media policy Loosely related Only shares CSF PR.DS-01: related, not a mapping 12.4 Asset inventory Loosely related Only shares CSF ID.AM-03: related, not a mapping …and 1 more in the downloads
Essential Eight	ISM-0445 ISM-1175 ISM-1380 ISM-1387	Privileged human users are assigned a dedicated privileged user account to be used…; Privileged user accounts (excluding those explicitly authorised to access online……	Loosely related	No mapping. Only shares CSF PR.AA-05: related, not a mapping +17 more loosely related (not mappings) ISM-1488 Microsoft Office macros in files originating from the internet are blocked Loosely related Only shares CSF PR.DS-02: related, not a mapping ISM-1507 Requests for privileged access to systems and their resources are validated when first… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1508 Privileged access to systems and their resources is limited to only what is required… Loosely related Only shares CSF PR.AA-05: related, not a mapping ISM-1509 Privileged access events are centrally logged Loosely related Only shares CSF PR.AA-05: related, not a mapping …and 13 more in the downloads
DORA	Art.9(2)Art.9(3)(c)Art.9(3)(d)Art.9(3)(a)	Protection and prevention; Protection and prevention…	Loosely related	No mapping. Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping +3 more loosely related (not mappings) Art.9(4)(d) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.9(4)(b) Protection and prevention Loosely related Only shares CSF ID.AM-03: related, not a mapping Art.9(4)(c) Protection and prevention Loosely related Only shares CSF PR.AA-05: related, not a mapping
CPS 234	Para 21	Timely controls commensurate with risk and asset life-cycle	Loosely related	No mapping. Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping
Cyber Essentials	CE 1 CE 2 CE 4	Firewalls; Secure Configuration…	Loosely related	No mapping. Only shares CSF ID.AM-03, PR.AA-05: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.