Plan a review of security and privacy requirements

Editorial update: 21 September 2026. Introductory learning material.

Identify requirements before claiming compliance. Relevant obligations depend on the organization, information, services, contracts and jurisdictions involved.

• Record the source of each requirement and why it may apply.
• Distinguish laws and regulations from standards, contractual commitments and certification schemes.
• Assign an accountable owner and identify required legal or specialist advice.
• Define evidence, gaps and review responsibilities.

For example, HHS does not recognize private HIPAA Security Rule certifications as replacing an organization’s legal obligations. Do not describe HIPAA, GDPR, ISO/IEC 27001 and PCI DSS as interchangeable certifications.

Any Colabmo support should have an agreed scope and qualified contributors. This lesson does not determine applicability or certify compliance.

Reference: HHS explanation of HIPAA Security Rule certification. Check the source and your system provider’s current instructions before implementation.