# Compliance

Concept · [Cloud, hosting and security](https://ecosystem.samcarlton.com/cloud)

Also called: regulatory compliance, compliant, HIPAA, HIPAA compliant, GDPR, regulations, regulated industry

Meeting the laws, regulations and standards that apply to a company. In software the names heard most are HIPAA for US health information, GDPR for [personal data](https://ecosystem.samcarlton.com/data-privacy) of people in the European Union, and [PCI DSS](https://ecosystem.samcarlton.com/payments) for payment card data. Which ones apply to a company is a legal question.

**For example:** A startup wants to sell scheduling software to clinics. A clinic's lawyer asks whether the product will handle patient information that HIPAA covers.

## Connects to (24)

- [SOC 2](https://ecosystem.samcarlton.com/soc-2): An examination of how a service company protects customer data.
- [Data privacy](https://ecosystem.samcarlton.com/data-privacy): How a company collects, uses, stores and shares information about people.
- [Payments](https://ecosystem.samcarlton.com/payments): The service that lets a company charge customers' cards and bank accounts and receive the money.
- [Terms of service](https://ecosystem.samcarlton.com/terms-of-service): The legal agreement between a service and the people who use it.
- [Region](https://ecosystem.samcarlton.com/region): A geographic location where a cloud provider groups its data centers.
- [AI use policy](https://ecosystem.samcarlton.com/ai-use-policy): An organization's rules for which AI tools its people may use and what information they may put into them.
- [ISSA Oklahoma](https://ecosystem.samcarlton.com/issa-oklahoma): The Oklahoma chapter of the Information Systems Security Association, a professional group for cybersecurity workers.
- [First-party tracking](https://ecosystem.samcarlton.com/first-party-tracking): Collecting analytics on your own website through your own systems, rather than sending visitor data to outside ad or analytics companies.
- [IRS Section 7216](https://ecosystem.samcarlton.com/irs-section-7216): A US tax rule that limits how tax return preparers may use or disclose clients' tax return information without the client's consent.
- [Cyber liability insurance](https://ecosystem.samcarlton.com/cyber-liability-insurance): Insurance that helps pay the costs of a data breach or cyberattack, such as investigation, customer notification, legal costs and recovery.
- [ISO/IEC 27001](https://ecosystem.samcarlton.com/iso-27001): An international standard for running an information security management system.
- [Protected health information](https://ecosystem.samcarlton.com/protected-health-information): Under US health privacy law (HIPAA), health information that can identify a person, such as a diagnosis tied to a name.
- [NIST AI Risk Management Framework](https://ecosystem.samcarlton.com/nist-ai-rmf): A voluntary framework from NIST, the US standards agency, that helps organizations manage the risks AI can pose to people, organizations…
- [Government contracting](https://ecosystem.samcarlton.com/government-contracting): Selling products or services to a government agency under a formal contract.
- [ForHumanity](https://ecosystem.samcarlton.com/forhumanity): A nonprofit public charity that examines the risks of AI and develops criteria for the independent audit of AI systems, written by…
- [Federal Trade Commission](https://ecosystem.samcarlton.com/ftc): The US federal agency that enforces laws against unfair, deceptive and anticompetitive business practices.
- [FutureCon](https://ecosystem.samcarlton.com/futurecon): A series of one-day cybersecurity conferences in cities across North America, run by FutureCon Events, with talks, a panel and sponsor…
- [Women-owned small business certification](https://ecosystem.samcarlton.com/wosb-certification): A free US Small Business Administration certification that lets small businesses at least 51% owned and controlled by women who are US…
- [Oklahoma Corporation Commission](https://ecosystem.samcarlton.com/oklahoma-corporation-commission): The Oklahoma state regulator for fuel, oil and gas, public utilities and transportation.
- [TechAccess Oklahoma](https://ecosystem.samcarlton.com/techaccess-oklahoma): A digital accessibility conference held in Oklahoma City, organized by the Digital Accessibility Team at Oklahoma ABLE Tech at Oklahoma…
- [Fractional CISO](https://ecosystem.samcarlton.com/fractional-ciso): A part-time security leader.
- [Data processing agreement](https://ecosystem.samcarlton.com/data-processing-agreement): A contract that says how a service provider may handle personal data for its customer: what it may do with the data, how it keeps the data…
- [Business associate agreement](https://ecosystem.samcarlton.com/business-associate-agreement): A contract that US health privacy law (HIPAA) requires before a clinic, health plan or other covered organization lets an outside company…
- [Palo Alto Networks](https://ecosystem.samcarlton.com/palo-alto-networks): A cybersecurity company that sells firewalls and security software to businesses, schools and governments.

> This glossary is plain-language orientation, not legal or financial advice. Before you decide on a company structure, a contract, taxes or a fundraising deal, talk with a lawyer or an accountant.

Map view: https://ecosystem.samcarlton.com/compliance