IT Compliance category

Healthcare IT Compliance

Rules for software and services that create, store or transmit patient health information. 3 entries, 1 with a full guide.

Health data is a special category under almost every privacy law, and healthcare has its own sector rules on top. For US patient data, HIPAA applies to covered entities (providers, health plans, clearinghouses) and to their business associates, which includes most software vendors, hosting providers and IT support companies that handle protected health information.

HIPAA does not have an official certification. Vendors prove their controls with a risk analysis, policies, a signed business associate agreement and often an independent report such as SOC 2 or HITRUST. In the EU and India, health data falls under the GDPR's and the DPDP Act's general rules, with extra sector guidance.

Healthcare IT standards and laws

HIPAA

Health Insurance Portability and Accountability Act of 1996 (Privacy, Security, Breach Notification and Enforcement Rules)

Law Mandatory if in scope United States

HIPAA is the US federal law that protects health information. Its Privacy Rule limits how protected health information (PHI) is used and disclosed, its Security Rule requires administrative, physical and technical safeguards for electronic PHI, and its Breach Notification Rule sets deadlines for telling patients and HHS. It applies to covered entities and to business associates such as software vendors, cloud hosts and IT support firms that handle PHI on their behalf.

Covers, who needs it and key requirements
What it covers
Protected health information held or transmitted by covered entities and business associates: permitted uses and disclosures, patient rights, security risk analysis, safeguards for ePHI, business associate agreements and breach notification.
Who needs it
Health tech and EHR vendors, telehealth apps, medical billing and transcription providers, cloud and managed service providers, and offshore IT teams that create, receive, maintain or transmit PHI for US healthcare clients.
Why it matters
US healthcare clients cannot share PHI without a signed business associate agreement, and OCR fines and corrective action plans apply directly to business associates.
Applies in
United States (federal)
Key requirements
  • Sign business associate agreements (BAAs) with covered entities and your own subcontractors
  • Perform and document an accurate and thorough security risk analysis
  • Administrative safeguards: security officer, workforce training, access management, contingency plan
  • Physical safeguards: facility access, workstation and device controls
  • Technical safeguards: access control, audit controls, integrity, authentication, transmission security
  • Breach notification without unreasonable delay and no later than 60 days after discovery

HITRUST CSF

HITRUST Common Security Framework and e1, i1 and r2 assessments

Certifiable standard Voluntary US healthcare

HITRUST is a certifiable security and privacy framework widely used by US healthcare organisations and their vendors. The HITRUST CSF harmonises requirements from HIPAA, NIST, ISO and others, and offers three assessment levels: e1 (essential, one year), i1 (implemented, one year) and r2 (risk-based, two years). Assessments are performed by authorised external assessors and quality-checked by HITRUST before certification.

Covers, who needs it and key requirements
What it covers
A harmonised control framework covering information protection, access control, risk management, endpoint and network protection, incident management and privacy, mapped to HIPAA and other standards.
Who needs it
Health tech, healthcare SaaS, revenue cycle and IT vendors serving US hospitals and payers.
Why it matters
Many US health systems and payers ask vendors for HITRUST certification as proof of HIPAA-aligned security.
Applies in
United States origin; used mainly in US healthcare
Key requirements
  • Choose an assessment level (e1, i1 or r2)
  • Scope systems and implement the selected requirements
  • Readiness assessment and remediation
  • Validated assessment by an authorised assessor and HITRUST QA

21 CFR Part 11

US FDA 21 CFR Part 11: Electronic Records; Electronic Signatures

Regulation Mandatory if in scope US life sciences

21 CFR Part 11 sets the FDA's criteria for when electronic records and signatures are trustworthy and equivalent to paper. It applies to records required under FDA rules, such as clinical trial, manufacturing and quality records. Systems need validation, secure audit trails, access controls, record retention and controls on electronic signatures. Software companies serving pharmaceutical, biotech and medical device clients must support Part 11 and GxP validation.

Covers, who needs it and key requirements
What it covers
Validation, audit trails, record protection and retention, access and authority checks, device checks, training, signature manifestations and signature-record linking.
Who needs it
Life sciences companies and the software and SaaS vendors whose systems hold FDA-required records.
Why it matters
FDA inspectors check Part 11 controls, and pharma clients require vendor support for validation.
Applies in
United States (FDA-regulated activities); relied on worldwide by life sciences
Key requirements
  • Validate systems for accuracy and reliability
  • Secure, computer-generated, time-stamped audit trails
  • Limit system access to authorised individuals
  • Electronic signatures linked to records and unique to each person
  • Retain records and make them available for inspection

Need help with healthcare it compliance?

Get a gap assessment from vetted compliance and cybersecurity firms, or ask us a question.

Get an assessment Find a company

List your IT company for free

Create a profile in minutes, get reviewed by our editors and start receiving enquiries from clients looking for your skills.

Get listed free