HIPAA Compliance for Software & IT Vendors: Full Guide

If your software stores, processes or transmits health information for a US hospital, clinic, insurer or digital health company, HIPAA will come up in the first sales call. This guide explains who HIPAA applies to, what "business associate" status means for a software vendor or IT service provider, what the Security Rule requires, and how to prepare a product and a team to sign a business associate agreement with confidence.

Quick answer: HIPAA is a US federal law. Its Privacy, Security and Breach Notification Rules (45 CFR Parts 160 and 164) apply to covered entities (health plans, healthcare clearinghouses and most healthcare providers) and to their business associates, which include software, cloud and IT service vendors that handle protected health information (PHI). Compliance is mandatory if you fall into one of those groups and irrelevant if you do not. There is no official HIPAA certification; compliance is shown through a risk analysis, safeguards, policies, signed business associate agreements and, often, third-party reports.

What is HIPAA?

HIPAA is the federal law that, among other things, sets national standards for the privacy and security of health information in the United States. The rules are written and enforced by the Department of Health and Human Services (HHS), mainly through its Office for Civil Rights (OCR).

Full form and definition

HIPAA stands for the Health Insurance Portability and Accountability Act of 1996. For IT companies, "HIPAA compliance" usually means meeting the HIPAA Administrative Simplification rules:

Privacy Rule: when PHI may be used and disclosed, and individuals' rights over it.
Security Rule: administrative, physical and technical safeguards for electronic PHI (ePHI).
Breach Notification Rule: notice to individuals, HHS and sometimes the media after a breach of unsecured PHI.
Enforcement Rule: investigations and civil money penalties.

What counts as PHI?

Protected health information is individually identifiable health information held or transmitted by a covered entity or business associate, in any form. It includes demographic data linked to health status, care or payment, so an appointment record with a name and a clinic is PHI. Health data a consumer app collects directly from users, with no covered entity involved, is usually not PHI under HIPAA, although other laws, such as the FTC Health Breach Notification Rule and state health privacy laws, may apply.

History and background of HIPAA

HIPAA was enacted in 1996, initially to protect health insurance coverage when people changed jobs. Its Administrative Simplification provisions required standard electronic transactions and, with them, privacy and security rules. The Privacy Rule took effect for most covered entities in April 2003 and the Security Rule in April 2005.

The HITECH Act of 2009 made business associates directly liable for Security Rule compliance, created the Breach Notification Rule and increased penalties. The Omnibus Rule of 2013 implemented HITECH, extending liability to subcontractors of business associates.

Why was HIPAA introduced?

Standardising electronic healthcare transactions made data flow faster, which also made it easier to misuse. Congress paired standardisation with federal privacy and security protections so patients could trust the shift to electronic records.

What is changing?

On 6 January 2025 HHS published a proposed rule to overhaul the Security Rule. It would, among other things, remove the distinction between "required" and "addressable" safeguards, require written technology asset inventories and network maps, mandate encryption and multi-factor authentication with limited exceptions, and require regular compliance audits. As of October 2026 this rule is not final. The current Security Rule applies; many organisations are nonetheless using the proposal as a roadmap because it reflects what OCR already expects.

Main objectives and purpose

Protect the confidentiality, integrity and availability of ePHI.
Limit uses and disclosures of PHI to what the rules permit, and to the minimum necessary.
Give individuals rights, including access to their records.
Make sure breaches are disclosed so people can protect themselves.
Hold vendors that handle PHI to the same security standards as providers and plans.

Who needs HIPAA compliance?

Covered entities

Health plans, healthcare clearinghouses and healthcare providers that conduct standard electronic transactions (such as insurance claims).

Business associates

A person or company that creates, receives, maintains or transmits PHI on behalf of a covered entity, or provides certain services involving PHI. For IT companies this typically includes:

EHR, practice management, telehealth, billing and patient engagement software vendors
Cloud and hosting providers that store ePHI, even if the data is encrypted and the provider holds no key (HHS cloud computing guidance)
Managed service providers, help desks and IT support firms with access to systems containing PHI
Development agencies that build or maintain systems with real patient data
Subcontractors of business associates, such as your own hosting provider or offshore support team

Pure conduits that only transmit data, such as an internet service provider, are generally not business associates.

Geography

HIPAA is US law, but a vendor outside the US that handles PHI for a US covered entity is still a business associate under its contract. Offshore development and support teams for US healthcare clients are common, and the business associate agreement (BAA) is how the obligations reach them.

Key requirements of HIPAA

Security Rule: administrative safeguards

Risk analysis and risk management (45 CFR 164.308(a)(1)): an accurate, thorough assessment of risks to ePHI and measures to reduce them. This is the requirement OCR cites most often in enforcement.
A designated security official
Workforce security, access management and sanctions
Security awareness training
Security incident procedures
Contingency plan: data backup, disaster recovery and emergency mode operations
Periodic evaluation
Business associate agreements with subcontractors

Security Rule: physical safeguards

Facility access controls, workstation use and security, and device and media controls, including disposal and reuse. For cloud-native companies most of this is inherited from the cloud provider for data centres, but laptops and offices remain your responsibility.

Security Rule: technical safeguards

Access control: unique user IDs, emergency access, automatic logoff, encryption and decryption (currently addressable)
Audit controls that record activity in systems with ePHI
Integrity controls against improper alteration or destruction
Person or entity authentication
Transmission security, including encryption in transit (currently addressable)

"Addressable" does not mean optional. You must implement the specification if reasonable and appropriate, or document why not and what equivalent measure you use. In practice, encryption at rest and in transit is expected.

Privacy Rule duties for business associates

Business associates may use and disclose PHI only as the BAA permits, must apply the minimum necessary standard, and must help the covered entity meet individuals' rights, such as access and amendment.

Breach Notification Rule

A breach of unsecured PHI is presumed reportable unless a documented four-factor risk assessment shows a low probability of compromise. Covered entities notify affected individuals without unreasonable delay and no later than 60 days after discovery; notify HHS (immediately for 500 or more people, annually for smaller breaches); and notify prominent media for breaches affecting more than 500 residents of a state or jurisdiction. Business associates must notify the covered entity without unreasonable delay and no later than 60 days after discovery; many BAAs shorten this.

Documentation retention

Required policies, procedures and records must be kept for six years from creation or last effective date (45 CFR 164.316).

How to implement HIPAA compliance: step by step

Confirm your status. Determine whether you are a covered entity, business associate or neither, product by product.
Map PHI. Find every place PHI is created, stored, processed or sent, including logs, analytics, error trackers, support tools and email.
Run a risk analysis. Assess threats and vulnerabilities to ePHI and rate the risks. Use the HHS Security Risk Assessment tool or a recognised method such as NIST CSF-aligned assessment.
Close gaps. Typical fixes: MFA everywhere, encryption, central logging with retention, endpoint management, least-privilege access, backup and restore tests.
Write policies and procedures covering each Security Rule standard and your Privacy Rule duties as a business associate.
Sign BAAs with every vendor that touches PHI on your behalf, and use only services the vendor will cover under a BAA (many cloud services are BAA-eligible only in certain configurations).
Train the workforce at onboarding and periodically, with records.
Prepare incident and breach response, including the four-factor assessment and notification templates.
Evaluate periodically and after major changes; many vendors add an independent assessment or a SOC 2 report to give customers assurance.

Documentation required

Risk analysis and risk management plan
Security policies and procedures for each standard, including documented decisions on addressable specifications
Designation of the security (and, for covered entities, privacy) official
Business associate agreements, upstream and downstream
Training materials and attendance records
Access reviews, audit log reviews and sanctions records
Contingency plan, backup and restore test records
Incident log, breach risk assessments and notifications
Periodic evaluation reports

Audit and assessment requirements

HIPAA does not require an annual external audit or certification. OCR investigates complaints and breach reports and runs periodic audit programmes. Covered entity customers will assess you through questionnaires and contract terms. To give assurance, vendors commonly obtain a SOC 2 report with HIPAA mapping, an ISO 27001 certificate, or HITRUST certification. None of these is a "HIPAA certificate"; they are evidence that your controls meet the rule's expectations.

Estimated implementation timeline

Typical timeline for a health tech software vendor
Phase	Duration
Status, PHI mapping and risk analysis	3 to 6 weeks
Technical remediation (MFA, encryption, logging, backups)	4 to 12 weeks
Policies, BAAs and training	3 to 6 weeks, in parallel
Incident response tests and first evaluation	2 to 4 weeks

A vendor that already runs ISO 27001 or SOC 2 can often reach business associate readiness in 6 to 10 weeks.

Cost considerations

Risk analysis and gap assessment by a consultant or internal team
Security tooling: identity provider with MFA, device management, logging and monitoring
BAA-eligible cloud services, which can cost more or limit service choices
Legal review of BAAs
Optional third-party assurance (SOC 2, HITRUST)
Ongoing staff time for evaluations, training and access reviews

Benefits of HIPAA compliance

Access to the US healthcare market, where BAAs are a precondition for any deal involving PHI.
Lower breach likelihood and impact; healthcare is one of the most targeted sectors for ransomware.
Faster security reviews with a ready evidence pack.
A security programme that maps well to NIST and ISO frameworks used elsewhere.

Risks and consequences of non-compliance

Civil money penalties in four tiers based on culpability, from lack of knowledge to uncorrected wilful neglect, with per-violation amounts and annual caps that HHS adjusts for inflation.
Resolution agreements with OCR, often including payments and multi-year corrective action plans with monitoring.
Criminal penalties for knowingly obtaining or disclosing PHI in violation of HIPAA: up to USD 50,000 and one year in prison, rising to USD 250,000 and ten years where the intent is commercial advantage, personal gain or malicious harm.
State attorney general actions, which HITECH authorised.
Contract termination and indemnity claims under BAAs.

Common implementation mistakes

No real risk analysis, or a template completed once and never updated.
PHI leaking into logs, error tracking, analytics or support tickets processed by vendors without a BAA.
Using cloud services that are outside the provider's BAA scope.
Assuming "HIPAA-compliant hosting" makes the application compliant.
Shared accounts and no audit trail for access to patient data.
Backups that are never restored in a test.
Agreeing to BAA notification deadlines your incident process cannot meet.

Compliance challenges for IT companies

Shared responsibility: the cloud provider secures infrastructure; you secure configuration, identity, application and data.
Offshore access: customers may restrict where PHI can be accessed from, which affects staffing models.
Test data: developers need realistic data; use properly de-identified or synthetic data instead of production PHI. HIPAA de-identification requires either the Safe Harbor method (removing 18 identifier types) or an expert determination.
AI features: sending PHI to an AI model provider requires a BAA with that provider and a check that the provider does not retain or train on the data contrary to the BAA.

Best practices and recommendations

Keep PHI in as few systems as possible and tokenise identifiers elsewhere.
Encrypt everywhere, and manage keys separately from data.
Enforce phishing-resistant MFA for all staff with production access.
Monitor access to PHI and review alerts, not just collect logs.
Prepare for the proposed Security Rule changes now; they align with modern baseline security.
Use NIST SP 800-53 or CIS Controls to make "reasonable and appropriate" concrete.

Tools and technologies that help

Identity providers with SSO, MFA and automated de-provisioning
Cloud security posture management to catch misconfigured storage and networks
Centralised logging and SIEM with alerting on PHI access
Data loss prevention and data discovery tools
Compliance automation platforms that map controls and collect evidence
Backup services with immutable copies to resist ransomware

Relationship with other compliance frameworks

HIPAA and related frameworks
Framework	Relationship
SOC 2	Common way for vendors to evidence HIPAA-aligned security controls; can include a HIPAA mapping
ISO 27001	Management system and controls that cover most Security Rule safeguards
NIST CSF and SP 800-53	HHS publishes mappings between the Security Rule and NIST frameworks
GDPR	Health data of people in the EU is special category data under the GDPR; both can apply to one product
CCPA/CPRA	Exempts PHI governed by HIPAA but may cover other consumer health data

Real-world implementation examples

The following are illustrative composites based on common patterns, not named clients.

Telehealth start-up

A video consultation start-up found that its error tracker and customer support platform were receiving patient names and symptoms. It scrubbed PHI from logs, moved support to a BAA-covered plan, signed BAAs with its cloud and video providers, ran a risk analysis and documented its safeguards. Its first hospital customer signed after a six-week review.

Offshore development partner

An Indian development company maintaining a US clinic network's patient portal signed a BAA, moved all development to synthetic data, restricted production access to two named engineers through a logged bastion with MFA, and added HIPAA training to onboarding.

Frequently asked questions

Is there an official HIPAA certification?

No. HHS does not certify organisations or products. Any "HIPAA certification" is a private assessment or training credential, not government approval.

Is my software company a business associate?

If your product or service creates, receives, maintains or transmits PHI on behalf of a covered entity or another business associate, yes.

Does HIPAA apply to health and fitness apps?

Not usually, if the app collects data directly from consumers and is not offered on behalf of a covered entity. Other laws, such as the FTC Health Breach Notification Rule and state consumer health data laws, may apply instead.

Is a cloud provider a business associate if data is encrypted?

Yes. HHS guidance says a cloud provider that stores ePHI is a business associate even if it cannot view the data because it lacks the encryption key.

What is a business associate agreement?

A contract required by HIPAA that sets out how a business associate may use PHI, the safeguards it must apply, breach reporting duties, subcontractor obligations and return or destruction of PHI at the end of the relationship.

Is encryption required under HIPAA?

Under the current rule it is an addressable specification, but in practice it is expected, and properly encrypted PHI is not "unsecured" for breach notification purposes. The proposed 2025 rule would make it required.

How quickly must a business associate report a breach?

Without unreasonable delay and no later than 60 days after discovery under the rule, though many BAAs require notice within a few days.

Can PHI be accessed from outside the US?

HIPAA does not prohibit it, but the covered entity's BAA and policies may. You remain responsible for safeguards wherever access happens.

How long must HIPAA documentation be kept?

Six years from the date of creation or the date it was last in effect, whichever is later.

Has the HIPAA Security Rule been updated?

A major update was proposed in January 2025. As of October 2026 it has not been finalised, so the existing rule applies.

Can we use AI tools with PHI?

Only if the AI provider signs a BAA and its terms on retention and training are compatible with your obligations, and the use is permitted under your BAA with the covered entity.

Conclusion and next steps

For an IT vendor, HIPAA compliance is mostly about three things: knowing where PHI is, protecting it with the safeguards the Security Rule describes, and making contractual promises your operations can keep.

Confirm whether you are a business associate.
Map PHI and complete a documented risk analysis.
Remediate technical gaps and write the policies.
Sign BAAs up and down your supply chain.
Consider SOC 2 or ISO 27001 for independent assurance.

This guide is general information, not legal advice.

How we keep this guide up to date

We review this guide every six months and immediately when HHS finalises the Security Rule update or issues new guidance or enforcement trends relevant to software and IT vendors.