HIPAA compliance for software and IT vendors: rules, BAAs and training

HIPAA (the Health Insurance Portability and Accountability Act of 1996) is the US federal law whose regulations protect individually identifiable health information. Its Privacy Rule, Security Rule and Breach Notification Rule apply to covered entities, such as health plans and most healthcare providers, and to the business associates that handle protected health information for them, including software, cloud and IT vendors.

If your product stores patient data for a clinic, hosts records for a health plan, or your engineers can see protected health information while supporting a hospital, HIPAA applies to you directly. This guide explains who is covered, what the three rules require, how business associate agreements work, the training rules, and what the proposed Security Rule changes would mean. Each requirement cites the regulation in 45 CFR, linked in the sources.

What is HIPAA and what does it protect?

HIPAA was enacted in 1996. The HHS regulations that matter for IT companies are the Administrative Simplification rules in 45 CFR Parts 160 and 164. The HITECH Act of 2009 and the 2013 Omnibus Rule extended them, most importantly by making business associates directly liable.

The rules protect protected health information (PHI): individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium (45 CFR 160.103). It includes information about a person's past, present or future health condition, the care provided to them, or payment for that care, when it identifies them or could reasonably be used to. Names, addresses, dates related to the person, phone numbers, email addresses, medical record numbers and device identifiers are all identifiers when linked to health information.

Electronic PHI (ePHI) is PHI that is created, received, maintained or transmitted electronically. The Security Rule applies to ePHI only. The Privacy Rule applies to PHI in every form.

Health information that has been de-identified under 45 CFR 164.514, either by removing 18 listed identifiers (safe harbor) or through an expert determination, is no longer PHI.

Is HIPAA compliance mandatory?

Yes. HIPAA is federal law for covered entities and business associates. The HHS Office for Civil Rights (OCR) enforces the civil rules through investigations, compliance reviews, resolution agreements and civil money penalties. State attorneys general can also bring civil actions under HIPAA. Knowingly obtaining or disclosing PHI in violation of HIPAA is a federal crime prosecuted by the Department of Justice (42 USC 1320d-6).

There is no official HIPAA certification. HHS does not certify vendors or products. Companies that say they are "HIPAA certified" usually mean they completed a third-party assessment, such as a SOC 2 with HIPAA mapping or a HITRUST certification, which can help demonstrate compliance but is not a government certificate.

Who must comply with HIPAA?

Covered entities

• Health plans: health insurers, HMOs, company health plans, and government programs such as Medicare and Medicaid.
• Healthcare clearinghouses: organizations that convert nonstandard health information into standard formats.
• Healthcare providers that transmit health information electronically in connection with standard transactions, such as claims. In practice this covers most hospitals, clinics, physicians, dentists, pharmacies and labs.

Business associates

A business associate is a person or organization, other than a member of the covered entity's workforce, that creates, receives, maintains or transmits PHI on behalf of a covered entity, or provides certain services to it that involve PHI (45 CFR 160.103). For IT, examples include:

• EHR, practice management, telehealth, billing, scheduling and patient engagement software.
• Cloud service providers that store ePHI, even if the data is encrypted and the provider has no key, as HHS explains in its cloud computing guidance.
• Managed IT, help desk and security service providers with access to systems holding ePHI.
• Data analytics, AI and transcription vendors processing PHI.
• Email, backup and document management services used to send or keep PHI.

A subcontractor that handles PHI for a business associate is itself a business associate, so the duties flow down the chain.

Not every vendor is a business associate. A conduit that only transmits data and does not store it beyond what transmission requires, such as an internet service provider, is not. Neither is a vendor with only incidental exposure, such as a janitorial service.

Why does HIPAA matter for health tech and IT vendors?

• Direct liability. Since HITECH, business associates are directly liable for Security Rule compliance, impermissible uses and disclosures, breach notification to the covered entity and some Privacy Rule duties.
• Sales. Hospitals and health plans will not buy from a vendor that cannot sign a business associate agreement and answer a security questionnaire.
• Breach exposure. Healthcare is a frequent target for ransomware. HHS publishes breaches affecting 500 or more people on its public breach portal, often called the "wall of shame".
• Penalties and settlements. OCR resolution agreements include payments and corrective action plans that last for years.
• Recognized security practices. A 2021 amendment to HITECH requires HHS to consider whether you had recognized security practices, such as the NIST Cybersecurity Framework, in place for the previous 12 months when deciding fines and audit outcomes.

What does the HIPAA Privacy Rule require?

The Privacy Rule (45 CFR Part 164, Subpart E) controls how PHI may be used and disclosed and gives individuals rights over their information.

• Permitted uses and disclosures. Covered entities may use and disclose PHI without authorization for treatment, payment and healthcare operations, and for listed public interest purposes. Most other uses, including most marketing, need the individual's written authorization.
• Minimum necessary. Uses, disclosures and requests must be limited to the minimum necessary for the purpose, except for treatment and a few other cases (164.502(b)).
• Individual rights. Access to and copies of their PHI, generally within 30 days (164.524), amendment, an accounting of disclosures, restrictions and confidential communications.
• Notice of privacy practices from covered entities.
• Administrative requirements (164.530): a privacy official, training, safeguards, complaints process, sanctions, mitigation and documentation.

A business associate may only use and disclose PHI as its business associate agreement permits or requires, or as required by law. It must also help the covered entity meet access, amendment and accounting requests where the agreement says so.

What does the HIPAA Security Rule require?

The Security Rule (45 CFR Part 164, Subpart C) requires covered entities and business associates to ensure the confidentiality, integrity and availability of all ePHI they create, receive, maintain or transmit, protect against reasonably anticipated threats and impermissible uses, and ensure workforce compliance (164.306). It is flexible: you consider your size, complexity, capabilities, technical infrastructure, costs and the likelihood and impact of risks.

Implementation specifications are either required, or addressable. Addressable does not mean optional. It means you assess whether the specification is reasonable and appropriate, implement it if so, and if not, document why and implement an equivalent alternative where reasonable.

Risk analysis is the foundation

The first required specification is an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI (164.308(a)(1)(ii)(A)), followed by risk management to reduce them to a reasonable and appropriate level. A missing or incomplete risk analysis is among the most common problems cited in OCR enforcement actions. HHS and ONC offer a free Security Risk Assessment Tool for smaller organizations.

What does the Breach Notification Rule require?

A breach is the acquisition, access, use or disclosure of PHI in a way the Privacy Rule does not permit, which compromises its security or privacy (164.402). An impermissible use or disclosure is presumed to be a breach unless a documented risk assessment of four factors shows a low probability that the PHI has been compromised. The factors are the nature and extent of the PHI, the unauthorized person who used it or received it, whether it was actually acquired or viewed, and the extent to which the risk has been mitigated.

The rule applies to unsecured PHI. PHI encrypted or destroyed according to HHS guidance is secured, so its loss does not trigger notification.

Covered entities usually set much shorter notice periods for their business associates in the BAA, often a few days. A breach is treated as discovered on the first day it is known, or would have been known with reasonable diligence, to any workforce member or agent other than the person who committed it. That is one reason staff training on reporting matters.

What must a business associate agreement include?

A covered entity must have a written contract with each business associate, and a business associate must have one with each subcontractor (164.308(b), 164.314(a) and 164.504(e)). The agreement must, among other things:

• Set the permitted and required uses and disclosures of PHI.
• Prohibit uses or disclosures not permitted by the contract or required by law.
• Require appropriate safeguards and compliance with the Security Rule for ePHI.
• Require reporting of uses or disclosures not provided for by the contract, including breaches of unsecured PHI and security incidents.
• Require subcontractors to agree to the same restrictions.
• Require making PHI available for access, amendment and accounting as the covered entity needs.
• Require making internal practices and records available to HHS.
• Require return or destruction of PHI at the end of the contract, where feasible.
• Allow termination if the business associate violates a material term.

HHS publishes sample business associate agreement provisions. Most vendors offer a standard BAA and negotiate the reporting timelines, security exhibits and liability terms.

What HIPAA training is required?

HIPAA has two explicit training requirements, and both apply to business associates as well as covered entities in practice.

Security awareness and training (45 CFR 164.308(a)(5))

Covered entities and business associates must implement a security awareness and training program for all members of the workforce, including management. The rule lists four addressable implementation specifications:

• Security reminders, meaning periodic security updates.
• Protection from malicious software, including procedures for guarding against, detecting and reporting it.
• Log-in monitoring, meaning procedures for monitoring log-in attempts and reporting discrepancies.
• Password management, meaning procedures for creating, changing and safeguarding passwords.

Privacy Rule training (45 CFR 164.530(b))

Covered entities must train all workforce members on the policies and procedures for PHI required by the Privacy Rule, as necessary and appropriate for them to carry out their functions. Training must be given to each new workforce member within a reasonable period after they join, and to affected members within a reasonable period after a material change in policies or procedures. The training must be documented. Business associates do not have this exact duty by regulation, but BAAs commonly require it, and their staff must know the BAA limits on use and disclosure.

How often, and how long to keep records

Neither rule sets an annual frequency. Most organizations train at hire and yearly, because it is easy to defend and OCR expects the program to be ongoing. Documentation required by the Security Rule and Privacy Rule must be kept for six years from the date of creation or the date it was last in effect, whichever is later (164.316(b)(2) and 164.530(j)), so training records should be kept at least that long. "Workforce" includes employees, volunteers, trainees and other people whose conduct is under the entity's direct control, whether or not they are paid (160.103).

How do software and IT vendors become HIPAA compliant step by step?

1. Confirm your role. Are you a business associate, a subcontractor, or neither? Map which products and services touch PHI.
2. Appoint a security official (164.308(a)(2)) and, where your BAAs require, a privacy contact.
3. Inventory ePHI. Where it is stored, processed, transmitted, logged and backed up, including in support tools and test environments.
4. Do a risk analysis and write a risk management plan with owners and dates.
5. Implement safeguards. Access control with unique IDs and MFA, encryption at rest and in transit, audit logging, integrity controls, automatic logoff, backup and disaster recovery, device and media controls.
6. Write policies and procedures for each Security Rule standard, and keep them for six years.
7. Sign BAAs with every customer that is a covered entity, and with each subcontractor that handles PHI for you.
8. Build incident and breach procedures that meet your BAA reporting timelines and the 60-day outer limit.
9. Train the workforce under 164.308(a)(5), with role-based training for engineers and support staff who may see PHI.
10. Apply sanctions consistently when staff break policy (164.308(a)(1)(ii)(C)).
11. Evaluate periodically (164.308(a)(8)), for example through an annual internal review or an independent assessment.

What are HIPAA penalties?

Civil money penalties are set in 45 CFR 160.404 in four tiers based on culpability, and adjusted for inflation every year. The amounts below apply to penalties assessed on or after 28 January 2026.

In 2019 HHS announced that, as a matter of enforcement discretion, it would apply lower annual caps to the first three tiers (25,000, 100,000 and 250,000 dollars before inflation). Check the current HHS position for your case, because enforcement discretion can change. Many OCR cases end in resolution agreements with a settlement payment and a corrective action plan, rather than a formal penalty.

Criminal penalties under 42 USC 1320d-6 reach fines of up to 50,000 dollars and one year in prison, up to 100,000 dollars and five years for offenses under false pretenses, and up to 250,000 dollars and ten years for intent to sell or use PHI for commercial advantage, personal gain or malicious harm.

What are common HIPAA mistakes made by IT vendors?

• Assuming encryption means you are not a business associate. Cloud providers holding encrypted ePHI are still business associates.
• No risk analysis, or a generic one that does not cover the actual systems that hold ePHI.
• PHI in places nobody planned for: support tickets, screenshots, logs, analytics events, test databases and AI prompts.
• Using a subcontractor, such as an email or AI service, to process PHI without a BAA.
• Treating addressable specifications as optional without documenting the decision.
• Training once at hire and never again, or not keeping records for six years.
• Breach procedures that wait for a forensic report before notifying the covered entity, missing the BAA deadline.
• Marketing the product as "HIPAA certified", which suggests a government certificate that does not exist.

What are the proposed HIPAA Security Rule changes?

On 6 January 2025 HHS published a notice of proposed rulemaking to strengthen the Security Rule. The comment period closed on 7 March 2025. HHS's regulatory agenda now lists a final rule for July 2027. Among the proposals, as summarized in the HHS fact sheet:

• Remove the distinction between required and addressable specifications, making nearly all of them required.
• Require written documentation of all policies, procedures, plans and analyses.
• Require a technology asset inventory and a network map showing how ePHI moves, reviewed at least yearly.
• Require encryption of ePHI at rest and in transit, and multi-factor authentication, with limited exceptions.
• Require vulnerability scanning at least every six months and penetration testing at least every 12 months.
• Require procedures to restore certain systems and data within 72 hours.
• Require a compliance audit at least every 12 months.
• Require business associates to verify, at least every 12 months, that they have deployed required technical safeguards, through a written analysis by a subject matter expert and a certification.
• Require business associates to notify covered entities within 24 hours of activating their contingency plans.

How does HIPAA relate to other frameworks?

• HITRUST CSF is a certifiable framework widely used in US healthcare to demonstrate HIPAA safeguards and more.
• SOC 2 reports can be issued with additional HIPAA criteria, giving customers one report.
• NIST CSF and NIST SP 800-53 are common sources of recognized security practices. HHS also publishes NIST SP 800-66 as a Security Rule implementation guide.
• ISO 27001 supports the Security Rule's risk-based approach for vendors that also sell outside the US.
• 21 CFR Part 11 applies when you handle FDA-regulated electronic records, such as clinical trial systems.
• CCPA and other state privacy laws mostly exempt PHI covered by HIPAA, but may cover other health or wellness data you hold.

Key HIPAA terms

Covered entityA health plan, healthcare clearinghouse, or healthcare provider that conducts standard electronic transactions. Business associateA person or organization that handles PHI on behalf of a covered entity, including subcontractors. PHI and ePHIProtected health information, and its electronic form. BAABusiness associate agreement, the contract required between a covered entity and business associate. AddressableA Security Rule specification you must assess and implement if reasonable and appropriate, or document an alternative. Unsecured PHIPHI not rendered unusable, unreadable or indecipherable through HHS-approved encryption or destruction. OCRThe HHS Office for Civil Rights, which enforces HIPAA's civil rules. WorkforceEmployees, volunteers, trainees and others under the entity's direct control, paid or not.

HIPAA FAQs

Official sources and references

We checked these sources while writing and reviewing this guide. Where a rule is a proposal or a draft, the guide says so.

• 45 CFR Part 164 on eCFR (Security, Breach Notification and Privacy Rules) Sections cited throughout this guide
• 45 CFR Part 160 on eCFR (definitions and penalties) Definitions in 160.103, penalties in 160.404
• HHS, HIPAA for professionals OCR guidance hub
• HHS, HIPAA Security Rule NPRM fact sheet Proposed changes, January 2025
• Federal Register, HIPAA Security Rule to Strengthen the Cybersecurity of ePHI (90 FR 898) Notice of proposed rulemaking
• Federal Register, Annual Civil Monetary Penalties Inflation Adjustment (91 FR 3665) 2026 penalty amounts
• HHS, Guidance on HIPAA and cloud computing Cloud providers as business associates
• HHS, Sample business associate agreement provisions Model BAA language
• HHS, Breach notification rule Notification duties and the breach portal

Next steps

1. List every product, service and subcontractor that touches PHI, and confirm a BAA covers each.
2. Update your written risk analysis and risk management plan.
3. Check your breach procedure against the shortest notice period in your customer BAAs.
4. Assign security awareness training to the whole workforce and keep the records for six years. Book a demo to see how LMS Advisor tracks it.
5. Compare your controls with the proposed Security Rule so you are not caught out when it is finalized.