HIPAA basics
HIPAA compliant software: what it means and how to check a vendor
A plain guide for practice managers, compliance leads and IT buyers. Every rule is cited to the Code of Federal Regulations as read on 6 November 2026. This page explains the rules. It does not say that any product, including ours, is HIPAA compliant.
HIPAA does not describe a type of software. Its rules bind covered entities and business associates, and they tell those organizations to protect the electronic protected health information they handle. Software is called HIPAA compliant in practice when an organization can use it while meeting those duties and, where the vendor handles that information for the organization, a written business associate contract is in place. This page sets out the Security Rule safeguards, the contract, and a short check you can run on a vendor.
plain answer
What is HIPAA compliant software?
HIPAA does not define a category of software. Its Security Rule says that covered entities and business associates must protect the confidentiality, integrity and availability of the electronic protected health information they create, receive, maintain or transmit. The rule text puts those duties on the organization. In practice, software is called HIPAA compliant when an organization can use it and still meet those duties, and when the vendor, if it handles that information on the organization's behalf, has signed a business associate contract. A product on its own does not make an organization compliant.
Source: eCFR, 45 CFR 164.306(a) and 45 CFR 160.103, read 6 November 2026.
reference
What does the HIPAA Security Rule require of software?
The technical safeguards in 45 CFR 164.312 name five standards: access control, audit controls, integrity, person or entity authentication and transmission security. Access control has two required specifications, unique user identification and an emergency access procedure, and two addressable ones, automatic logoff and encryption and decryption. Integrity and transmission security have addressable specifications: a mechanism to authenticate electronic protected health information, integrity controls and encryption.
Addressable does not mean optional. Under 164.306(d)(3) the organization must assess whether each one is reasonable and appropriate, implement it if so, or document why not and put an equivalent measure in place where that is reasonable. The administrative safeguards in 164.308, such as a risk analysis, concern the organization's own process, not only the product.
Source: eCFR, 45 CFR 164.312, 164.306 and 164.308, read 6 November 2026.
plain answer
Is there a HIPAA certification for software?
The technical safeguards section of the Security Rule, 45 CFR 164.312, lists five standards, and none of them is a product certificate. The rule text we read does not define a HIPAA certification for software, so ask any vendor that says its software is HIPAA certified who issued the label and what it rests on, and read the contract and the safeguards behind it.
HHS's own answer on certification was not available to us on 6 November 2026, so this page does not quote HHS on it. Check HHS's guidance directly before you rely on or repeat any certification claim.
Source: eCFR, 45 CFR 164.312, read 6 November 2026.
plain answer
What is a business associate agreement for software?
A business associate, under 45 CFR 160.103, is a person who, on behalf of a covered entity, creates, receives, maintains or transmits protected health information for a function the rules regulate, or who provides certain services, such as consulting or data aggregation, that involve disclosure of that information. A subcontractor doing the same for a business associate is included.
Under 45 CFR 164.314(a)(2)(i), the contract must provide that the business associate will comply with the Security Rule requirements that apply, make sure its subcontractors agree to comply, and report any security incident it becomes aware of, including breaches of unsecured protected health information. 164.308(b)(3) requires the assurances to be documented in a written contract.
Source: eCFR, 45 CFR 160.103, 164.314 and 164.308, read 6 November 2026.
how to
How do you check whether software is HIPAA compliant?
These steps follow the rule text. They are a starting list, not legal advice.
First, decide whether the vendor will create, receive, maintain or transmit protected health information for you. If it will, it is a business associate and you need the written contract before real data goes in. Second, read the contract against 164.314(a)(2)(i): compliance with the Security Rule, subcontractors bound, incidents and breaches reported. Third, ask the vendor how its product meets each of the five technical standards, and note which settings are yours to turn on. Fourth, make sure the system is covered by the risk analysis that 164.308(a)(1)(ii)(A) requires of the organization. Fifth, put a date on reviewing it again, because 164.308(a)(8) calls for periodic evaluation.
Source: eCFR, 45 CFR 164.308, 164.314 and 164.312, read 6 November 2026.
kriv role
Where Kriv helps
Kriv AI advises regulated organizations on governed AI use. If the software you are assessing is an AI tool, start with our guide to AI and HIPAA, which covers business associates, vendor terms and audit trails for AI systems. Kriv AI does not certify software or compliance and does not give legal advice.
limits
What this page could not confirm
We read the regulation text on the eCFR, not HHS's own guidance pages, because HHS's pages were not available to us on 6 November 2026. We did not read the physical safeguards in 164.310 or the Privacy Rule. We read only the Federal Register listing for the Security Rule update HHS proposed in January 2025, not its text. Rules and their status change, so check the current regulation and talk to counsel before you decide that a product is acceptable for your organization.
Sources
Cited sources
- eCFR 45 CFR 164.312 Technical safeguards (source note: 68 FR 8376, 2003; 78 FR 5694, 2013), read 2026-11-06
- eCFR 45 CFR 164.306 Security standards: General rules (68 FR 8376; 68 FR 17153; 78 FR 5693), read 2026-11-06
- eCFR 45 CFR 164.308 Administrative safeguards (68 FR 8376; 78 FR 5694), read 2026-11-06
- eCFR 45 CFR 164.314(a) Business associate contracts (source note lists amendments to June 7, 2013), read 2026-11-06
- eCFR 45 CFR 160.103 Definitions (page shows amendments to 24 March 2026, 91 FR 14404), read 2026-11-06
- Federal Register, HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, Proposed Rule, published 2025-01-06, document 2024-30983 (API search read 2026-11-06 lists no final rule), read 2026-11-06
Straight answers
Frequently asked questions about HIPAA compliant software: what it means and how to check a vendor
Is HIPAA compliant software the same as HIPAA certified software?
The Security Rule's technical safeguards section lists five standards and no product certificate (45 CFR 164.312, read 6 November 2026). Ask who issued a HIPAA certified label and what it rests on.
Does a business associate agreement make software HIPAA compliant?
No. The contract is one requirement. The organization still needs a risk analysis and safeguards under the Security Rule (45 CFR 164.308 and 164.312, read 6 November 2026).
Does HIPAA require encryption in software?
Encryption is an addressable specification under access control and under transmission security. Addressable means the organization assesses it and implements it if reasonable and appropriate, or documents why not and uses an equivalent measure (45 CFR 164.312 and 164.306(d)(3), read 6 November 2026).
Is the HIPAA Security Rule changing?
HHS published a proposed rule, HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, in the Federal Register on 6 January 2025 (document 2024-30983). A Federal Register search on 6 November 2026 listed it only as a proposed rule, not a final rule. Check its current status before you plan around it.
Who has to use HIPAA compliant software?
The Security Rule's duties fall on covered entities and business associates (45 CFR 164.306(a), read 6 November 2026). Covered entities are health plans, health care clearinghouses and health care providers that transmit health information electronically in connection with covered transactions (45 CFR 160.103).
Talk to the team that would do the work
Bring your requirements to a working session with the person who'll actually deliver.
Book a Discovery Call