HIPAA Security Rule: A Practical Guide for Vendors and Business Associates

Many software and service companies first meet HIPAA when a hospital or clinic asks them to sign a business associate agreement. That agreement is not just paperwork. A business associate that creates, receives, maintains or transmits protected health information has direct responsibilities under the HIPAA Security Rule.

The three types of safeguards

• Administrative

  Risk analysis and risk management, an assigned security official, workforce training, access procedures, contingency plans and vendor agreements.

• Physical

  Controls over facilities, workstations and devices, including disposal and reuse of hardware and media.

• Technical

  Access controls, audit logging, integrity protections, user authentication and secure transmission of data.

Where to begin

• 1. Map your data

  Identify where electronic protected health information enters, where it is stored, who can reach it and which vendors touch it.

• 2. Run a risk analysis

  Identify threats and weaknesses for those systems, rate the risk and document the results. This is a required step and a common focus of investigations.

• 3. Create a remediation plan

  Rank the risks, assign owners and record decisions. Include the risks you accept and why.

• 4. Implement safeguards

  Strong authentication, least-privilege access, encryption, logging and tested backups usually come first.

• 5. Write policies and train staff

  Keep your policies practical, train people when they join and regularly after that, and retain records for six years.

• 6. Manage subcontractors

  Any subcontractor handling this data on your behalf also needs a business associate agreement.

Common misunderstandings

• "Our cloud provider is HIPAA compliant, so we are too"

  A signed agreement with the provider helps, but how you configure and use the service is still your responsibility.

• "We can buy a HIPAA certificate"

  The US government does not certify HIPAA compliance. Third-party assessments are useful evidence, but they are not official certification.

• "Addressable means optional"

  Addressable items must be assessed. If you do not implement one, you must document why and use a reasonable alternative where appropriate.

Are you a business associate?

The test is what you do with protected health information, not what your company calls itself. If you create, receive, maintain or transmit it on behalf of a healthcare provider, health plan or clearinghouse, you are likely to be a business associate. This commonly includes cloud-hosted software vendors, billing and transcription firms, IT service providers with access to patient systems, and data analytics firms.

Storing encrypted data does not automatically take you out of scope, even when you do not hold the key, according to HHS guidance on cloud computing. Have your legal counsel confirm your status for each service, and remember that a subcontractor who handles this data for you can also be a business associate.

What a risk analysis should cover

HHS regularly highlights a missing or incomplete risk analysis in enforcement actions. A simple questionnaire or vulnerability scan is not enough on its own. A credible analysis looks across the organization and is written down.

• Scope

  All electronic protected health information, in every system, device, backup and vendor where it exists.

• Threats and weaknesses

  Consider ransomware, stolen credentials, misconfigured cloud services, lost devices, insider misuse and vendor failures.

• Current safeguards

  Record what protects each system today, and whether it is working.

• Likelihood and impact

  Rate each risk using a consistent method, so that priorities can be explained and repeated.

• Risk management plan

  Assign actions, owners and dates. An analysis with no follow-up leaves you exposed.

• Updates

  Review the analysis on a regular schedule and after material changes, such as a new product, vendor or office.

Practical technical safeguards

The Security Rule is deliberately flexible, so it does not list specific products. It expects measures that are reasonable and appropriate for your size and risks. For most software and service companies, these controls are a strong starting point.

• Access control

  Use unique user IDs, least privilege, strong MFA and fast removal of access when people change roles or leave.

• Encryption

  Encrypt data in transit and at rest. Encrypting data properly can also matter under breach notification rules, because the rules focus on unsecured information.

• Audit logging

  Record access to patient data and administrative actions, protect the logs, and actually review them.

• Integrity

  Use change control and monitoring so that data cannot be altered or destroyed without detection.

• Backup and recovery

  Keep protected backups and test restoration. A contingency plan is required, and it matters most when ransomware strikes.

• Secure development

  If you build software, keep real patient data out of test environments, and review code and dependencies for security issues.

Breach notification basics

An impermissible use or disclosure of unsecured protected health information is presumed to be a breach unless a documented risk assessment shows a low probability of compromise. A business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovery. However, many contracts demand far shorter periods, so check each agreement and build those deadlines into your incident response plan.

Your notice should identify the affected individuals where possible and give the covered entity the information it needs for its own notifications. Keep records of your assessment, even if you conclude that no notification is required.

What healthcare customers ask for

Hospitals and health systems often send long vendor security questionnaires before signing a contract. Prepare these items in advance to shorten your sales cycle: a signed business associate agreement template, a summary of your risk analysis, your security policies, training records, a data flow diagram, your subcontractor list, recent penetration test or assessment summaries from your independent provider, and any SOC 2 or HITRUST reports you hold.

New technology raises new questions, too. Before anyone puts patient data into an AI tool or transcription service, check that a business associate agreement is in place and that the settings match your obligations. Also keep an eye on regulatory changes. HHS published a proposed update to the Security Rule in early 2025 that would make several safeguards more specific, so check its current status with your counsel.

Where NPLUS Global helps

We carry out the risk analysis, map your safeguards to the Security Rule, write practical policies and prepare the evidence healthcare customers ask for. This is readiness support and not legal advice, so your legal counsel should review contracts and breach obligations. Rules can also change, so check current guidance from the US Department of Health and Human Services.