DataSecureHIPAA obligations depend on your role and activities, not simply whether your software handles health-related data. Determine whether your organization is a covered entity, a business associate, a subcontractor business associate or outside those definitions. Map the information and services involved, and obtain legal advice where your role is unclear.
A practical HIPAA readiness checklist
This is a starting plan, not an exhaustive statement of the HIPAA rules or a guarantee of compliance. Assign an owner and retain evidence of decisions for each relevant item.
| Work area | Questions to resolve | Useful records |
|---|---|---|
| Role and data flows | For whom do you handle protected health information? Where is electronic PHI created, received, maintained or transmitted? | Role assessment, system inventory, data flows and accountable owners. |
| Agreements and vendors | Are appropriate business associate agreements in place with customers and relevant subcontractors? | Executed agreements, vendor inventory and documented responsibilities. |
| Risk analysis and management | Have you assessed risks to ePHI across relevant systems and tracked how you address them? | Documented risk analysis, treatment decisions, owners and follow-up. |
| Access and workforce | Who can access ePHI, and how do you authorize, review and remove access? How are staff trained? | Access decisions, reviews, training records and relevant procedures. |
| Technical and physical safeguards | How are systems, devices and facilities protected? How do you review activity, recover data and evaluate security measures? | Configuration records, review logs, backup and recovery tests and safeguard decisions. |
| Incidents and privacy | How do you identify, investigate, document and report incidents and handle applicable privacy obligations? | Response procedures, incident records, communications and privacy workflows. |
Download the editable HIPAA readiness worksheet (CSV)
Open it in a spreadsheet, assign owners and record next actions. Store references securely; do not enter patient information, passwords or access tokens. Tailor the worksheet with counsel—it is not a compliance assessment.
The HHS Security Rule summary explains administrative, physical and technical safeguards for electronic protected health information. The HHS risk analysis guidance describes assessing risks and documenting security measures. Privacy and breach-notification obligations also need separate consideration; a security checklist alone is incomplete.
Example: a software provider serving a hospital
Suppose a vendor hosts a scheduling application for a hospital and maintains ePHI on its behalf. The vendor and its counsel assess its business associate role and arrange the required agreement. The team maps production systems, backups and support access; evaluates risks; assigns owners to safeguards; and checks subcontractors that handle ePHI on its behalf.
As part of its plan, the team records access approvals, reviews activity and tests recovery. It also agrees incident escalation contacts and contractual deadlines with the hospital. This fictional example illustrates the process; actual obligations and safeguards depend on the arrangement and risk analysis.
Plan breach response before an incident
The HHS Breach Notification Rule guidance distinguishes the responsibilities of covered entities and business associates. For example, a business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery; an agreement may require faster notice. Covered entities have separate notification duties, and the timing and recipients vary with the circumstances. Have counsel help define your process rather than treating 60 days as a target.
Common questions
Does a SOC 2 report make a company HIPAA compliant?
No. A SOC 2 examination and HIPAA obligations serve different purposes. Some security evidence may be useful for both, but a SOC 2 report does not establish that all applicable HIPAA requirements are met.
Does “addressable” mean optional?
No. HHS explains that an entity must assess whether an addressable implementation specification is reasonable and appropriate in its environment and document its decisions and actions as required. See HHS’s explanation.
Is a vendor’s agreement enough?
A business associate agreement is important where required, but it does not itself perform your risk analysis, operate safeguards or satisfy every obligation. Read the agreement alongside your actual responsibilities and practices. See the HHS business associate guidance.
Keep requirements current
Consult HHS and qualified counsel for current requirements. HHS has published a proposed Security Rule update; proposals should not be treated as final requirements solely because they were proposed.
Educational information, not legal advice or an exhaustive compliance assessment. Applicability, contracts, state law and current rules require review for your circumstances.
Make your readiness work more manageable.
Discuss your compliance and evidence needs with DataSecure365.
Book a demo ↗