Beyond SOC 2
What is HIPAA compliant software?
What is HIPAA compliant software?
No software is HIPAA compliant on its own. HIPAA imposes obligations on organisations, specifically covered entities and their business associates, not on products. What exists is software that can be used in a compliant way: it provides the safeguards the Security Rule requires, and the vendor will sign a business associate agreement. Compliance is a property of your organisation and its contracts, not a feature of a tool.
What to actually check in a vendor
| Requirement | What to ask for |
|---|---|
| Signed BAA | Will they sign one, without an enterprise upgrade? This is the gate. |
| Access control | Unique user IDs, role-based access, no shared accounts |
| Audit logging | Records of who accessed PHI, when, and what they did |
| Encryption | In transit and at rest |
| Automatic logoff | Sessions terminate after inactivity |
| Integrity controls | PHI cannot be improperly altered or destroyed undetected |
| Backup and recovery | Retrievable exact copies, tested |
| Subcontractors | Their subprocessors carry obligations too, under the Omnibus Rule |
The BAA is the one that decides it. A product with every technical safeguard and no BAA cannot be used with PHI. A product with a BAA and weak safeguards puts you in breach through your own risk analysis. You need both, and the BAA is the one people forget to check until procurement.
There is no HIPAA certification
HHS does not certify, accredit, or endorse any product, vendor, or organisation. A "HIPAA certified" badge is either self-issued or issued by a private company with no regulatory standing.
What healthcare buyers accept instead:
- A signed BAA, which is a contract rather than a certificate
- A SOC 2 Type II report, often with HIPAA criteria mapped into scope
- Your risk analysis and safeguard documentation
See how much does HIPAA certification cost for what the alternatives actually cost.
If you are building the software
You are likely a business associate with direct legal obligations the moment you handle PHI for a covered entity, regardless of your size. That means a documented risk analysis, implemented safeguards, signed BAAs both upstream and downstream, and evidence that all of it operates.
The Security Rule's safeguards overlap heavily with the SOC 2 Common Criteria, particularly CC6 for access control and CC7 for operations, which is why most healthcare SaaS vendors pursue SOC 2 and map HIPAA into it rather than running two programmes. See what controls overlap between SOC 2, ISO 27001, and HIPAA.