What Is HIPAA-Compliant Software?
HIPAA-compliant software is software built and operated so that the organizations using it can meet the HIPAA Privacy, Security and Breach Notification Rules when it handles protected health information. Compliance depends on the software's safeguards and on how it is configured, contracted and run, and no government agency certifies software as HIPAA compliant.
Reviewed by Eduardo Diaz, Co-Founder & CEO ยท Updated
Who and what HIPAA covers
HIPAA applies to covered entities, meaning health plans, health care clearinghouses and most health care providers, and to their business associates, the vendors that create, receive, maintain or transmit protected health information on their behalf. Protected health information is individually identifiable health information, such as a diagnosis tied to a name, a date of birth or a medical record number. Three rules matter most for software. The Privacy Rule limits how that information may be used and shared. The Security Rule sets safeguards for health information held electronically. The Breach Notification Rule says who must be told, and how quickly, when unsecured information is exposed.
Why there is no official HIPAA certification
A badge that says HIPAA certified can sound official, but HHS does not certify any person or product as HIPAA compliant, and it does not recognize private certifications of Security Rule compliance. A third party audit can be useful evidence that a vendor takes security seriously, yet it does not relieve anyone of their legal duties, and HHS can still find a violation afterward. HHS also says a business associate cannot replace the required contract with a self certification. So the accurate claim is that software supports HIPAA compliance. Whether an organization actually complies depends on its own risk analysis, policies, contracts, training and daily practice.
The safeguards the Security Rule expects
The Security Rule groups its requirements into administrative, physical and technical safeguards. Administrative safeguards include a documented risk analysis, a named security official, workforce training and access policies that match each person's role. Physical safeguards protect the devices and facilities where data lives. Technical safeguards are the ones software teams build directly: access controls, audit controls that record activity, integrity controls that guard against improper changes, user authentication and transmission security. The rule is deliberately flexible and does not name specific products or methods. Each organization weighs its size, systems, costs and risks, which is why the risk analysis is the foundation for every other decision.
Business associate agreements and your vendors
Before a vendor handles protected health information for you, HIPAA requires a written business associate agreement that sets out how the vendor will protect the data and report problems. That obligation flows downstream. A development firm, hosting company or AI provider that handles the data for a business associate is itself a business associate and needs its own agreement. HHS guidance says a cloud provider that stores encrypted health data is still a business associate even if it does not hold the decryption key. Business associates are also directly liable for some failures, including not complying with the Security Rule. In practice, map every service that touches patient data and confirm an agreement exists for each one.
Breach notification and the proposed Security Rule update
If unsecured protected health information is breached, affected individuals must be notified without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people must also be reported to HHS within that window, and breaches involving more than 500 residents of a state or jurisdiction require notice to prominent local media. Separately, HHS published a proposed overhaul of the Security Rule in the Federal Register on January 6, 2025. It would require encryption at rest and in transit, multifactor authentication, an asset inventory and network map, and regular vulnerability scanning, with limited exceptions. As of October 2026 it has not been finalized, so the existing rule still applies.
How we build HIPAA-ready software at AetherCraft
We design for the safeguards from the first sprint instead of adding them before launch. Access is scoped by role and checked on the server for every request, not just hidden in the interface. Every sensitive action is logged, and when AI is involved, every AI suggestion is logged with the person who accepted or rejected it. We keep patient identifiers away from AI models wherever possible, and a licensed or named person makes the decision. On UNIZA, a secure AI connected care platform for healthcare networks, that meant six access levels plus custom roles, AI care gap analysis, an AI assistant that never sees patient identifiers and a tamper-evident audit history.
What to ask a vendor or development partner
When someone tells you their software is HIPAA compliant, ask follow up questions. Will they sign a business associate agreement, and do they have agreements with their own hosting, email, analytics and AI providers? Where is the data stored, and is it encrypted in transit and at rest? How is access limited by role, and is that enforced on the server? Is there an audit log of who viewed or changed records, and can it be altered? Do any AI features send patient data to an outside model? How would they detect a breach and tell you about it? This entry is general information, not legal advice, so confirm your obligations with a health care attorney.
Frequently Asked Questions
Can software be HIPAA certified?
Not by the government. HHS does not certify any person or product as HIPAA compliant and does not recognize private Security Rule certifications. Vendors may hold independent security audits, which can be useful evidence, but those do not transfer compliance to you. A more precise claim is that a product supports HIPAA compliance when it is configured, contracted and used correctly by an organization that has done its own risk analysis.
Do I need a business associate agreement with my developers?
If your development or support team will create, receive, maintain or transmit protected health information for a covered entity or another business associate, yes. That includes access to production databases, logs or backups that contain patient data. If developers only ever work with synthetic or properly de-identified data and never touch production, the answer may be different, so get the specific arrangement reviewed by counsel.
Is a HIPAA-eligible cloud service enough to make my app compliant?
No. Major cloud providers will sign a business associate agreement and offer services suited to health data, but they secure the infrastructure, not your application. You are still responsible for how your app controls access, logs activity, encrypts data, handles backups and manages vendors. HHS also expects you to run and document your own risk analysis covering the whole system, including the parts you build.
Can I use AI with patient data under HIPAA?
It can be done, but the AI provider becomes a business associate if it handles protected health information for you, so you need an agreement and appropriate safeguards. A safer pattern is to keep identifiers out of the AI entirely. HIPAA recognizes two de-identification methods: removing 18 specified types of identifiers under Safe Harbor, or having a qualified expert determine that the risk of re-identification is very small.
Is the new HIPAA Security Rule in effect?
Not as of October 2026. HHS proposed major Security Rule changes in a notice published January 6, 2025, including required encryption and multifactor authentication, but the rule has not been finalized and the current Security Rule remains in force. Many of the proposed controls are already sensible practice, so building them in now reduces rework if a final rule arrives.
See It In Practice
Related Reading
Related Terms
Built for Your Industry
Book a Discovery Call. Eduardo Diaz leads every AetherCraft engagement personally.