How to become HIPAA compliant
Becoming HIPAA compliant requires a structured approach to identifying applicable obligations, evaluating security risks, implementing safeguards, and documenting compliance activities.
Organizations should integrate these activities into existing security, IT, privacy, and governance processes. The following seven steps serve as a practical editorial framework:
Step 1: Determine applicable HIPAA requirements
Identify whether the organization operates as a covered entity, business associate, or both.
Determine which business activities involve PHI, which HIPAA rules apply, and who is responsible for compliance oversight.
Define the scope of the compliance program, including relevant departments, services, and third-party relationships.
Step 2: Identify and map systems containing ePHI
Document where ePHI is created, received, maintained, and transmitted.
Include relevant applications, databases, cloud environments, endpoints, network infrastructure, and external service providers.
Understanding the full information environment helps identify potential exposure and prevent important assets from being overlooked. External attack surface intelligence can supplement internal inventories by identifying internet-facing assets and security weaknesses that warrant investigation.
Step 3: Conduct a HIPAA security risk analysis
Evaluate threats and vulnerabilities that could compromise the confidentiality, integrity, or availability of ePHI.
Assess existing security measures, the likelihood and potential impact of adverse events, and areas requiring improvement.
Document findings and prioritize remediation.
Risk analysis identifies security risks. Risk management establishes how the organization will reduce them.
Step 4: Implement appropriate security safeguards
Establish the administrative, physical, and technical protections required for the organization's environment.
Depending on identified risks, measures may include access restrictions, authentication, encryption, security logging, vulnerability remediation, workforce training, and recovery planning.
Document implementation decisions and evaluate whether safeguards remain effective.
Step 5: Assess vendors and establish business associate agreements
Identify vendors that qualify as business associates and establish required business associate agreements (BAAs).
Assess relevant vendor security practices, including information handling, access controls, incident response capabilities, and operational dependencies.
Organizations should reassess critical vendors when security risks or business relationships change.
HIPAA requires regulated organizations to address applicable business associate obligations and manage risks to ePHI. Vendor security assessments and continuous monitoring can help organizations evaluate those risks, although HIPAA does not prescribe a universal vendor assessment methodology or require a specific monitoring technology.
Step 6: Prepare for security incidents and breaches
Establish procedures for identifying, investigating, documenting, containing, and responding to cybersecurity incidents.
Define responsibilities for technical response, legal assessment, notification, and operational recovery.
Develop contingency plans and test recovery procedures to support the availability of critical information systems.
Step 7: Maintain documentation and monitor compliance
Maintain required policies, procedures, training records, assessments, and evidence of corrective actions.
Review security risks, update safeguards, and evaluate the effectiveness of remediation activities as circumstances change.
The Security Rule generally requires specified documentation to be retained for six years from its creation or the date it was last in effect, whichever is later.
HIPAA compliance is an ongoing responsibility requiring coordination across security, compliance, privacy, and business teams.
How do you conduct a HIPAA security risk assessment?
A HIPAA security risk assessment identifies threats and vulnerabilities that could compromise ePHI and evaluates their likelihood and potential impact. Under the Security Rule, organizations must conduct an accurate and thorough analysis of potential risks and vulnerabilities affecting ePHI.
An effective assessment includes several activities:
- Identify relevant assets and information flows: Document systems, applications, devices, networks, and third parties involved in handling ePHI.
- Evaluate threats and vulnerabilities: Consider unauthorized access, ransomware, insecure configurations, unpatched software, insider activity, and operational disruptions.
- Review existing safeguards: Examine access management, audit controls, encryption, security monitoring, and administrative procedures.
- Assess likelihood and impact: Determine how identified threats could affect ePHI and healthcare operations.
- Prioritize and document risks: Establish risk levels, assign responsibilities, and identify appropriate remediation measures.
- Reevaluate risks as conditions change: Update assessments when new technologies, business processes, or security conditions introduce material changes.
For example, a healthcare organization might discover several vulnerable internet-facing systems during an assessment. Security teams can evaluate exploitability, asset exposure, and potential access to ePHI to prioritize corrective action.
Bitsight Security Posture Management provides external attack surface visibility and threat-informed insights that can complement internal risk assessments and support remediation prioritization. However, external security intelligence does not replace the comprehensive risk analysis required under HIPAA.
HHS does not prescribe a single assessment methodology or universal annual schedule under the current rule. Organizations must maintain an accurate, thorough understanding of relevant risks.
What cybersecurity best practices support HIPAA compliance?
HIPAA's flexible security framework allows organizations to select appropriate technical protections based on their environments and risk assessments. The following practices can strengthen healthcare cybersecurity while supporting applicable Security Rule requirements.
Strengthen identity and access management
Implement appropriate access restrictions, unique user identification, authentication, and procedures for modifying or terminating access.
Multi-factor authentication (MFA) can provide additional protection for privileged accounts, remote access, and systems containing sensitive information. Regular access reviews can identify excessive privileges and accounts that no longer require access.
Protect ePHI through encryption
Encryption helps protect health information against unauthorized access or interception. Organizations should evaluate encryption for stored information, devices, backups, and electronic transmissions.
Certain encryption specifications are addressable under the current Security Rule. Organizations must document appropriate implementation decisions based on their risks.
Prioritize vulnerability management
Vulnerability management helps organizations identify and address weaknesses across applications, infrastructure, and connected systems. Effective programs evaluate vulnerability severity alongside exploitability, asset criticality, exposure, and business impact.
For example, a vulnerability affecting an internet-facing system connected to a patient portal may warrant greater urgency than an equivalent weakness in an isolated, lower-impact environment.
As a best practice, risk-informed prioritization helps teams direct remediation resources toward exposures that present significant threats.
Monitor security activity and exposure
Security monitoring supports the detection of suspicious activity, unauthorized access, and changes in security posture. Organizations should establish appropriate audit logging, review relevant security events, and investigate findings that could affect ePHI.
Continuous external exposure monitoring can complement internal monitoring by identifying internet-facing weaknesses and changes in infrastructure.
Strengthen incident response and recovery
Healthcare organizations should establish procedures for investigating incidents and restoring critical operations. Contingency planning should address data backups, disaster recovery, emergency operations, and appropriate testing.
Recovery preparation is especially important for ransomware incidents that could disrupt patient care or limit access to essential systems.
The NIST SP 800-66 Revision 2 guidance provides additional recommendations for implementing HIPAA Security Rule requirements using established cybersecurity practices.
How does HIPAA address third-party cybersecurity risk?
Healthcare organizations depend on external vendors for cloud infrastructure, billing systems, electronic health records, and other essential services. These relationships can introduce cybersecurity risks affecting sensitive information and operational continuity.
HIPAA establishes responsibilities for covered entities and business associates, including required contractual arrangements and applicable security obligations.
Business associate agreements
A BAA establishes required assurances concerning how business associates may handle PHI and their responsibilities for safeguarding information. However, executing a BAA does not independently demonstrate that a vendor has effective cybersecurity controls. Organizations should also evaluate the security risks associated with relevant vendor relationships.
Vendor risk assessments and continuous monitoring
Vendor assessments can examine security documentation, access controls, incident response capabilities, and evidence of implemented safeguards. Yet third-party security conditions can change between assessments.
For example, a healthcare technology provider might introduce new internet-facing services, experience compromised credentials, or develop vulnerabilities that increase potential exposure.
Continuous third-party monitoring can help identify emerging risks and inform vendor remediation discussions, though it is not a HIPAA technology requirement.
Bitsight Third-Party Risk Management combines vendor assessments, security posture intelligence, and continuous monitoring to help security and GRC teams evaluate third-party risks.
These capabilities provide additional visibility into vendor security performance while supporting ongoing risk management.
What happens when a cybersecurity incident causes a HIPAA data breach?
A cybersecurity incident does not automatically constitute a reportable HIPAA breach. Organizations must investigate incidents involving PHI and determine whether an impermissible use or disclosure constitutes a breach under the Breach Notification Rule, considering applicable exceptions and risk assessment requirements.
HIPAA breach notification requirements
Covered entities must generally notify affected individuals following a reportable breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery.
Additional reporting requirements depend on the number of individuals affected.
Incident | General notification requirement |
Breach affecting fewer than 500 individuals | Notify affected individuals; report to HHS within 60 days after the calendar year ends |
Breach affecting 500 or more individuals | Notify affected individuals and HHS without unreasonable delay, no later than 60 days after discovery |
Breach affecting more than 500 residents of a state or jurisdiction | Notify prominent media outlets serving the affected area |
Breach involving a business associate | Notify the covered entity without unreasonable delay, generally within 60 days after discovery |
Organizations should also evaluate additional requirements under applicable state laws.
What are the consequences of HIPAA noncompliance?
HIPAA violations can result in regulatory investigations, corrective action plans, civil monetary penalties, and additional compliance obligations. Cybersecurity incidents can also disrupt healthcare operations, create recovery expenses, and affect patient trust.
Maintaining documented security policies, risk assessments, and incident response procedures helps organizations demonstrate their security risk management activities.
HIPAA compliance checklist
A HIPAA compliance checklist helps healthcare security and GRC teams organize implementation activities, monitor progress, and identify the evidence needed for internal reviews.
This checklist summarizes foundational HIPAA cybersecurity activities and supporting evidence. Organizations must also evaluate all applicable HIPAA Privacy Rule, Security Rule, and Breach Notification Rule requirements.
Governance and risk management
| | Action item | Supporting evidence | HIPAA reference |
☐ | Assign security responsibility | Role assignments, policies | § 164.308(a)(2) |
☐ | Conduct security risk analysis | Risk assessment, risk register | § 164.308(a)(1)(ii)(A) |
☐ | Implement risk management measures | Remediation plans, action records | § 164.308(a)(1)(ii)(B) |
☐ | Train workforce members | Training records | § 164.308(a)(5) |
Physical and technical safeguards
| | Action item | Supporting evidence | HIPAA reference |
☐ | Establish facility and workstation protections | Access and security procedures | § 164.310 |
☐ | Implement appropriate access controls | Access policies, authorization records | § 164.312(a) |
☐ | Establish audit controls | Audit settings, review records | § 164.312(b) |
☐ | Implement applicable authentication and transmission protections | Configurations, security procedures | § 164.312(d)–(e) |
Third-party risk management
| | Action item | Supporting evidence | HIPAA reference |
☐ | Identify applicable business associate relationships | Vendor inventory | § 164.308(b) |
☐ | Establish required business associate agreements | Executed agreements | § 164.314(a) |
☐ | Evaluate relevant vendor security risks | Risk analysis and vendor assessments | § 164.308(a)(1) |
Incident response and ongoing compliance
| | Action item | Supporting evidence | HIPAA reference |
☐ | Establish security incident procedures | Incident response plans | § 164.308(a)(6) |
☐ | Maintain contingency plans | Backup and recovery records | § 164.308(a)(7) |
☐ | Evaluate security measures periodically | Evaluation reports | § 164.308(a)(8) |
☐ | Maintain required documentation | Policies, procedures, records | § 164.316 |
Organizations should also maintain separate processes addressing applicable Privacy Rule and Breach Notification Rule obligations.
How can Bitsight support HIPAA cybersecurity risk management?
HIPAA compliance requires organizations to identify security risks, implement appropriate safeguards, and evaluate the effectiveness of their security programs.
Bitsight helps healthcare security and governance teams gain visibility into cyber risk across their external attack surface and third-party ecosystem.
Security Posture Management provides continuous visibility into external assets and vulnerabilities, helping teams prioritize remediation, measure security improvements, and communicate risk to stakeholders.
Third-Party Risk Management helps organizations evaluate vendor security posture, review assessment evidence, monitor emerging exposures, and coordinate vendor risk mitigation.
Bitsight's cyber risk intelligence can supplement HIPAA security risk management by connecting exposure information with relevant threat and business context.
These capabilities support security oversight and risk-informed decisions. They do not independently establish HIPAA compliance or replace required assessments, policies, and safeguards.
HIPAA compliance FAQs
Does HIPAA require multi-factor authentication?
The current HIPAA Security Rule requires appropriate authentication and access controls but does not universally mandate MFA. MFA is a widely recommended cybersecurity measure that can strengthen protection against compromised credentials and unauthorized access.
Is encryption mandatory for HIPAA compliance?
Under the current HIPAA Security Rule, encryption is an addressable implementation specification. Organizations must evaluate whether encryption is reasonable and appropriate for their environment and document implementation decisions, including any applicable alternative safeguards.
How often are HIPAA security risk assessments required?
The current Security Rule does not prescribe a universal annual assessment frequency. Organizations must conduct an accurate and thorough risk analysis and reevaluate risks as appropriate when systems, operations, or security conditions change.
Can an organization become HIPAA certified?
HHS does not issue an official HIPAA compliance certification. Independent assessments and certifications may provide supporting evidence of security practices, but they do not independently establish compliance with every applicable HIPAA requirement.
Are HIPAA cybersecurity requirements changing?
HHS issued proposed modifications to the HIPAA Security Rule in December 2024, with the proposal published in January 2025. The proposal addresses stronger cybersecurity protections, including more prescriptive requirements involving security controls, documentation, and testing.
Organizations should monitor rulemaking developments and distinguish proposed requirements from obligations currently in effect.
Strengthen HIPAA cybersecurity risk management with Bitsight
Maintaining HIPAA compliance requires ongoing attention to sensitive information, evolving security risks, and third-party relationships.
By combining comprehensive risk assessments, appropriate security safeguards, vendor oversight, and continuous monitoring, healthcare organizations can identify weaknesses, prioritize remediation, and strengthen cybersecurity governance.
Bitsight helps security leaders understand external exposure, evaluate third-party cyber risk, and measure improvements in security posture. Explore Bitsight Security Posture Management and Third-Party Risk Management to learn how cyber risk intelligence can support your healthcare security program.
