No. The Security Rule sections we reviewed do not mention a software bill of materials. A component inventory still helps with the risk analysis the rule does require, because you cannot assess risks and vulnerabilities in software you cannot list. Medical device rules from other regulators treat SBOMs differently, so keep the two apart.
Why the question keeps coming up
Buyers read about vendor breaches and ask whether they should demand an SBOM. The honest answer is that HIPAA leaves the method to you: the rule asks for an accurate and thorough assessment of risks and vulnerabilities, and flexibility in measures based on size, complexity and the probability and criticality of risks. An SBOM is one input to that assessment, not a mandated artifact.
What an SBOM adds to a vendor review
| Question | Without an SBOM | With an SBOM |
|---|---|---|
| Does the product use a component named in a new advisory? | Wait for vendor email | Check the list yourself |
| Which libraries handle PHI parsing? | Guess | Review the named ones |
| Are licences and end of life components present? | Unknown | Visible |
| Did the vendor change dependencies after an incident? | Unknown | Compare two versions |
How to request one
- Ask for an SBOM in a standard format such as SPDX or CycloneDX for the version you run.
- Ask how often it is regenerated, ideally at each release.
- Ask whether it covers transitive dependencies and container layers.
- Ask how the vendor responds when a listed component has a new advisory, and how fast it tells you.
- Store it with the vendor file and compare it at the next review.
Many vendors will share a summary under an agreement. Accept that, but ask for component names and versions.
Try it yourself
Click through it at your own pace, or open it full screen. Open the dependency tree and see how many packages arrive indirectly, then think about how you would learn about one of them from a vendor.
Keep the scope honest
An SBOM is a list. It does not tell you whether a flaw is reachable, whether the vendor patched, or whether anything was tampered with. Pair it with reachability analysis and the vendor's patch record.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis, continuous monitoring and evidence automation that can support a vendor review. You can run a free scan at gold.safeguard.sh/scan. It does not make any organisation compliant with HIPAA, and this post is not legal advice.
Quick check
Is an SBOM required for medical devices?
Different rules apply to device makers. See our posts on FDA cybersecurity expectations, and confirm requirements with a regulatory specialist.
Should I refuse a vendor that will not provide one?
Record it as a risk and weigh it against the data the vendor touches. Tier the vendor first.
Sources
Last reviewed: 19 October 2026.
