The current HIPAA Security Rule text on administrative safeguards requires risk analysis, risk management and periodic evaluation. In the section I checked, it does not use the words vulnerability scanning. Scanning is a common way to meet those duties, so teams adopt it. This is general information, not legal advice.
What the text says
Section 164.308 sets administrative safeguards. Under the security management process, covered entities and business associates must conduct an accurate and thorough assessment of the potential risks and vulnerabilities to electronic protected health information, and implement security measures sufficient to reduce those risks and vulnerabilities to a reasonable and appropriate level.
A separate evaluation standard asks for periodic technical and nontechnical evaluation, based initially on the standards and later in response to environmental or operational changes affecting security, to establish how well policies and procedures meet the requirements.
The rule is deliberately technology neutral. It tells you the outcome, not the tool.
Why teams still scan
If you must assess vulnerabilities in systems that hold health data, you need a way to find them. Scanning dependencies, containers and hosts is a repeatable, documentable method. It produces dated output that serves as risk analysis input and as evidence for the periodic evaluation.
| Duty in the text | How scanning helps |
|---|---|
| Risk analysis of vulnerabilities | Findings feed the register |
| Risk management to a reasonable level | Remediation and exceptions show action |
| Periodic evaluation | Scheduled scans show recurrence |
| Response to operational change | Scans after major changes |
What to document
- Which systems create, receive, maintain or transmit health data, and which software components they use.
- How you discover vulnerabilities and how often.
- How you decide what to fix first.
- Fix records and exceptions with approvals.
- Review of the whole approach when something changes.
Your risk analysis should name scanning as one of the methods, so the choice is deliberate rather than accidental.
A note on rule changes
HHS has proposed updates to the Security Rule in the past, and rules can change. I did not verify the current status of any proposal for this post, so check the Federal Register and HHS before you rely on this text for a decision, and ask counsel. Our post on the HIPAA Security Rule for software covers how software teams approach it.
Software supply chain angle
For health software, the risk analysis should include third-party components. A vulnerable library inside an application that handles health data is a vulnerability in the system. An SBOM gives the list that a risk analysis can reference. Safeguard generates SBOMs, scans dependencies and maps findings to compliance frameworks to help assemble that evidence, though the legal conclusion about your obligations is yours and your counsel's.
Quick check
So scanning is optional under HIPAA?
The tool is a choice, but assessing and managing vulnerabilities is not. Most organizations find scanning the practical way to do it, and document that choice.
Do business associates have the same duty?
The administrative safeguards text applies to both covered entities and business associates, so a software vendor handling health data should read the same section.
Sources
Last reviewed: 19 October 2026.
