The HIPAA Security Rule does not mention software supply chains, but its requirements cover them. Risk analysis, business associate contracts, audit controls, integrity protection and access control all apply to the third party code and services that touch electronic protected health information. This post maps each to practical work.
This is an engineering guide, not legal advice. Safeguard helps produce evidence for some of these controls and does not make an organization HIPAA compliant.
Who does the rule apply to?
Covered entities and business associates. A covered entity is a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with covered transactions. A business associate performs functions or services for a covered entity that involve protected health information, and the definition includes subcontractors of business associates. A software vendor that handles patient data for a clinic is often a business associate.
Risk analysis and risk management
Section 164.308(a)(1) requires an accurate and thorough assessment of the potential risks and vulnerabilities to ePHI, and security measures that reduce risks to a reasonable and appropriate level. Both are marked required.
Supply chain mapping: your risk analysis should include third party libraries, container images and hosted services in systems that touch ePHI. An inventory of components, with known vulnerabilities, is the factual base for that assessment. Without it the analysis is guesswork.
Business associate contracts
Section 164.308(b) lets a covered entity share ePHI with a business associate only after obtaining satisfactory assurances, documented in a written contract. A business associate may bring in a subcontractor only after similar assurances.
Supply chain mapping: your vendors and their sub-processors are the chain. Keep a list of services that can see ePHI, the contract for each and who reviews them. A new analytics library that sends data to a third party may create a new relationship you did not intend.
Contingency plan
Section 164.308(a)(7) requires a data backup plan, a disaster recovery plan and an emergency mode operation plan.
Supply chain mapping: can you rebuild and redeploy if a registry is unavailable or a package is withdrawn? Keep pinned versions, internal copies of critical dependencies and tested restore procedures.
Technical safeguards
Section 164.312 covers access control, audit controls, integrity, person or entity authentication and transmission security.
- Access control: unique user identification and emergency access procedures are required. Apply that to build systems and package publishing accounts too, since someone who can publish code can change what runs on ePHI.
- Audit controls: the rule calls for mechanisms that record and examine activity in systems that contain or use ePHI. Log dependency changes, deployments and administrator actions.
- Integrity: protect ePHI from improper alteration or destruction. Verifying that the code you deploy is the code you reviewed supports this. Record what was built and from what.
- Transmission security: guard against unauthorized access to ePHI in transit. Encryption and decryption and encryption for transmission are listed as addressable, which means you assess whether they are reasonable and appropriate and document your decision.
What does addressable mean?
It does not mean optional. It means you must implement the specification if reasonable and appropriate, or document why not and use an equivalent measure. Keep that reasoning in writing.
What to do
- Inventory the components and services in every system that touches ePHI.
- Include that inventory and its known vulnerabilities in your risk analysis.
- Track vendors and sub-processors with signed agreements.
- Restrict and log who can publish or deploy code.
- Pin versions and keep tested ways to rebuild.
- Record what was built, from which source, for each release.
- Document your decisions on each addressable specification.
Quick check
Does HIPAA require a software bill of materials?
The sections we reviewed do not mention one by name. An inventory supports the required risk analysis, which is why teams use it.
Is a vendor automatically covered if it says it is HIPAA compliant?
No. A covered entity needs satisfactory assurances documented in a written contract with a business associate. A marketing claim is not that.
Sources
- 45 CFR 164.308, administrative safeguards
- 45 CFR 164.312, technical safeguards
- 45 CFR 160.103, definitions
Last reviewed: 18 October 2026.
