You can manage HIPAA Security Rule compliance in spreadsheets if your systems holding electronic protected health information are few and well known. Track a risk analysis, a risk register, policies, training, business associate agreements and incident records. Automate when system counts, access reviews or log evidence outgrow manual updates.
HIPAA is US law. The Security Rule applies to covered entities and business associates, and it requires safeguards for electronic protected health information, usually shortened to ePHI. The HHS pages we tried to fetch returned HTTP 403, so for rule text we used the eCFR copy of 45 CFR 164.312 and general knowledge of the rule's structure. This is not legal advice.
What does the workbook need?
- ePHI inventory. Every system that creates, receives, maintains or transmits ePHI, with owner, location, data types, and which vendors touch it. The risk analysis starts here, and an incomplete inventory undermines everything else.
- Risk analysis. For each system: threats, vulnerabilities, existing controls, likelihood, impact, resulting risk. Keep every dated version.
- Risk management plan. Each risk, the action chosen, an owner, a due date and a completion date.
- Safeguards map. The administrative, physical and technical standards, with your policy, procedure and evidence link per row.
- Workforce. Training dates per person, sanction policy acknowledgement, access by role.
- Business associates. A register of vendors with ePHI access, whether a signed agreement exists, and date of last review.
- Incidents. Every security incident and breach assessment, with decisions and notifications.
- Evidence log. What, when, from where, by whom.
What do the technical safeguards require?
From 45 CFR 164.312 on eCFR: access control (unique user identification and emergency access procedure are required; automatic logoff and encryption are addressable), audit controls, integrity (a mechanism to authenticate ePHI is addressable), person or entity authentication, and transmission security (integrity controls and encryption are addressable). Addressable does not mean optional. It means you assess whether the measure is reasonable for you and document your decision or an equivalent alternative.
Regulators have proposed changes to the Security Rule in the past. Check HHS for the current status before you lock your controls, and document the version of the rule you used.
Where do spreadsheets fail for HIPAA?
- Inventory drift. New tools get ePHI without anyone updating the sheet.
- Access reviews. Exporting user lists from many systems every quarter and comparing them by hand.
- Log evidence. Audit controls need real logs, which a spreadsheet only points to.
- Records retention. Overwritten cells erase history you may need to show for years.
- Single point of failure. One person holds the whole workbook.
When should you automate?
Automate evidence that repeats: access lists, configuration checks, vulnerability scans, and vendor review reminders. Keep judgment calls, like risk ratings and sanction decisions, with people. A good trigger is when you spend more time updating the workbook than fixing issues in it.
What to do
- Build the ePHI inventory by walking the data from entry to storage to deletion.
- Run the risk analysis and date it. Repeat when systems or vendors change.
- Create the risk management plan with owners and dates.
- Sign agreements with every business associate and log them.
- Train staff and record completion.
- Turn on audit logging for ePHI systems and decide who reviews it and how often.
- Keep dated copies of every version of the workbook.
Quick check
Does HIPAA require a particular tool?
No. It requires safeguards and documentation. A spreadsheet can document them, provided the records are accurate and complete.
Is encryption optional under the Security Rule?
In the rule text on eCFR we fetched, encryption is an addressable specification, not strictly required, but you must assess it and document your reasoning. Check for any updates to that.
How Safeguard helps automate this
HIPAA technical evidence repeats forever, which suits automation. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between audits, which saves time for other work. Technical evidence comes from your real code and dependencies through scans, SBOMs and reachability, not only policies. Autonomous remediation can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard helps prepare evidence. It does not make you HIPAA compliant. Book a call to see it.
Sources
- eCFR: 45 CFR 164.312 technical safeguards, fetched 18 October 2026
- HHS: HIPAA Security Rule, HTTP 403 on fetch
Last reviewed: 18 October 2026.
