HIPAA for a CTO: the technical safeguards and who decides what

For a CTO, HIPAA means the Security Rule's technical safeguards in 45 CFR 164.312 plus the risk analysis in 164.308 that justifies them. The rule names standards, such as access control, audit controls, integrity, authentication and transmission security, without naming products. You choose the controls, and you must be able to show why they fit your risk.

Does it apply to you?

It applies to covered entities and business associates handling electronic protected health information (ePHI). A software company that creates, receives, maintains or transmits ePHI for a covered entity is typically a business associate. Confirm the status with counsel, since it drives contracts and direct liability.

What are the technical safeguards?

Per the regulation text as fetched, 164.312 sets five standards.

• Access control: unique user IDs and emergency access procedures are required. Automatic logoff and encryption are addressable.
• Audit controls: mechanisms that record and examine activity in systems using ePHI.
• Integrity: protect ePHI from improper alteration or destruction, with an addressable mechanism to authenticate it.
• Person or entity authentication: verify that whoever seeks access is who they claim.
• Transmission security: guard against unauthorized access in transit, with addressable integrity controls and encryption.

What does addressable mean?

Not optional. For an addressable item you assess whether it is reasonable and appropriate in your environment, then implement it, implement an equivalent alternative, or document why neither applies. In practice, encryption of ePHI is something a CTO should expect to defend if absent. Treat it as expected unless you have a written, risk-based reason.

Where does the risk analysis sit?

Section 164.308 requires an accurate and thorough assessment of risks to the confidentiality, integrity and availability of ePHI, and risk management that reduces them to a reasonable and appropriate level. It also requires a sanction policy and information system activity review. The analysis is the document that ties your technical choices to reasons. A missing or stale analysis is the most common weak point in a review, because everything else depends on it.

What do you decide?

You decide the architecture: where ePHI lives, how it is segmented, how keys are managed, how logs are protected, and which third parties may touch it. You also decide how engineers get production access. A practical pattern is no standing access to ePHI stores, time-limited elevation with logging, and test data that is not real patient data.

What is not yours?

Legal status, contract terms with covered entities, and the decision on whether an event is a reportable breach. For breaches, the notification rule requires covered entities to notify individuals without unreasonable delay and no later than 60 calendar days after discovery. Business associates have their own duty to notify the covered entity under their agreement. Get facts to your privacy officer fast.

What does not exist?

There is no official HIPAA certification issued by the government. Vendors may sell badges or assessments, which can be useful evidence, but they do not equal compliance. Check what is being claimed before repeating it to customers.

How to check or apply this

1. Map every system that stores, processes or transmits ePHI.
2. Date and refresh the risk analysis at least yearly and after major changes.
3. Verify unique IDs, audit logging, encryption in transit and at rest, and tested emergency access.
4. Document any addressable item you handle differently, with the reason.
5. Keep signed agreements with every subcontractor that touches ePHI.
6. Rehearse the breach runbook, including the 60 day outer limit.

Quick check

Sources

• 45 CFR 164.312, technical safeguards
• 45 CFR 164.308, administrative safeguards
• 45 CFR 164.404, notification to individuals

Last reviewed: 18 October 2026.