HIPAA is a US federal law whose regulations protect individually identifiable health information. It applies to covered entities, meaning health plans, health care clearinghouses and health care providers that transmit health information electronically for covered transactions, and to business associates that handle that information for them. The text defines duties, not a certificate.
Safeguard does not hold any HIPAA attestation. This is an explainer based on the federal regulation text.
Who counts as a covered entity?
The regulation at 45 CFR 160.103 defines a covered entity as a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a covered transaction.
A health care provider includes anyone who furnishes, bills or is paid for health care in the normal course of business, along with providers of services under the Social Security Act. Whether a small practice is covered depends on whether it conducts those electronic transactions.
Who is a business associate?
A business associate is a person who, on behalf of a covered entity, creates, receives, maintains or transmits protected health information for a regulated function, or provides certain services such as legal, accounting or data aggregation that involve disclosure of that information. The definition includes subcontractors of business associates, health information organizations and personal health record providers.
For a software company, the question is simple to state: does your service store or process protected health information for a covered entity? If yes, you are likely a business associate and need a contract with the right terms. Ask counsel to confirm.
What is protected health information?
It is individually identifiable health information, transmitted or maintained electronically or in any other form. The definition excludes certain education records, employment records held by a covered entity as an employer, and information about a person deceased for more than 50 years.
What does the Security Rule ask first?
Section 164.308 sets administrative safeguards. Four required implementation specifications sit under the security management process:
- Risk analysis: assess potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information.
- Risk management: put security measures in place to reduce those risks to a reasonable and appropriate level.
- Sanction policy: apply sanctions to workforce members who fail to follow security policies.
- Information system activity review: regularly review records such as audit logs, access reports and security incident tracking reports.
Section 164.308(a)(8) adds periodic technical and nontechnical evaluation. The first evaluation uses the rule's standards. Later ones are triggered by environmental or operational changes that affect the security of that information.
Where do software dependencies come in?
Risk analysis has to cover the systems that hold the data. If your application runs on open source libraries, a vulnerable library is a risk to the confidentiality, integrity or availability of what it processes. A dated dependency inventory and vulnerability scan results are practical inputs to the risk analysis and to the activity review, though the rule does not name any specific tool.
What to do
- Decide whether you are a covered entity, a business associate or neither, and write the reasoning down.
- Sign a business associate agreement with every covered entity customer and every subcontractor that touches the data.
- Run and document a risk analysis covering every system that stores or sends the data.
- Record the measures you chose to reduce each risk and the owner.
- Review logs and access reports on a schedule and keep proof.
- Re-evaluate after every major change to systems or workflows.
Quick check
Is there a HIPAA certification?
The regulation text we read defines duties and definitions and does not define a certificate. Vendors may show third party assessments, but those are separate from the rule.
Does a small practice have to comply?
If it is a health care provider that transmits health information electronically in connection with a covered transaction, it is a covered entity regardless of size.
Sources
Last reviewed: 18 October 2026.
