HIPAA IT Requirements: The Technical Controls Your Practice Must Have
Meeting HIPAA IT requirements means building a technology environment that actively protects patient data from unauthorized access. HIPAA is the Health Insurance Portability and Accountability Act, a 1996 US federal law. Its administrative simplification rules protect the privacy and security of protected health information (PHI) and are enforced by the HHS Office for Civil Rights (OCR).
For a modern medical practice, clinic, or business associate, HIPAA technical compliance is a concrete, verifiable build-out of controls across your network, devices, and cloud services. Signing paperwork is only the first administrative step.
PHI is individually identifiable health information held or transmitted in any form. The electronic subset of this data is called ePHI, which includes your electronic health record (EHR) data, email communications, server backups, and network file shares.
What makes health information identifiable. HHS recognizes 18 identifiers. These include a patient name, address, dates of treatment, phone numbers, email addresses, and Social Security numbers. They also include medical record numbers and biometric identifiers. Removing all 18 of these identifiers (a process known as safe harbor) de-identifies the data. In a working medical environment, your staff needs access to this identifiable information to provide care.
Three rules matter for compliance work. Because you must store and transmit this sensitive data, you are subject to strict regulations:
| Rule | What it governs |
|---|---|
| Privacy Rule | How PHI may be used and disclosed, and the rights patients have over their own records |
| Security Rule | Safeguards for ePHI, split into administrative, physical, and technical categories |
| Breach Notification Rule | What must happen when unsecured PHI is exposed |
This guide breaks down exactly what the Security Rule demands and how those mandates translate into a real, functional it stack for your organization.
OCR enforcement, by the numbers: OCR’s own enforcement record shows one failure keeps recurring: in 2023, seven of OCR’s HIPAA resolution agreements, nearly half that year’s total, followed investigations that found no compliant risk analysis. The 2024 Change Healthcare hack exposed the health data of 192.7 million people, the largest healthcare data breach in US history. And any breach affecting 500 or more individuals draws OCR scrutiny automatically.
HIPAA it Requirements: Translating the Security Rule to Your it Stack
The Security Rule requires three safeguard categories to protect ePHI. Here is how they break down and where this guide covers each one.
| Safeguard category | What it covers | Where it is covered in this guide |
|---|---|---|
| Administrative | Risk analysis, policies, workforce training, access management, and naming a Security Officer | Risk analysis and compliance officers, covered in this section |
| Physical | Facility and device controls, workstation security, and media disposal | Device and Media Disposal, inside the technical checklist below |
| Technical | The actual software and hardware mechanisms that protect ePHI and control access to it | The seven-item technical checklist that follows |
The translation from regulation to operational it stack follows a clear sequence. The federal regulations tell you what data to protect, but they do not provide a shopping list of which software to buy. You have to translate the HIPAA security rule technical safeguards into a concrete managed it setup. Here is the process, step by step.
Start With a Risk Analysis
A documented, current risk analysis is the foundation of your entire compliance program. It is also one of the first documents OCR asks to see in an investigation. The enforcement numbers earlier in this guide show why regulators treat it as non-negotiable. You must formally assess your vulnerabilities and implement the right technology to mitigate those specific risks.
Designate Your Officers
HIPAA requires formally designating a Privacy Officer and a Security Officer. Existing staff members may hold these roles, but they must be the named accountable owners of the compliance program. These officers work closely with your IT provider to ensure the technical controls align with your administrative policies.
Know the Enforcement Triggers
OCR investigations typically start from a complaint (patient, employee, or competitor), a reported breach, or selection under the OCR audit program. Your practice might be smaller than Change Healthcare, but the threats are identical.
The audit itself is mostly a documentation request. OCR asks for your risk analysis, policies, training records, access logs, incident records, and vendor agreements. If your it stack cannot produce that evidence, your practice is at risk.
Build a Layered Defense
To prevent disasters, your IT provider must build a layered defense that meets the specific mandates of the Security Rule. You can read more about the administrative and physical aspects in our guide to the HIPAA Security Rule explained.
The Technical Checklist for Your Practice
Here is exactly what your it stack needs to include. These are the concrete deliverables your managed IT provider should implement and monitor every day. The table below maps each control to its regulatory mandate, the MSP deliverable, and what an OCR auditor will ask to see.
| Control | Security Rule Mandate | MSP Deliverable | OCR Audit Evidence |
|---|---|---|---|
| Access Control + Unique IDs + MFA | Implement technical policies that allow only authorized persons or programs to access ePHI | Give every user a unique login, enforce MFA, set automatic logoff, document emergency access procedure | User access list with unique IDs, MFA enforcement report, emergency access procedure document |
| Encryption at Rest and in Transit | Implement a mechanism to encrypt and decrypt ePHI | Apply AES-256 encryption on every laptop, desktop, and server; encrypt all email and transmissions containing patient data | Endpoint encryption compliance report, email encryption gateway configuration record |
| Audit Logging and Review | Implement mechanisms that record and examine activity in systems containing ePHI | Aggregate logs from EHR, firewalls, servers, and Microsoft 365 in a SIEM; retain records for six years | Access logs spanning the requested time window, SIEM alert configuration, review-frequency documentation |
| Data Backup and Disaster Recovery | Ensure availability of ePHI through contingency planning | Run automated, encrypted, offsite, immutable backups; perform routine test restores | Backup test results, restore-time documentation, offsite-storage agreement |
| Endpoint Protection and Software Compliance | Protect against malicious software and unauthorized access at the device level | Deploy EDR on every device, manage patching actively, retire unsupported operating systems and EHR versions | EDR deployment report, patch-compliance dashboard, supported-software inventory |
| Device and Media Disposal | Implement policies for final disposition of ePHI and the hardware on which it is stored | Wipe drives to NIST SP 800-88 standards or physically destroy them; maintain documented chain of custody | Device disposal log with serial numbers, wipe-certification or destruction records, chain-of-custody documentation |
| Secure Remote Access | Protect ePHI accessed from outside the facility | Require VPN or secure gateway with MFA on every login; deploy MDM for phones and tablets that touch company data | VPN/MFA enforcement report, MDM enrollment dashboard, remote-access policy document |
The rest of this section walks through each control in detail.
Access Control, Unique IDs, and Authentication
The law requires you to implement technical policies and procedures that allow only authorized persons or software programs to access ePHI. This falls directly under HIPAA access control requirements.
In a practical IT environment, every single user must have a unique user ID. You cannot share generic logins like “frontdesk”, “nurse1”, or “admin”. If an unauthorized change occurs or a file is deleted, you must be able to trace that action back to a specific, named individual.
Role-based access and the minimum necessary standard. This concept ties heavily into the minimum necessary standard. A billing specialist needs access to financial records and certain treatment codes, but they likely do not need access to full clinical notes. Your IT team must configure your network and software permissions so that employees only access the ePHI necessary to do their specific jobs.
Authentication and MFA. Meeting HIPAA password and authentication requirements means moving beyond a simple username and password. Multi-factor authentication (MFA) is a critical control, and HHS has proposed requiring it explicitly under the Security Rule. When a user logs into your EHR, email system, or VPN, they must provide a password plus a second factor, such as a time-based code from an authenticator app. If a hacker steals a doctor’s password, MFA stops them from logging in.
Automatic logoff and emergency access. You also need automatic logoff controls. If a nurse walks away from a workstation in a busy exam room, the computer must lock itself after a short period of inactivity. This prevents unauthorized users from accessing the system while the authorized user is away.
Finally, you need a process for emergency access. If a provider gets locked out during a medical emergency, there must be a documented, secure way to access necessary ePHI to ensure patient care is not delayed.
Encryption at Rest and in Transit
Encryption is one of the most vital technical safeguards you can deploy. It scrambles your data so that it is unreadable to anyone who does not have the specific decryption key. Meeting HIPAA data encryption requirements means you must protect ePHI both when it is stored (at rest) and when it moves across networks (in transit).
At rest vs. In transit: how they differ and why both matter.
| Encryption at Rest | Encryption in Transit | |
|---|---|---|
| What it protects | Stored data on laptops, desktops, servers, and backup media | Data moving across your network, the internet, or via email |
| Technology | AES-256 full-disk encryption on every device | TLS encryption for web traffic, encrypted email gateways, secure VPN tunnels |
| Breach consequence if implemented | A stolen encrypted laptop is generally not “unsecured PHI” — the theft is usually not a reportable breach | Intercepted encrypted traffic is unreadable; no patient data is exposed |
| Breach consequence if skipped | A stolen unencrypted laptop triggers mandatory patient and media notification, plus OCR investigation | Plain-text email interception equals a reportable breach with full notification obligations |
| MSP action required | Enforce encryption on every device that stores ePHI; produce compliance reports on demand | Configure email encryption, enforce secure transmission protocols, block unencrypted ePHI emails |
For data at rest, your IT team must encrypt the hard drives on all laptops, desktops, and servers using industry-standard AES-256 encryption. This provides a massive compliance advantage. Properly encrypted data is generally not considered “unsecured PHI.” If a fully encrypted laptop is stolen from a doctor’s car, the loss is usually not a reportable breach, and you avoid the costs and reputational damage of notifying patients and the media.
For data in transit, your IT provider must ensure that any email containing patient information is encrypted. Standard email is sent in plain text, which malicious actors can easily intercept. Your provider must configure your email system to automatically encrypt messages containing ePHI, or provide a secure, encrypted portal for patients and partners to use.
Audit Logging and Review
You cannot just set up security controls and assume they keep working perfectly forever. The Security Rule requires you to implement hardware, software, and procedural mechanisms that record and examine activity in information systems that contain or use ePHI.
Fulfilling HIPAA audit log requirements means your it stack must track who logs in, when they log in, what files they access, and what changes they make. Your EHR system has its own internal audit logs. Your IT provider must also collect logs from your firewalls, servers, Microsoft 365 environment, and remote access gateways.
Active review, not just collection. Collecting logs is only half the requirement. You must also actively review them. A modern managed IT provider uses a Security Information and Event Management (SIEM) tool to aggregate these logs and alert a security team to anomalous behavior. For example, a user downloading thousands of patient files at 2 a.m. Or dozens of failed logins from a foreign country must trigger immediate investigation.
There is also a strict documentation retention requirement. You must keep compliance policies and related records (which can include certain audit data) for six years.
Data Backup and Disaster Recovery
Availability is a core component of information security. If a ransomware attack locks your systems or a server hardware failure destroys your data, you must restore operations quickly to continue patient care. Fulfilling HIPAA data backup and disaster recovery obligations requires more than copying files to a USB drive once a week.
You need an automated, encrypted backup system that stores copies of your ePHI securely offsite. Modern it standards require immutable backups. An immutable backup cannot be altered or deleted by anyone, not even an administrator, for a set period. If ransomware infects your network and tries to delete your backups, the backup data remains safe and intact.
Test your restores routinely. A backup system is useless if the files are corrupted or if restoration takes three weeks. Your IT provider should perform routine test restores to prove your practice can recover data quickly and completely in a real emergency.
Endpoint Protection and Software Compliance
Every device that touches your network is a potential entry point for attackers. This includes traditional workstations, laptops, tablets, and even mobile phones used for work. Endpoint protection must go far beyond traditional, outdated antivirus software.
Modern it stacks use Endpoint Detection and Response (EDR) tools. EDR monitors device behavior in real time to stop advanced threats like ransomware before they spread across your network. If a malicious file tries to encrypt a hard drive, the EDR software detects the abnormal behavior, kills the process, and isolates the infected machine from the rest of the network.
Software compliance: supported, patched, and current. When evaluating HIPAA software compliance requirements, ensure every application handling ePHI is secure, actively supported by the vendor, and properly configured. Running outdated software like Windows 7, old versions of Windows Server, or unsupported EHR versions is both a massive security risk and a direct compliance failure.
Your IT provider must actively manage patch management. All operating systems, applications, and network devices need critical security updates as soon as manufacturers release them.
Device and Media Disposal
When a computer, server, or hard drive reaches the end of its useful life, you cannot simply throw it in the dumpster, sell it online, or donate it to a school. Proper HIPAA device and media disposal is a strict requirement under the physical safeguards, and it heavily involves your IT team and their technical processes.
Follow this four-stage decommissioning workflow for every device:
- Decommission the device. Identify all storage media in the device and remove it from the production network. Log the device in your asset inventory with its serial number and the date of decommissioning.
- Sanitize the media. Use specialized software to securely wipe the drives to NIST SP 800-88 media sanitization standards, the current federal benchmark. Simply deleting files or formatting the drive is never enough — basic data recovery tools can retrieve deleted files from a formatted drive.
- Physically destroy or repurpose. After verification of the wipe, either physically destroy the media (industrial shredding of hard drives) or repurpose the device internally if it passed sanitization.
- Document the chain of custody. Keep a detailed log for every disposed device: serial number, wipe method used, date, and the person who performed the work. This documentation proves to an auditor that the data was handled correctly.
Secure Remote Access
The shift to remote work, telehealth, and outsourced billing has expanded the boundaries of the traditional medical office. If your staff accesses ePHI from home, from a coffee shop, or while traveling, that connection must be strictly secured.
VPN, MFA, and encryption as a baseline. Users connecting from outside the office should use a secure Virtual Private Network (VPN) or a secure remote desktop gateway. This connection must enforce encryption in transit and strictly require multi-factor authentication for every login attempt.
Manage the remote devices, not just the connection. The remote devices themselves must meet your organizational security standards. Your IT provider should enforce policies that prevent staff from downloading ePHI onto personal, unmanaged home computers. If an employee uses a personal laptop, that device must still be subject to your security policies. Otherwise, access should be restricted to a secure web portal where data cannot be saved locally.
Mobile Device Management (MDM) tools ensure that any smartphones or tablets accessing company data are encrypted, password-protected, and can be remotely wiped if lost or stolen.
HIPAA-Compliant Email and Cloud Storage
Many practices assume that buying a product with a compliance label solves their regulatory problems. That is a dangerous misconception. No vendor or cloud platform can sell you a blanket “HIPAA certified” status that covers your organization’s compliance. Meeting HIPAA email security requirements and using HIPAA-compliant cloud storage requires two specific things: a signed contract and proper technical configuration.
The BAA is non-negotiable. A Business Associate Agreement (BAA) is required before a business associate may access PHI. It makes the vendor legally responsible for protecting the data. It specifies permitted uses, safeguards, breach reporting, and subcontractor obligations. Cloud providers like Microsoft or Google act as business associates if you store ePHI on their servers. Using their services without a signed BAA is itself a violation of the Security Rule.
If you are wondering does your IT vendor need a BAA?, the answer is always yes. Any subcontractors your IT vendor uses must also sign BAAs to ensure the legal obligations flow down the chain.
Configuration is the second half of compliance. A vendor might sign a BAA for their enterprise platform, but you still have to turn the security features on. If you buy Microsoft 365 but fail to enforce MFA, leave audit logging disabled, and allow unencrypted ePHI emails, you are not compliant.
Fulfilling your HIPAA business associate it obligations means your IT provider must actively configure, monitor, and manage these cloud tools to align with the Security Rule.
What Your MSP Should Be Able to Evidence
When the HHS Office for Civil Rights investigates, they do not just take your word that your it stack is secure. The audit process, as covered above, is mostly a documentation request. You have to prove your compliance with hard evidence.
Your managed IT provider must produce that evidence on demand. Work through this table with them:
| Evidence Type | What it Proves | OCR’s Expectation | If Missing |
|---|---|---|---|
| Access Logs | Every login, file access, and change is traceable to a specific named user | Logs must cover the requested time window; the MSP must deliver them promptly | No way to prove who accessed what; a single missing log can escalate an investigation |
| Current Documented Risk Analysis | You have formally assessed your ePHI vulnerabilities and mitigations | This is the first document OCR requests; it must be current and complete | OCR considers the absence of a risk analysis a foundational violation — nearly half of 2023 resolution agreements cited this |
| Signed BAAs | Every vendor and subcontractor handling your ePHI is legally accountable | OCR expects BAAs with your MSP, cloud providers, and every subcontractor in the chain | An unsigned BAA is itself a Security Rule violation; liability flows to your practice |
| Endpoint Encryption Reports | Every laptop, desktop, and server that stores ePHI is encrypted | OCR wants a compliance report showing encryption status across every device | A single unencrypted device makes every piece of ePHI on it “unsecured PHI” — a breach waiting to happen |
| Backup Test Results | Your backups actually work and you can recover within an acceptable time window | OCR expects documented test restores performed on a routine schedule | Untested backups are a gamble; corrupted backups discovered during a real disaster equal unrecoverable ePHI |
| MFA Enforcement Reports | Multi-factor authentication is enforced across all users, not just some | OCR expects proof that MFA is active on your EHR, email, VPN, and any system touching ePHI | A single account without MFA is an open door for credential theft; HHS has proposed making MFA an explicit requirement |
If your current IT provider cannot quickly generate this evidence, your practice is carrying a massive, hidden risk. Compliance is an ongoing state you maintain and can evidence, not a certificate you buy once and forget.
See Where You Stand
Take our free 2-minute HIPAA Risk-Check to see your audit-readiness level and the gaps you need to fix. It features 8 plain-English questions, and there is no sign-up required to see your result.
free HIPAA compliance checklist
Related Guides
- What Is HIPAA? A Plain-English Guide for Business Owners
- What Is a HIPAA Business Associate Agreement (BAA)?
- HIPAA Violations: Examples, Fines, and What Happens
- The HIPAA Privacy Rule Explained for Businesses
Frequently Asked Questions
What is the HIPAA tech rule?
The technical safeguards of the HIPAA Security Rule dictate how electronic protected health information must be secured. It requires specific technology controls like unique user IDs, emergency access procedures, automatic logoff, and data encryption. These rules ensure that only authorized individuals can access patient data.
What does it take for software to be HIPAA compliant?
Software itself cannot hold an official HIPAA certification. For a medical practice to use a software application compliantly, the vendor must sign a Business Associate Agreement taking legal responsibility for the data. The software must also be configured to enforce strict access controls, audit logging, and encryption.
What is the HIPAA rule for cybersecurity?
The HIPAA Security Rule acts as the primary cybersecurity mandate for healthcare providers and their vendors. It requires covered entities to perform a formal risk analysis to identify vulnerabilities. Based on that analysis, organizations must implement administrative, physical, and technical safeguards to protect electronic patient records from unauthorized access or breaches.
Does HIPAA apply to tech companies?
Yes, HIPAA applies directly to tech companies if they act as business associates. Any IT provider, cloud host, or software vendor that creates, receives, maintains, or transmits protected health information on behalf of a healthcare provider must comply. These vendors are directly liable under the Security and Breach Notification Rules.
Can Microsoft be HIPAA compliant?
Microsoft cloud services can be used in a HIPAA-compliant manner, but they are not compliant by default out of the box. You must sign a Business Associate Agreement with Microsoft before storing patient data on their servers. You must also configure your Microsoft 365 environment to enforce multi-factor authentication, audit logging, and email encryption.
Secure Your Practice with LeadingIT
Protecting patient data requires an IT partner who understands the strict demands of federal regulations. LeadingIT has helped Illinois practices meet HIPAA since 2010. We operate the technical half of HIPAA, signing BAAs as standard and delivering the access controls, encryption, and tested backups required by law.
Explore LeadingIT’s HIPAA compliance services, or review our managed cybersecurity services to see how we actively monitor and defend your network.
If you are ready to secure your practice and generate the evidence auditors demand, please contact us or use our book a call today at 815-788-6041.
