HIPAA Software
Definition
HIPAA software is any application that creates, receives, maintains, or transmits Protected Health Information (PHI) and must comply with the HIPAA Security Rule's administrative, physical, and technical safeguards. Healthcare software companies that handle PHI must sign a Business Associate Agreement (BAA) with covered entities -- violations carry fines of $100-$50,000 per violation up to $1.9 million annually.
HIPAA compliance is not a certification -- it is an ongoing operational requirement. The HHS Office for Civil Rights enforces HIPAA through audits, complaints, and breach investigations. The largest HIPAA fines (Anthem: $16M; Community Health Systems: $5M) involve inadequate technical safeguards for PHI at rest and in transit.
Key technical safeguards for HIPAA software
- Encryption of PHI at rest (AES-256) and in transit (TLS 1.2+)
- Unique user identification and automatic logoff
- Audit controls: logs of all access to PHI with user, timestamp, and action
- Integrity controls: PHI cannot be altered or destroyed without detection
- Transmission security: end-to-end encryption for all PHI over networks
HIPAA and AI
Using an LLM API (OpenAI, Anthropic) to process PHI requires a BAA with the LLM provider. Both OpenAI and Anthropic offer BAAs for enterprise plans. Sending PHI to a model without a BAA is a HIPAA violation regardless of the model's security posture. Self-hosted models eliminate the BAA requirement at the cost of significant infrastructure overhead.
Related terms
FedRAMP
FedRAMP is the U.S. government's standardized security authorization program for cloud services used by federal agencies, reusable across agencies once granted.
ATO (Authority to Operate)
An Authority to Operate (ATO) is the formal approval granted by a federal Authorizing Official that allows a software system to operate within a government environment after completing the NIST Risk Management Framework assessment process. ATOs are required before any federal system goes live and must be continuously maintained -- typically reviewed annually and triggered by significant system changes.
Section 508
Section 508 requires federal agencies to buy, build and use accessible technology that meets the Access Board's Revised 508 Standards, which adopt WCAG 2.0 AA.
SOC 2
SOC 2 (System and Organization Controls 2) is an auditing standard developed by the AICPA that evaluates a software company's controls over security, availability, processing integrity, confidentiality, and privacy. A SOC 2 Type II report -- covering 6-12 months of operating effectiveness -- is increasingly required by enterprise buyers and is a de facto procurement requirement for B2B SaaS vendors.
See how we implement this
Custom Application Development
Purpose-built software designed around your exact requirements.
Legacy System Modernization
Migrate, refactor, or replace aging systems without disrupting operations.
Security & Compliance
How we secure client systems, and how compliance requirements are scoped in the design phase on regulated builds.
AI Workflow Automation
LLMs and intelligent agents that eliminate repetitive work across your organization.
Need help implementing this in your business?
Code and Trust translates AI concepts like hipaa software into working implementations, starting with a workflow audit that shows exactly where it creates ROI.
Schedule AI Audit →