HIPAA Compliance Checklist for Software Development

For electronic PHI, the Security Rule (45 CFR 164.308 to 164.316) requires administrative, physical and technical safeguards, written BAAs with vendors that handle PHI, and written policies kept for 6 years. The Breach Notification Rule (164.400 to 164.414) sets who must be told after a breach and by when, and the Privacy Rule limits uses of PHI and defines de-identification (164.514(b)). These duties fall on covered entities and on business associates, which includes a software vendor that creates, receives, maintains or transmits PHI for a healthcare provider or health plan.

A Required implementation specification must be implemented. An Addressable one is not optional: under 45 CFR 164.306(d)(3) you must assess whether it is reasonable and appropriate for your system, implement it if it is, and if it is not, document why and implement an equivalent measure where reasonable. Standards that have no implementation specifications, such as audit controls (164.312(b)), must be met as written.

Under the current rule, encryption at rest (164.312(a)(2)(iv)) and in transit (164.312(e)(2)(ii)) are addressable, so you must implement them or document an equivalent measure. In practice, hospital security reviews expect both, and PHI encrypted by a method in HHS's breach guidance is not unsecured PHI, so losing an encrypted device may not require breach notification. HHS's January 2025 proposal would make encryption required, but it has not been finalized.

Yes. 45 CFR 164.312(b) requires mechanisms that record and examine activity in systems containing ePHI, and 164.308(a)(1)(ii)(D) requires regular review of those records. The rule sets no specific retention period for audit logs. The 6-year retention in 164.316(b)(2)(i) applies to required documentation, such as policies and records of required actions, so many teams keep logs for 6 years as a conservative choice.

No. The provider's BAA covers only the services on its HIPAA-eligible list, and only its side of the shared responsibility model. Configuring those services, access control, audit logging, backups, your other vendors' BAAs and your policies remain your responsibility. This checklist maps those duties to engineering work; meeting them depends on your risk analysis and how the system is run.

Avoid it. Copying production PHI into development widens who can see it, which works against the minimum necessary standard and your access controls, and every tool in that environment then needs a BAA. Use synthetic data, or data de-identified under 45 CFR 164.514(b) by removing all 18 Safe Harbor identifiers or through an expert determination.

No. HHS published the proposed rule, "HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information", on January 6, 2025 (90 FR 898). As of October 30, 2026, the Federal Register shows no final rule under its RIN (0945-AA22), and the Fall 2025 Unified Agenda lists final action for July 2027. Until a final rule is published, the current Security Rule, including its Addressable specifications, is the law.

No. HHS does not certify software or vendors as HIPAA compliant, and the HIPAA rules contain no certification requirement. Customers may ask for third-party evidence such as a SOC 2 Type II report or a HITRUST assessment; those are commercial attestations, not HIPAA approvals.