HIPAA Compliance and IT: What Healthcare Businesses Need to Know

Most healthcare practices think of HIPAA compliance as a legal and administrative issue — policies, training, signed forms. That's part of it, but a significant portion of HIPAA compliance is technical, governed by what's called the Security Rule. If your practice handles electronic protected health information (ePHI), your IT systems are directly in scope, whether or not anyone has ever framed it that way to you.

What is the HIPAA Security Rule?

The Security Rule requires covered entities and their business associates to implement administrative, physical, and technical safeguards to protect ePHI. The technical safeguards are the ones that live squarely in IT — access controls, audit logging, data integrity protections, and secure transmission — and they're the piece most small practices haven't fully addressed, often without realizing it.

The Technical Safeguards That Actually Matter for IT

Access Control

Every user needs a unique login — no shared accounts — along with role-based permissions so staff only see the patient data relevant to their job, automatic logoff on idle sessions, and multi-factor authentication on anything that touches ePHI. This is the same identity and access management work we do for Entra ID and Okta migrations, applied specifically to a HIPAA context.

Audit Controls

You need a record of who accessed what ePHI, when, and what they did with it. Most small practices running default Microsoft 365 or basic EHR configurations don't have this logging turned on or reviewed in any meaningful way — it's one of the most common gaps we find.

Integrity Controls

Safeguards to ensure ePHI isn't improperly altered or destroyed, whether by an attacker, a software bug, or an honest mistake. This usually comes down to proper backup configuration, version history, and controlled access to who can modify records.

Transmission Security

Any ePHI sent over a network needs to be encrypted in transit — email containing patient information is a common failure point here — and data at rest (on servers, in cloud storage) needs to be encrypted as well.

Common Gaps We See in Small Healthcare Practices

• MFA isn't enforced account-wide, or is only turned on for some staff
• Former employees still have active access to systems containing patient data
• Patient information gets sent over regular, unencrypted email
• No Business Associate Agreement (BAA) on file with a cloud vendor that touches ePHI
• Audit logging exists but nobody is reviewing it
• Staff use personal devices to access patient data without any device-level safeguards

What Happens If You're Not Compliant?

Beyond the technical risk of a breach, HIPAA has its own breach notification requirements — affected patients, and in larger breaches the Department of Health and Human Services and media, have to be notified within specific timeframes. Penalties for non-compliance scale with negligence, and a breach involving PHI tends to be more reputationally damaging for a healthcare practice than for most other businesses, since patient trust is the product.

How to Get Started

A HIPAA Security Rule gap assessment is the right starting point — it tells you specifically where your technical safeguards fall short against the requirements above, with a prioritized plan to close them. One honest caveat: full HIPAA compliance also involves policies, training, and administrative safeguards outside of IT, so this isn't a substitute for guidance from your compliance officer or legal counsel — it's the technical half of the picture, done right.

If you're not sure where your practice stands, a free consultation is a low-pressure way to find out what a gap assessment would actually look like for your systems.