HIPAA is a set of U.S. federal requirements that applies to covered entities and, in defined circumstances, their business associates. The Privacy Rule governs permitted uses and disclosures of protected health information and gives individuals rights over their information. The Security Rule focuses on administrative, physical, and technical safeguards for electronic protected health information. The Breach Notification Rule establishes duties following certain breaches of unsecured PHI.

HIPAA compliance is contextual, not a universal product label. The same application can be deployed compliantly in one environment and noncompliantly in another because data flows, contracts, access, configuration, integrations, monitoring, policies, and workforce behavior differ.

The first deliverable should not be a security checklist. It should be a data-flow and responsibility map showing what information is involved, why it is needed, who may use it, where it is stored, which vendors receive it, how long it remains, and what happens when a user requests access, correction, or export.

Compliance by design means a control has an owner, an implementation, an acceptance test, operational evidence, and a review trigger. A policy without implementation is incomplete. A technical control without documentation and operating ownership is fragile.

HHS summarizes Security Rule technical safeguards around access control, audit controls, integrity, authentication, and transmission security. A production healthcare platform should implement these through consistent platform capabilities rather than one-off feature code.

A healthcare team should not depend on individual developers remembering every security and privacy requirement. The delivery pipeline should make insecure choices difficult, detect problems early, and preserve review evidence.

HHS explains that merely selling software does not automatically make a vendor a business associate when the vendor has no access to PHI. When a vendor creates, receives, maintains, or transmits PHI on behalf of a covered entity or business associate in a way that meets the definition, the relationship generally requires an appropriate business associate agreement and corresponding safeguards.

Review the actual service and data flow, not the vendor’s marketing page. A company may offer one product under a BAA and another outside it. Optional support, analytics, logging, model-training, preview, backup, or integration features may change the data path.

The safest default is to avoid production PHI in local development, demos, automated tests, screenshots, issue trackers, analytics, and routine support. Use synthetic data that preserves realistic structure and edge cases without identifying real patients.

Security incidents and reportable breaches are not identical. The response process must rapidly contain the event, preserve evidence, determine what information and people were affected, evaluate legal and contractual obligations, communicate accurately, and prevent recurrence.

HHS states that an impermissible use or disclosure is generally presumed to be a breach unless the regulated entity demonstrates a low probability that PHI was compromised using the required risk-assessment factors. The software therefore needs evidence-quality audit events, reliable timestamps, identity context, data lineage, and retention sufficient for investigation.

The proposal nevertheless gives engineering leaders a useful view of regulatory direction. HHS proposed more prescriptive risk analysis, written documentation, asset inventories and network maps, stronger authentication, encryption, incident planning, restoration procedures, vendor verification, and removal of much of the current distinction between required and addressable implementation specifications.