Skip to content
ComplianceOfficer
§ 01

45 CFR Parts 160, 164

HIPAA compliance software that watches the Security Rule change

Run the free scan

Work email and a 6 digit code. No card, nothing charged. Starter plan $149 a month when you want the daily watch.

HIPAA compliance software helps a covered entity or business associate meet the Security, Privacy and Breach Notification Rules: it runs the required Security Risk Analysis, tracks the administrative, physical and technical safeguards, holds your policies, training records and Business Associate Agreements, and keeps the evidence an OCR investigator would ask for. ComplianceOfficer adds the part most HIPAA tools leave to you: it checks what HHS, OCR and the Federal Register publish once a day and emails you each new change, tagged HIPAA, with the source. It does not run the risk analysis or hold your BAAs.

Scan your HIPAA obligations now

Pick Healthcare and HIPAA below. The scan returns the obligation register for your sector with the last 12 months of regulatory movement, sources linked. No signup, nothing stored.

§ Live · Compliance scan

One free run. Nothing you pick is stored.

Frameworks you answer to

Fintech, US · first rows of a real scan

  • § 01 Control environment and governance
  • § 02 Risk assessment and monitoring of controls
  • § 03 Logical access controls
  • § 04 System monitoring and incident response

The HIPAA obligations, line by line

  • § 01 Security Risk Analysis, kept current 164.308(a)(1)(ii)(A)
  • § 02 Administrative safeguards and workforce training 164.308
  • § 03 Physical safeguards and device controls 164.310
  • § 04 Technical safeguards, access and audit controls 164.312
  • § 05 Business Associate Agreements 164.502(e), 164.308(b)
  • § 06 Breach notification clock 164.404 · 60 days
  • § 07 Right of access requests 164.524
  • § 08 The proposed Security Rule rewrite NPRM, 6 Jan 2025

When you pick HIPAA, the scan puts five of these on your register: the Privacy Rule, the Security Rule risk analysis, the safeguards, business associate agreements and breach notification. You mark each one in place or a gap, with a note, and can ask for a policy draft for a gap. When the daily check finds OCR guidance, an enforcement action or the final Security Rule, you get an email with the source. The loop is described on how it works.

§ 02 The rule that has not landed yet

The 2026 HIPAA Security Rule changes are still proposed, not law

A lot of vendor pages currently tell healthcare buyers that MFA and encryption are now mandatory under HIPAA. As of July 2026 that is not correct, and buying on the strength of it means buying on a false premise. Here is the actual state of play.

HHS published a Notice of Proposed Rulemaking on 6 January 2025 that would rewrite the Security Rule: it removes the long-standing distinction between required and addressable implementation specifications, and makes multi-factor authentication, encryption of ePHI at rest and in transit, asset inventories, network maps and defined restoration timelines explicitly required. The public comment period closed on 7 March 2025. No final rule has been issued, and the regulatory timetable for final action has slipped into 2027. Our guide to the 2026 HIPAA Security Rule changes goes through each proposed safeguard and what is enforceable today.

What that means practically: you are still governed by the Security Rule as it stands, where encryption remains addressable and must be reasoned about in your risk analysis rather than simply switched on. But OCR is enforcing the current rule hard, and risk analysis failures remain the single most cited deficiency. The sensible position is to close the gap on your risk analysis now, treat the proposed safeguards as the direction of travel, and have something checking the Federal Register so that when the final rule lands you hear it from a daily check of the source, not from a newsletter three weeks later. That is the job this product does, and it is the same engine behind regulatory change management.

What HIPAA compliance software actually covers

The category is broader than it looks, and the tools in it do genuinely different jobs. Read the row that matches the problem you are trying to solve.

Job to be done What the tool does Who it suits
Security Risk Analysis Guided questionnaire producing a documented, defensible risk analysis and remediation plan Every covered entity and business associate, without exception
Policies and training Policy templates, workforce attestation, annual training records Practices and clinics with no dedicated compliance staff
Control automation Cloud and identity integrations that test technical safeguards and collect evidence continuously Health tech and SaaS business associates on AWS, Azure or GCP
BAA management Tracks which vendors touch PHI, whether a signed BAA exists, and when it was last reviewed Anyone with a real vendor footprint
Regulatory watch Monitors OCR, HHS and the Federal Register and tells you when the rule moves Teams who cannot afford to learn about a rule change late

Most incumbents are strong on the middle three rows and quiet on the last one. That is the gap ComplianceOfficer is built for, and the same argument runs through our SOC 2 compliance software and vendor risk management software pages. If you are weighing HIPAA against the security frameworks your enterprise buyers ask for, the ISO 27001 vs SOC 2 comparison sets out which one a US healthcare buyer will actually accept.

§ 03 Questions buyers ask

HIPAA compliance software questions, answered

Can software be HIPAA certified?

No. HHS does not certify or endorse any product as HIPAA compliant, and no vendor can sell you a certification that HHS recognizes. Compliance is a property of your organization and how it uses a tool, not a badge the tool carries. What a vendor can legitimately sign is a Business Associate Agreement. Treat any HIPAA certified seal on a pricing page as marketing.

Does HIPAA require a security risk assessment?

Yes. A risk analysis is a required implementation specification under the Security Rule at 45 CFR 164.308(a)(1)(ii)(A). It has to be accurate, thorough, and kept current as your systems change, which means it is not a document you produce once and file. An inadequate or missing risk analysis is among the most frequently cited findings in OCR enforcement actions.

What is a Business Associate Agreement?

A BAA is the contract required under 45 CFR 164.502(e) between a covered entity and any vendor that creates, receives, maintains or transmits protected health information on its behalf. It does not make the vendor compliant. It binds them to safeguard PHI, to report breaches to you, and it creates accountability if they fail. If a vendor touches PHI and will not sign one, that is the answer to your evaluation.

How long do I have to report a HIPAA breach?

Affected individuals must be notified without unreasonable delay and no later than 60 days after discovery of the breach. Breaches involving 500 or more individuals must also be reported to HHS within that same 60 day window, and to prominent media in the affected state. Smaller breaches are logged and reported to HHS annually, within 60 days of the end of the calendar year.

How much does HIPAA compliance software cost?

For a small practice, guided risk analysis and policy tools generally run in the low thousands of dollars per year. Automated platforms aimed at health tech companies, with cloud integrations and continuous control monitoring, are typically five figures annually once audit support is included. Our tiers are set out on pricing, and the trade-offs are broken down in how much compliance software costs.

General regulatory information, not legal advice.

Run the compliance scan
§ 90

Related registers

§ 99 · Final entry

Create your account

Leave your work email, confirm the 6-digit code, and your account is ready. Nothing is charged to create it.

Buy the plan