Who must comply with the HIPAA Security Rule explained

Does the HIPAA Security Rule apply to your organization?

The HIPAA Security Rule binds health plans, health care clearinghouses, covered health care providers that transmit health information electronically in connection with a HIPAA standard transaction, and business associates of covered entities. It protects only electronic protected health information (ePHI), so paper and spoken PHI fall outside it (45 CFR 164.302). If a customer contract or an OCR request asks you to prove Security Rule compliance, start by confirming which of these roles you hold, because that answer decides whether the Rule applies to you at all. Status depends on your role and the data you touch, not on your size, industry or whether you consider yourself a health company. A small billing vendor that receives patient records from a clinic is a business associate, while a provider that never sends standard electronic transactions may not be a covered entity. Confirm your status in writing before you commit budget. Map each system that creates, receives, maintains or transmits PHI for a covered entity, then check each engagement against the business associate definition in 45 CFR 160.103, including subcontractors that handle PHI on your behalf. Where the answer is unclear, the HHS covered entity decision tool and a qualified privacy or healthcare counsel can settle it. Keep the determination on file, since it sets the scope of every later control decision. Responsibility is split. Your organization owns its safeguards, policies and risk decisions. An implementation partner can configure, harden and document the self-hosted systems that hold ePHI and prepare the evidence. Only an independent auditor or assessor can test those controls and issue a report, and no HIPAA certificate replaces that work. Ask your partner and your assessor to state their roles in the scope document, so that neither party is assumed to be responsible for a control the other has agreed to own.

Which roles fall under the Security Rule

The Security Rule treats health plans and health care clearinghouses as covered entities by definition. A health plan covers individual or group arrangements that provide or pay for medical care, including insurers, HMOs and government programs. A clearinghouse converts health information between standard and nonstandard formats, typically for billing and claims. Neither role depends on how much data you hold or whether you transmit electronically, so the rule applies to the plan or clearinghouse itself.

Health plans: Commercial insurers, employer group health plans, Medicare and Medicaid programs and similar payers fall here.
Clearinghouses: Organizations that process claims into standard transaction formats for providers or payers are covered.
Electronic PHI only: The Security Rule protects ePHI held or transmitted by these entities, not paper records.
Business associate status: A health plan or clearinghouse that performs services for another covered entity may also carry business associate duties.
Confirm your role: Check whether your plan or clearinghouse status is defined in the CMS decision tool that HHS points to.

Before you scope a project, confirm with counsel whether your organization is a covered entity, a business associate or both, because the obligations and the contracts that flow from each differ.

Where the Security Rule stops: electronic PHI and entities outside HIPAA

The Security Rule covers electronic protected health information held by covered entities and business associates, and nothing else. The four boundaries below are the ones buyers most often misread, and each one depends on facts about the organization's own data flows and transactions, so each should be confirmed with counsel before it is relied on.

Paper and spoken PHI sit outside

The Security Rule protects PHI maintained in or transmitted by electronic media. PHI kept on paper, faxed from a paper original or spoken in a conversation is not covered by the Security Rule, although the Privacy and Breach Notification Rules may still apply to it. Check where each record is created, stored and shared, and whether a paper process is later scanned or keyed into an electronic system, because that conversion can bring the information into scope.

Paper-only billing may exclude providers

A health care provider is a covered entity only if it transmits health information electronically in connection with a HIPAA standard transaction, such as an electronic claim. A clinic that bills only on paper, with no electronic transactions, may fall outside the covered entity definition. Confirm this against the transaction logs of the practice management system and any clearinghouse, because a single electronic claim can change the answer.

No PHI, generally no HIPAA

A company that never creates, receives, maintains or transmits PHI on behalf of a covered entity is generally not a business associate. Software vendors, consultants and service providers that serve health organizations but never see patient information fall into this group. Map each contract and data feed to confirm the vendor does not touch PHI, including support access, log files and test data copied from production.

Electronic PHI brings systems into scope

Once a system stores or transmits PHI electronically for a covered entity, the company operating it can be a business associate even if it is not a health care provider, a health plan or a clearinghouse. Subcontractors that handle that PHI are also business associates. Inventory every system, backup, email account and endpoint that holds ePHI, because a single unmapped location can bring an otherwise unrelated business into scope.

How HITECH made vendors directly liable for Security Rule failures

Before the HITECH Act, the Security Rule's obligations ran mainly to covered entities: health plans, clearinghouses and providers. Vendors that handled PHI for them were reached through contract, not through the federal rule itself. Section 13401 of the HITECH Act changed that by applying the Security Rule's safeguards, policies and documentation requirements to business associates in the same way they apply to covered entities, with civil and criminal liability attached. The 2013 Omnibus Final Rule, dated January 25, 2013, finalized the change. For a vendor, the practical result is that a failure to implement the standards and implementation specifications is a failure under federal law, and the Office for Civil Rights can investigate and penalize the business associate directly, without waiting for the covered entity to act.

Being directly liable means a business associate has to be able to show its own compliance. Its risk analysis, access controls, audit logging, contingency planning and written policies must cover the electronic PHI it creates, receives, maintains or transmits. The addressable and required distinctions in the rule apply to the vendor's own environment, and the vendor must document its choices. A reader evaluating a vendor should confirm which systems hold or transmit ePHI, who owns the risk analysis for those systems, and whether the vendor can produce its own policies and records on request, not only a signed contract.

A business associate agreement allocates duties between the parties, such as who reports an incident, who returns or destroys data and what the vendor must do for subcontractors. It does not remove the vendor's own obligations under the Security Rule, and it cannot waive them. Covered entities sometimes assume a signed agreement transfers risk, and vendors sometimes assume it limits their exposure to the customer alone. Both readings are worth checking with counsel. Whether a specific contract term, or a particular vendor's controls, meets the rule is a legal and factual question, so this section describes the framework only. Organizations unsure of their status should start with the HHS guidance on business associates and get advice from qualified counsel.

Covered entity, business associate or outside HIPAA: which role fits

This table compares the four roles an organization can hold under the Security Rule, who typically holds each one, what each must do, and what the other party will ask to see. Read it as a starting point for scoping, then confirm your role with counsel, since the classification is a legal determination.

Role	Who typically holds it	What it must do under the Security Rule	Evidence the other party will ask for
Covered entity	Health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with a HIPAA standard transaction	Comply with all standards and implementation specifications for ePHI, including risk analysis, risk management, written policies and six-year documentation	Risk analysis, written policies, named security official, training records, business associate agreements, and evidence of periodic evaluation
Business associate	Vendors that create, receive, maintain or transmit PHI for a covered entity, such as billing, claims, data transmission, and health information organizations	Comply with the same standards and specifications as covered entities under 45 CFR 164.302, and carry direct liability to OCR for Security Rule failures	Signed business associate agreement, risk analysis, security policies, incident reporting procedures, and subcontractor agreements
Vendor offering a personal health record on a covered entity's behalf	Companies that provide personal health records to individuals on behalf of a covered entity	Treated as a business associate, so must meet the Security Rule for the ePHI it handles for that covered entity	Business associate agreement, safeguard documentation, and proof that the vendor handles ePHI for the covered entity
Subcontractor of a business associate	Companies that handle PHI for a business associate, such as hosting, support or data processing providers	Comply with the Security Rule as a business associate in its own right, with a downstream agreement flowing down the same obligations	Subcontractor agreement with flow-down terms, security documentation, and evidence of safeguards for the PHI it touches
Entity outside the HIPAA Rules	Organizations that are neither covered entities nor business associates, such as some app developers or data aggregators that do not act for a covered entity	No Security Rule obligation under HIPAA, though other laws, contracts or the Federal Trade Commission may still apply	Written determination of status, contract terms showing no PHI handling for a covered entity, and any other applicable obligations

Who owns Security Rule compliance when a vendor handles your ePHI

A covered entity remains responsible for its own Security Rule compliance even when a vendor hosts or processes its ePHI. The entity owns its risk analysis, its named security official, its workforce training and its access decisions, and it cannot hand those duties to a vendor by contract. What it can do is require a business associate agreement that sets out what the vendor must safeguard, how incidents are reported and how subcontractors are bound.

Owned controls: risk analysis, risk management, workforce access, training, sanctions and the security official role stay with the covered entity.
Contract terms it should require: a business associate agreement covering permitted uses, safeguards, incident reporting, subcontractor flow-down and return or destruction of ePHI at termination.
Vendor evidence to request: the vendor's current risk analysis summary, its policies for the Security Rule standards it implements, and its incident response and contingency test records.
Evidence it must keep itself: its own risk analysis, a record of its vendor review and the business associate agreements it has signed, retained for six years.
Implementation partner role: a partner can help the entity prepare its own policies, risk analysis and vendor review files, but the entity still signs, owns and defends them.

Before relying on any vendor, confirm which safeguards the vendor is responsible for and which remain with your own staff and configuration.

Mistakes that leave an organization out of scope or exposed

Most HIPAA scoping mistakes come from a wrong answer to two questions: is this organization a covered entity or business associate, and does this workflow touch electronic PHI. The cards below cover the errors that repeatedly leave organizations either wrongly exempt or unprepared when a customer or OCR asks.

Assuming SaaS sits outside HIPAA

Many teams reason that because their company is not a provider or payer, HIPAA does not apply. Status depends on what the organization does with PHI for a covered entity, not on its industry label. A scheduling tool, analytics platform or billing portal that creates, receives, maintains or transmits PHI for a covered entity is generally a business associate. Check whether any customer sends you patient-identifiable data, including logs, support tickets and backups.

Treating subcontractors as someone else's problem

A business associate that hands PHI to a hosting provider, transcription firm or support contractor remains responsible for that chain. Subcontractors that handle PHI for a business associate are business associates themselves under the definition in 45 CFR 160.103. Map every downstream vendor that touches ePHI and confirm each one has agreed in writing to the same restrictions you accepted upstream.

Believing a vendor certificate shifts liability

A third-party seal or certificate does not make a vendor compliant and does not transfer responsibility for Security Rule failures. HHS does not endorse or recognize private certifications, and a certificate does not stop OCR from later finding a violation. Ask for evidence of the vendor's own risk analysis and safeguards, then confirm your business associate agreement names who is accountable for each.

Assuming paper-only workflows escape duties

The Security Rule covers only electronic PHI, so a clinic that keeps charts entirely on paper has fewer Security Rule duties than one that does not. The moment those records are scanned, faxed from a copier with storage, emailed or synced to a tablet, they become ePHI. Inventory where information is converted or transmitted electronically, because that is where Security Rule obligations begin.

Failing to update status after changes

Scope shifts when services change: a new electronic transaction, a new customer type, an acquired subsidiary or an added analytics feature can turn a non-covered business into a business associate. Status set years ago often goes unrevisited. Re-run the scope check whenever a contract, product line or data flow changes, and record the date and reasoning so the determination can be shown later.

How to confirm your status before you sign a contract

This sequence lets you establish, in writing, whether your organization is a covered entity, a business associate or neither, and which Security Rule duties follow from that role before a contract creates them. Each step produces a record you can show a customer, counsel or an auditor.

Inventory every system that touches PHI
Start by listing every application, database, device, cloud account, backup, email tool and outside service that creates, receives, maintains or transmits protected health information. Include systems run by subcontractors and tools staff use informally, such as spreadsheets shared by email. Engineering, operations, sales engineering and the business owner of each system should contribute, because the people who run a system often know where its data goes. The output is a system inventory with an owner and a data type for each entry. You know the step is complete when every entry has a named owner and nothing is marked unknown.
Map data flows to each customer and partner
For each inventoried system, trace where PHI comes from, where it goes and which organization it is handled for. A single platform can act for different customers in different roles, so record the role separately for each customer, partner or contract. Note the protocols and storage locations involved, such as an interface engine, a messaging gateway or a backup vault. The output is a data flow map that links each PHI flow to a named covered entity or upstream business associate. Confirm the map with the people who sign and operate the integrations, since the diagram often misses a connection that only one team knows about.
Test each role against the regulatory definitions
Using the flow map, determine for each customer relationship whether your organization is a covered entity, a business associate, a subcontractor of a business associate, or outside both definitions. Health plans, clearinghouses and providers qualify as covered entities only in specific circumstances, so check whether the provider transmits health information electronically in connection with a HIPAA standard transaction. Business associates are defined by the function they perform for a covered entity, not by the sector they operate in. Use the CMS decision tool that HHS points to, and the definitions in 45 CFR 160.103. The output is a role memo for each relationship that states the role and the reasoning behind it.
Separate electronic PHI from paper and spoken PHI
Check which flows involve electronic media. The Security Rule governs electronic protected health information only, so paper charts, faxed pages that are printed and discussions that are never recorded fall outside it, although the Privacy Rule may still apply. Note any data that moves between electronic and paper formats, such as scanned documents, printed reports or exports to a portable drive, because those conversions bring the data into scope. The output is an annotation on the flow map that marks each flow as electronic, paper, spoken or mixed. Ask counsel to review any mixed flows before you rely on the classification.
Document the determination with counsel
Bring the flow map, the role memos and the electronic annotations to your privacy counsel or compliance lead for review. Counsel should confirm the role for each relationship, identify any contract terms that change the answer, and decide whether a business associate agreement is required or already in place. Record the final determination in a signed memo that names the reviewer, the date and the customers or partners it covers. Remember that a determination is an internal compliance position, not a certification, and that only the Office for Civil Rights can make a binding finding. The output is a determination memo, filed with the contract file, that a customer's security or legal team can read.
Set review triggers for changes
Establish a log and a named owner that re-open the determination whenever the facts change. Typical triggers include a new customer, a new integration that moves PHI, a new subcontractor, a change in billing or transaction practice, a new storage location and any amendment to a contract or business associate agreement. Assign each trigger to the team that will notice it first, such as procurement, engineering or the account team. The output is a review log with dated entries and the outcome of each review. Check the log at a set internal interval so that a missed trigger surfaces before a customer or regulator finds it.

Common questions about HIPAA Security Rule applicability

Does a vendor that never sees PHI still have to comply with the HIPAA Security Rule?

Usually not, but the test is what the vendor does, not what it claims. The Security Rule applies to covered entities and to business associates, and a business associate is defined by creating, receiving, maintaining or transmitting PHI for a covered entity, or by providing certain services that involve PHI disclosure. A vendor with no access to PHI, including no hosting, support access or log retention that contains PHI, generally falls outside that definition. Confirm this in writing with the customer and counsel, because a support ticket, a file upload or a backup copy can change the answer. The data flow map is the first input to that conversation.

Does a small clinic have to comply with the HIPAA Security Rule?

A small clinic must comply if it is a health care provider that transmits health information electronically in connection with a HIPAA standard transaction, such as electronic claims. Size does not exempt a provider, but the rule lets an entity consider its own size, complexity and capabilities when choosing measures. HHS lists doctors, dentists, chiropractors and pharmacies among covered providers, and a provider that only handles paper and never transmits electronically in connection with a standard transaction may fall outside the rule. HHS points to a CMS decision tool for covered entity status, and the clinic's billing practices should be checked against it before it concludes either way.

Is a subcontractor of a business associate directly liable under HIPAA?

Yes. Under the HITECH Act, business associates are directly liable to the HHS Office for Civil Rights for Security Rule failures, and the definition of business associate in 45 CFR 160.103 includes subcontractors that handle PHI for a business associate. The business associate must obtain satisfactory assurances from its subcontractors, so the chain of contracts matters as much as the technology. A hosting company, a managed IT provider or a transcription service used by a vendor can each be in scope, even when the covered entity has no contract with them.

Is PHI on paper covered by the HIPAA Security Rule?

No. The Security Rule protects only electronic protected health information, meaning PHI maintained in or transmitted by electronic media. HHS notes that unlike the Privacy and Breach Notification Rules, the Security Rule does not apply to PHI on paper or spoken. Paper records remain subject to the Privacy Rule, so a practice that scans paper charts into an electronic system brings those images into Security Rule scope from the point of scanning. Confirm which records exist in which format, because hybrid environments are where applicability most often gets missed.

Does a HIPAA certificate prove that an organization is covered or compliant?

No. HHS states that no Security Rule standard requires certification, that HHS does not endorse or recognize private organizations' certifications, and that such certifications do not prevent HHS from later finding a violation. A certificate may describe a vendor's controls at a point in time, but it does not establish whether the vendor is a covered entity or business associate. Ask for the scope, the assessor's identity, the test period and the evidence behind the statement, and read those against your own data flows.

How much effort does confirming HIPAA status take, and what drives it?

The effort depends on how many systems touch health information, how many data flows cross organizational boundaries and how well those flows are documented. An organization with one electronic health record and a single billing vendor can usually answer the question in a short review with counsel. An organization with many integrations, subcontracted hosting, analytics feeds and patient-facing apps needs a system inventory, a data flow map and contract review for each link. Cost is mostly staff time from compliance, IT and legal, plus any outside counsel or consultant time. Ask any provider to scope the work in writing before it starts.

What must an organization provide to an implementation partner for a status review?

Provide the information the partner needs to map where ePHI lives and how it moves. That usually includes a list of systems, hosting locations and cloud accounts, interface and integration specifications, data retention settings, the business associate agreements and subcontractor lists already in place, and the names of the people who own each system. Include existing risk analysis documents and policies, even if they are out of date, because they show what the organization already believes about its scope. A partner can document and organize this material, but the organization must confirm that it is accurate.

Can an implementation partner decide HIPAA applicability for my organization?

No. Your organization owns the determination, and the decision should be made with your legal counsel. A partner can prepare system inventories, data flow documentation and technical evidence that counsel and your compliance team use to reach a conclusion. Where an independent assessor reviews your controls, only that assessor issues a report, and no firm can certify HIPAA compliance on HHS's behalf. Ask any partner to state in its written scope exactly which decisions remain with you, counsel or an assessor.

How DeployOpen maps PHI flows and prepares evidence for your role

Before anyone can say whether the Security Rule applies, the organization needs to know which systems create, receive, maintain or transmit electronic PHI and on whose behalf. DeployOpen plans and implements self-hosted open-source platforms inside your own infrastructure, so we work from those data flows and prepare the systems and evidence that support your role, whether covered entity or business associate.

How we scope

We agree a written scope before work starts, naming the systems, data flows and sites that handle electronic PHI for your role.
The scope lists which covered entity relationships, subcontractor hand-offs and business associate functions we are mapping, so gaps are visible early.
Ongoing support for the mapped environment can be arranged as a retainer after the fixed-scope work is complete.

How we build

We map where ePHI is created, received, stored, transmitted and disposed of across the platforms we deploy in your environment.
We configure access, logging, encryption and backup for those platforms, then record which configuration decisions answer each safeguard.
We test the deployed systems, including application, API and infrastructure security testing, and log findings against the mapped data flows.

How we hand over

You receive documentation of the data flow map, system configuration and the evidence each safeguard relies on, organized for your compliance file.
Documentation states which decisions your organization must still make, approve or sign, such as the business associate agreement and the addressable specification choices.
We do not issue audit reports, attestations or certifications. Your independent assessor or auditor uses the handed-over evidence to reach its own conclusions.

How we support

Support covers upgrades, backups, patching and documentation updates for the platforms we deployed, as set out in the written agreement.
Continuous security testing can be added as a retainer so that data flow maps stay current when systems or vendors change.
Ask us to confirm in writing which parts of the mapping and evidence work remain with your security official and legal team.

Who must comply with the HIPAA Security Rule: covered entities and business associates