Healthcare is one of the most regulated industries, because patient data is both sensitive and valuable to attackers. In the US, that data is protected by HIPAA; in Europe, by GDPR. This article explains what HIPAA means for software teams, the hidden costs of getting it wrong, how HIPAA compares with ISO/IEC 27001 and GDPR, and the safeguards to build in from the start.
What is HIPAA?
HIPAA, the Health Insurance Portability and Accountability Act, was passed in 1996 to modernize the flow of healthcare information, protect personal health data and address health insurance issues. Today it is enforced by the U.S. Department of Health & Human Services' Office for Civil Rights (OCR). State Attorneys General can also act against organizations that fail to comply, and both can impose financial penalties.
HIPAA applies to Covered Entities, such as providers and insurers, and to their Business Associates, including software vendors that handle patient data.
What data does HIPAA protect?
HIPAA protects Protected Health Information (PHI, or ePHI in electronic form): any health data that can identify a person. Examples include:
- Names and geographic details
- Social security and health insurance beneficiary numbers
- Medical record numbers
- Email addresses and IP addresses
- Vehicle license plates
- Photographs and fingerprints
HIPAA does not prescribe specific tools. Each organization assesses its own risks and chooses appropriate safeguards.
The hidden costs of weak HIPAA compliance
Fines are the visible risk. The hidden costs often hurt more:
- Breach response. Investigation, notifying patients and regulators, and fixing the gap take months of work.
- Rework. Adding audit logs, access control or encryption to a finished product costs far more than designing them in.
- Lost deals. Hospitals and labs won't sign with a vendor that can't show how it protects PHI.
- Blocked features. Telehealth, wearables and AI tools stall if the data underneath isn't handled correctly.
- Reputation. Patients and partners remember a breach long after it is fixed.
HIPAA, ISO/IEC 27001 and GDPR compared
- HIPAA: US law; protects health data (PHI); applies to providers, insurers and their vendors; enforced by OCR and state authorities; no official certification.
- ISO/IEC 27001: international standard; covers information security management across the whole organization; voluntary; audited by accredited bodies; results in a certificate.
- GDPR: EU law; protects all personal data of people in the EU; applies to any organization processing that data; enforced by national data protection authorities; no single certificate.
The three overlap but don't replace each other. An ISO/IEC 27001 certificate shows a mature security process; it does not by itself make a product HIPAA compliant.
HIPAA safeguards in practice
The HIPAA Security Rule requires three types of safeguards.
Physical safeguards. Restricted access to buildings and data centers, visitor sign-in, camera monitoring and secure equipment. In cloud environments, much of this is covered by the provider under a Business Associate Agreement.
Administrative safeguards. Security policies, risk assessments, staff training, password and access management, and an incident response plan.
Technical safeguards. Role-based access to PHI, encryption in transit and at rest, audit logs, separation of public and private environments, intrusion prevention and anti-malware protection.
In practice, this affects every healthcare product: telehealth video, lab and clinic management systems, and data from medical devices and wearables all count as PHI.
From our work: VARTEQ is ISO/IEC 27001 certified. On US healthcare projects, our teams work to client-defined HIPAA requirements, including team members who completed the required HIPAA training. We agree security requirements with each client at the start and use them to guide access controls, testing and releases. Examples include the GeneDx genetic testing platform and LIMSys, a lab system with user-level access controls and audit trails.
Frequently asked questions
Is there a HIPAA certification for software?
No. Compliance is shown through safeguards, policies and agreements, not an official certificate.
Does ISO/IEC 27001 cover HIPAA?
It overlaps, but it does not replace HIPAA's specific requirements for health data.
Who is responsible for HIPAA compliance, the vendor or the client?
Both. Responsibilities are set out in a Business Associate Agreement.
Final thoughts
HIPAA is flexible on purpose: it expects organizations to keep up with technology and choose safeguards that fit their risks. The cheapest time to meet it is at the start of a project. VARTEQ builds software for healthcare with security requirements agreed up front. Read also: Meeting the Data Security Challenge in Healthcare. Contact us to discuss your project.
