7 Ways HIPAA Compliance Strengthens Healthcare Security

HIPAA compliance strengthens healthcare security because the Security Rule forces organizations to do the basics well: analyze risk, limit access, log activity, train staff, protect data in transit and at rest, manage vendors and respond to breaches on a deadline. Treated as an operating discipline rather than paperwork, those requirements close the gaps attackers usually exploit.

Key takeaways

  • The HIPAA Security Rule requires administrative, physical and technical safeguards for electronic protected health information (ePHI).
  • A documented, recurring risk analysis is the foundation of every other control.
  • "Addressable" specifications are not optional; alternatives must be documented.
  • Encryption can relieve an organization of breach notification duties when PHI is properly secured.
  • HHS published a proposed rule to strengthen the Security Rule on January 6, 2025; watch for its final status.

What does the HIPAA Security Rule actually require?

The Security Rule applies to covered entities (health plans, clearinghouses and most providers) and their business associates. According to HHS, it groups protections into three categories: administrative safeguards such as risk management, workforce security and training; physical safeguards such as facility access and device controls; and technical safeguards such as access control, audit controls, integrity, authentication and transmission security.

HHS stresses that "addressable" specifications are not optional. If one is not reasonable for an organization, it must adopt an equivalent alternative and document why. For broader context on how privacy and records interact, see our guide to EHRs, patient privacy and HIPAA compliance.

Seven ways compliance improves security

1. Risk analysis finds weaknesses before attackers do

HHS requires an accurate and thorough assessment of risks to the confidentiality, integrity and availability of ePHI, followed by measures that reduce those risks to a reasonable level. Done yearly and after major changes, it surfaces unpatched systems, forgotten devices and risky workflows.

2. Access control limits the blast radius

Unique user IDs, role-based permissions and automatic logoff mean a stolen password exposes less data. Reviewing access when people change roles or leave is where many organizations slip.

3. Audit controls create evidence

Logging who viewed or changed records lets security teams detect snooping and investigate incidents. Logs only help if someone reviews them on a schedule.

4. Workforce training reduces human error

Phishing and misdirected data are common incident causes. Required training, refreshed regularly and tested with exercises, turns staff into a detection layer.

5. Encryption protects data at rest and in transit

Under the Breach Notification Rule, PHI secured through encryption or destruction is treated as unusable to unauthorized people, which can relieve an organization of notification duties for that incident. That makes encryption one of the highest-value controls.

6. Business associate agreements extend security to vendors

Cloud hosts, billing companies and IT providers that handle PHI must sign agreements and protect data. Vendor risk reviews catch weak links outside your walls. Our guide on achieving data security in the cloud covers practical controls to ask vendors about.

7. Breach rules force a tested response plan

HHS requires notice to affected individuals without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people must also be reported to HHS within 60 days, and breaches affecting more than 500 residents of a state require media notice. Those deadlines push organizations to rehearse incident response.

Safeguard areaExample controlsCommon gap
AdministrativeRisk analysis, training, contingency plansRisk analysis not updated after system changes
PhysicalFacility access, workstation and device controlsUnencrypted laptops and removable media
TechnicalAccess control, audit logs, authentication, transmission securityLogs collected but never reviewed
VendorsBusiness associate agreements, vendor reviewsMissing agreements with smaller vendors

Where does compliance fall short of real security?

Compliance is a floor. Organizations that write policies but never test them, or that run a risk analysis once and file it, meet the letter of the rule on paper while staying exposed. Real security comes from treating HIPAA requirements as recurring operations: quarterly access reviews, patching, tabletop exercises and vendor check-ins. Combining HIPAA with workplace safety planning, as described in the path to becoming HIPAA and OSHA compliant, helps smaller practices build one compliance calendar instead of two.

The rule itself may also change. HHS published a proposed rule titled "HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information" on January 6, 2025. Check the HHS Security Rule page for whether it has been finalized before planning budgets.

Frequently Asked Questions

Does HIPAA compliance guarantee that we will not be breached?

No. HIPAA sets minimum safeguards and requires you to manage risk to a reasonable and appropriate level, but no framework prevents every attack. Compliance reduces the likelihood and impact of incidents and ensures you can respond properly. Organizations that test controls, review logs and update risk analyses regularly get much more security value than those that only maintain documents.

How often should we perform a HIPAA risk analysis?

HHS requires regular review and reassessment rather than a single fixed interval. Many organizations perform a full risk analysis at least annually and update it whenever they adopt new systems, change vendors, move to the cloud or experience an incident. HHS and ONC offer a free Security Risk Assessment Tool aimed at small and medium-sized practices.

Is encryption required under HIPAA?

Encryption is an addressable specification, so it is not automatically mandatory, but you must implement it or document an equivalent alternative and explain why. In practice, encryption is strongly favored because PHI secured by encryption meeting HHS guidance is treated as unusable to unauthorized people, which can remove breach notification duties if encrypted data is lost.

Next steps

  • Confirm your last risk analysis date and schedule the next one.
  • Inventory devices holding ePHI and verify encryption on each.
  • List every vendor touching PHI and confirm a signed business associate agreement.
  • Run a tabletop exercise against the 60-day breach notification timeline.

Last reviewed: October 2026.

Sources

Comments

Post a Comment

Popular Posts

Why Workday Onboarding Breaks Down for Frontline Employees

Image
The Onboarding Gap Nobody Talks About Workday's onboarding module is well-designed for its intended audience: office-based, desk workers with reliable computer access, personal email addresses, and the digital literacy to navigate a web-based portal. For this population, Workday onboarding works well, it automates tasks, routes approvals, collects documents, and creates a reasonably smooth first-week experience. But most organizations using Workday have a substantial population of frontline workers: warehouse employees, retail staff, manufacturing workers, healthcare aides, food service workers, drivers. For this population, the standard Workday onboarding experience frequently fails in ways that are predictable, documented, and, crucially, fixable. Understanding why it breaks down and what actually works is increasingly urgent as labor market competition for frontline talent intensifies. How Standard Workday Onboarding Is Designed Workday's new hire onboarding (delivered throu...
Read more

How to Improve the Customer Experience (CX)

Customer experience is the sum of every interaction a customer has with your company, from the first ad they see to the way a return gets handled years after the purchase. Companies that take this seriously outperform those that treat CX as a support function. The ones that struggle tend to confuse customer satisfaction scores with actual improvements, or fix the wrong things. Here's a practical look at what actually moves CX forward. Start with where customers actually struggle Most CX improvement programs begin with surveys. Surveys are useful but limited, they capture what customers are willing to articulate after the fact, which tends to under-report friction in the middle of an experience and over-index on the most recent interaction. The richer data comes from observing behavior directly: where do customers drop off in a purchase flow? Where do support tickets spike? What search queries are people entering on your site that suggest they can't find what they're loo...
Read more

How Do I Log In and Sign In to Workday HCM

Workday HCM is the system your organization uses to manage everything from your pay stubs and benefits to time off requests and performance reviews. Getting in is usually simple once you know where to go, but first-time login, password resets, and single sign-on setups can trip people up if no one has walked them through it. Here's what you need to know. How to find your Workday login URL Workday doesn't have one universal login page. Each organization has its own tenant, a dedicated instance with a unique URL. Your company's HR department or IT team should have provided the URL when you were onboarded. It usually looks something like your-company.workday.com or wd3.myworkday.com/yourcompany . If you weren't given the URL, check your onboarding email, your company's intranet, or ask HR directly. Some organizations also link to Workday from their internal HR portal. Don't try to guess the URL, there's no central directory, and guessing wrong just takes...
Read more

UKG Union Contract and Overtime Rules for Multi-Site Food Plants

Multi-site food manufacturers running UKG often struggle with one thing: each plant has its own union contract, shift pattern and overtime rules, while the timekeeping system is configured centrally. The fix: document every contract rule precisely, map it to UKG pay rules and work rules, test against real timecards, and handle true exceptions with add-ons rather than core customization. Disclosure: The author works at CloudApper, which makes the UKG add-ons discussed in this article. Why are union contracts so hard to configure in UKG? Federal law sets a floor. Under the Fair Labor Standards Act, non-exempt employees must receive at least one and a half times their regular rate for hours worked over 40 in a workweek. Collective bargaining agreements frequently go further, and food plants often have several agreements across locations. Common contract provisions include: Daily overtime after 8 hours, or after 10 on a four-day schedule. Double time on the seventh consecutive day o...
Read more

Infor HCM Software Engineer Jobs: Salary Factors and Skills

An Infor HCM software engineer's salary depends mostly on the type of employer, the depth of Infor platform knowledge, and location. Engineers who combine general software skills with hands-on experience in Infor CloudSuite HCM, Lawson, Infor ION integrations and payroll logic tend to command more than generalist developers, because that combination is scarce in the job market. What does an Infor HCM software engineer actually do? The title covers several different jobs, and pay follows the job more than the title. Broadly, these engineers build, configure, integrate and support the Infor human capital management stack, which includes core HR, payroll, benefits, talent management and workforce management. Many organizations still run the older on-premises Infor Lawson system alongside or instead of the cloud suite, so experience with both is common. Typical responsibilities include: Building and maintaining integrations between Infor HCM and payroll providers, benefits carrie...
Read more

How to Search in Workday: Find Reqs, Reports, People and Tasks

To search in Workday, type into the global search bar at the top of any page, press Enter, then use the category filters on the left of the results to narrow to people, organizations, tasks and reports or other object types. Workday only returns items your security roles allow you to see, so missing results often mean an access issue rather than a typo. How does Workday search work? Workday uses a single global search box rather than separate menus for each module. Everything in the tenant, from a worker's profile to a job requisition to a custom report, is an object that search can find if you have permission to view it. Three points explain most search behavior: Security trimming. Results are filtered by your security groups. A recruiter and a payroll partner typing the same term will see different results. Categories. After you press Enter, results are grouped into categories that appear as filters. Clicking one hides everything else. Related actions. Once you open an...
Read more

ERP Solution Guide: How to Choose the Best ERP for You

What Is an ERP System and Why Does It Matter? An enterprise resource planning (ERP) system is software that integrates the core functions of a business — finance, inventory, procurement, human resources, manufacturing, and customer management — into a single, connected platform. Instead of data living in separate spreadsheets or standalone applications that don't talk to each other, an ERP creates one source of truth for the entire organization. For growing companies, the question is usually not whether they need an ERP but when and which one. Getting this decision right has long-term consequences. A poorly chosen ERP creates more problems than it solves — forcing teams to work around the system, creating data integrity issues, and consuming IT resources in an endless cycle of customization and maintenance. A well-chosen ERP, on the other hand, becomes the operational backbone that lets a company scale without proportionally growing its administrative overhead. Understandin...
Read more

The End of Remote Work: Why Companies Want You Back

Return to Office: The Trend Reshaping the Modern Workplace After years of celebrating the remote work revolution, a powerful counter-movement has taken hold. Amazon, JPMorgan Chase, Goldman Sachs, Disney, and hundreds of other organizations have issued return-to-office (RTO) mandates, some requiring full five-day-a-week presence. The era of near-universal remote work flexibility appears to be giving way to something more complicated, and HR leaders are at the center of navigating it. Why Companies Are Calling Employees Back Collaboration and Innovation: Many executives argue that the serendipitous interactions, the hallway conversation, the spontaneous whiteboard session, that drive breakthrough ideas simply cannot be replicated on Zoom. Studies from Stanford and MIT suggest that in-person collaboration produces measurably higher rates of novel idea generation. Culture and Cohesion: Building and sustaining organizational culture at a distance has proven harder than anticipated. N...
Read more

The Future of Employee Healthcare Key Concerns and Strategies for 2024

In a rapidly evolving professional landscape, employers are grappling with an array of challenges as they plan employee-sponsored healthcare strategies for 2024. A recent survey conducted in the US in August 2023 sheds light on the primary concerns and emerging trends in the realm of employee healthcare. Mental health, healthcare costs, pharmacy expenditures, and transformative technologies are at the forefront of employer considerations, signaling a need for comprehensive and innovative approaches to employee well-being. Rising Mental Health Concerns A staggering seven in 10 employers reported a surge in mental health concerns, marking a significant uptick from the previous year. With 77% of employers experiencing an increase and an additional 16% anticipating future challenges, the mental health landscape is a top priority. The implications of the ongoing pandemic, remote work dynamics, and societal shifts are evident as employers grapple with addressing and supporting the mental ...
Read more

How Digital Marketing Helps Your Business Grow: A Practical Plan

Digital marketing helps a business grow by putting it in front of buyers at the moment they search, compare and decide, then measuring which efforts produce revenue. Search, content, email, paid ads and social channels let even small teams reach targeted audiences, test messages cheaply and shift budget toward what works, something print and broadcast advertising rarely allow. How does digital marketing actually drive business growth? Growth comes from three levers: reaching more of the right people, converting more of them into customers and keeping those customers longer. Digital channels touch all three. Reach. Search engines, professional networks and industry newsletters connect you with people already looking for what you sell. Conversion. Clear landing pages, case examples and easy contact options turn interest into conversations. Retention. Email, customer education content and community channels keep existing customers engaged and open to expansion. The underlying ...
Read more