HIPAA compliance software
HIPAA compliance software for small practices
HIPAA compliance software keeps the risk analysis, policies, BAAs, training records and evidence in one place, so a practice, dental office or business associate can show its program when OCR, an insurer or a hospital customer asks. Ours comes with a named engineer who writes the risk analysis with you and fixes what it finds.
Continuous compliance
Configuration checks on 62 monitored endpoints, last run 14 minutes ago
- Total Active Violations
- 36
- Total Passed Checks
- 2,910
- Monitored Endpoints
- 62
- HIPAA score
- 98.8%
Violations by Requirement
Select a requirement to see its failing controls
Violations by severity
The short version
What is HIPAA compliance software?
HIPAA compliance software, sometimes sold as HIPAA compliance management software, is the system of record for a HIPAA program. It holds the documents the rule asks for, tracks who has done what, and shows when something has lapsed: a business associate agreement past its renewal, a new hire who has not been trained, a laptop that stopped reporting encryption.
What it does not do is make you compliant. HHS does not certify software or practices, and a tool with every box ticked can still sit on top of a risk analysis nobody believes. The compliance tools worth paying for are the ones that keep the program true between reviews. If you want to see the work as a list first, start with our HIPAA compliance checklist.
HIPAA requirements
What HIPAA requires that software should track
The HIPAA Security Rule is written as outcomes, not features, so the software has to cover six recurring jobs. The risk analysis comes first; our post on the HIPAA risk analysis explains what OCR expects to see in one.
- The risk analysisA documented, accurate assessment of the risks to every system that holds ePHI, and what you are doing about each. It is the first thing OCR asks for after a breach, and the rule expects it kept current as your setup changes.
- The Security Rule safeguardsAdministrative, physical and technical: who has access, how devices are protected, how logins are checked, what is logged and who reviews it.
- Policies people were trained onWritten policies that match how the practice works, each acknowledged, plus a sanction policy. OCR tests you against your own words.
- Business associate agreementsA signed agreement with every vendor that creates, receives, stores or sends PHI for you. A small practice commonly has ten to twenty-five of them.
- Training recordsTraining for every workforce member within a reasonable time of joining and when things change, with a record per person.
- Breach responseAn incident plan, a breach log, and the notification clock: affected individuals within 60 days of discovery, and HHS and the media too when 500 or more are affected.
What to look for
Must-have features in HIPAA compliance software
Use this list when you compare HIPAA compliance software vendors. Products differ less in what they list on the pricing page than in which of these jobs they do for you, which they hand you a template for, and which they leave to you.
- Risk analysisEither a guided questionnaire you fill in, or an analysis a person writes with you. Ask which one you are buying; most products sell the first.
- Policy libraryTemplates are a start. Look for policies drafted from your answers and reviewed by someone who knows the rule, with acknowledgment tracked per person.
- BAA trackerEvery business associate with the signed agreement, the owner and the renewal date, and a reminder before one lapses.
- Training recordsCompletion tracked per person, so the record exists before anyone asks for it.
- Evidence that collects itselfConnections to your identity provider, email and devices that show MFA is on and laptops are encrypted, rather than screenshots you upload once a year.
- Device monitoringAn agent on each workstation that reports encryption, screen lock and patch status. Several healthcare-specific products do not describe one.
- Cross-mappingIf a hospital customer asks for SOC 2, the same controls and evidence should answer both, without a second program.
- Someone to fix what it findsSoftware that lists gaps leaves the fixing to you. Check whether remediation is included or a referral.
We compared nine products against this list, including Compliancy Group, Accountable, Abyde, Vanta and Drata, in the best HIPAA compliance software for small practices.
Software or a person
HIPAA compliance software vs a consultant
A consultant writes the risk analysis and the policies, then leaves. The documents describe the practice as it was that month, and nobody is watching when a vendor changes or a laptop goes missing. Software watches, but most of it expects someone at the practice to run it, answer the questionnaire and do the fixes.
Small practices tend to fall between the two: they buy a tool, fill in the self-assessment once, and find at renewal that the program has gone stale. The answer is usually both jobs from one place. We go through the trade-offs in HIPAA compliance software vs a consultant, and through when a one-off analysis is enough in a risk analysis vs a full program.
Two different searches
HIPAA compliance software vs HIPAA-compliant software
The two phrases sound alike and mean different things. HIPAA compliance software runs your HIPAA program. HIPAA-compliant software is any product that handles PHI in a way that lets a covered entity use it under the rule: an EHR, a patient portal, a cloud file store.
No product is HIPAA compliant on its own. What makes compliant software usable is a business associate agreement with the vendor, the safeguards the vendor runs on its side, and the settings you choose on yours. If you build software that holds PHI, you are a business associate yourself; our guide to HIPAA for business associates covers what applies to you directly.
A question we get every week
Is Microsoft 365 HIPAA compliant?
It can be. Microsoft offers a business associate agreement on its paid business editions, and so does Google Workspace. Both also say that using their services does not make you compliant on its own. You still have to accept the BAA, turn on MFA and audit logging, restrict sharing, keep PHI out of consumer accounts, and include the service in your risk analysis.
The settings are where practices go wrong, so we wrote them down: Microsoft 365 and HIPAA and Google Workspace and HIPAA. Source for the paragraph above: Microsoft Learn, HIPAA and the HITECH Act.
What it costs
What HIPAA compliance software costs a small practice
Healthcare-specific tools are usually sold as a monthly subscription, and a few publish prices. Multi-framework platforms are priced for companies that also need SOC 2. In both cases the software is the smaller part of the bill: the risk analysis, the fixes it finds and the time your staff spend are what move the total. Our HIPAA cost guide for small practices lists the published figures with their sources.
AccuSights is one fixed fee. It covers the risk analysis, the fix plan, the platform, the endpoint agent, policies, training tracking and your named engineer. Tell us about your environment and you have your number in writing within 24 hours of sending back the intake form. Managed 24/7 protection is a separate monthly plan; both are on our pricing page.
How we run it
How AccuSights runs HIPAA compliance for a practice
We are the service-led option. We have fewer integrations than the big platforms and a smaller name than the best-known healthcare tools. What you get instead is a person who does the work with you.
- A named engineer writes the risk analysis with youNot a questionnaire. Your engineer maps every system, device and vendor that holds PHI, and the endpoint agent finds the laptops nobody remembered.
- Policies drafted and reviewedThe AI Policy Builder drafts from your answers and our in-house CISOs review the result. Acknowledgments and training completion are tracked per person.
- A business associate inventoryThe agreement, the owner and the renewal date for each vendor, with reminders before they lapse.
- Monitoring of connected controlsConnected controls are watched around the clock, and your engineer gets the alert when one drifts, such as MFA switched off on an account.
- Remediation is in-houseWe roll out the fixes with you or your IT provider, and in major cities an engineer can come on site.
- Year two is a review, not a restartAn incident plan you have rehearsed, a breach log already set up, and an annual refresh of the risk analysis, policies and training.
HIPAA controls are cross-mapped to SOC 2, so a vendor that sells to hospitals answers both from one evidence set; see the HIPAA to SOC 2 mapping. For the full HIPAA picture, start at HIPAA requirements for small practices, or see the fixed-fee healthcare HIPAA package.
Questions about HIPAA compliance software
What is HIPAA compliance software?
What is the best HIPAA compliance software for a small practice?
Is there a HIPAA certification for software?
Do we need a BAA with our HIPAA compliance software vendor?
How long does it take to get set up?
Does HIPAA compliance software help with SOC 2?
Next step
A HIPAA program you can show, and a person who keeps it current.
Book thirty minutes with an engineer and leave with your scope and a fixed fee in writing. Or start with the free HIPAA risk assessment tool and see where your practice stands today.
The regulator has the final say. We help interpret, scope and get you ready; we do not certify.