What Are the HIPAA Compliance Requirements for IT Providers?

By Michael Jann, EVP, Vertical Industry Solutions, Abacus · Published October 29, 2026 · Updated October 29, 2026

Short answer: An IT provider that handles protected health information (PHI), including electronic protected health information (ePHI), is a HIPAA business associate and must comply directly with the HIPAA Security Rule. That means signing a business associate agreement, performing a documented risk analysis, and implementing administrative, physical, and technical safeguards under 45 CFR 164.308, 164.310, and 164.312. Business associates face direct enforcement by the HHS Office for Civil Rights, with penalties reaching $2,190,294 per violation category per year.

HIPAA does not certify vendors. No federal agency issues a “HIPAA compliant” stamp, which is why the phrase appears on so many marketing pages with nothing behind it. What HIPAA does is impose a specific, auditable set of obligations on any IT provider that touches patient data – and give a healthcare organization the right to verify them.

Which HIPAA rules apply to an IT provider?

HIPAA is the Health Insurance Portability and Accountability Act of 1996, and its implementing regulations sit at 45 CFR Parts 160 and 164. Four rules matter to an IT provider: the Privacy Rule, the Security Rule, the Breach Notification Rule, and the Enforcement Rule. The Security Rule carries most of the technical obligations.

The Privacy Rule governs how protected health information may be used and disclosed. It applies to an IT provider indirectly, through the terms of the business associate agreement, and directly where the provider carries out a covered entity’s privacy obligations.

The Security Rule governs electronic protected health information specifically, and it applies to business associates directly. Since the 2013 HIPAA Omnibus Rule, an IT provider can be investigated and penalized by the Office for Civil Rights on its own, without the covered entity being at fault.

The Breach Notification Rule at 45 CFR 164.410 requires a business associate to notify the covered entity of a breach without unreasonable delay and no later than 60 days after discovery. The covered entity then notifies patients and HHS.

The Enforcement Rule establishes how HIPAA is enforced, including OCR’s authority to investigate complaints and potential violations, conduct compliance reviews, and impose civil money penalties in appropriate cases. For IT providers, this is important because being a business associate does not mean the covered entity is the only party at risk when something goes wrong. A business associate can have direct HIPAA obligations and can be held directly accountable for certain violations.

What are the HIPAA Security Rule requirements for managed IT?

The HIPAA Security Rule requires three categories of safeguards: administrative safeguards at 45 CFR 164.308, physical safeguards at 45 CFR 164.310, and technical safeguards at 45 CFR 164.312. Each category contains standards, and most standards contain implementation specifications that are either required or addressable. Addressable does not mean optional – it means the decision and its reasoning must be documented.

A managed IT provider typically owns or shares most of the technical safeguards and a meaningful share of the administrative ones. The covered entity keeps the safeguards that depend on its own workforce and facilities.

What is a HIPAA risk analysis, and how often is it required?

A HIPAA risk analysis is a documented assessment of the risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information across an organization. It is required under 45 CFR 164.308(a)(1)(ii)(A) and applies to covered entities and business associates alike.

A compliant risk analysis covers the full scope of electronic protected health information, wherever it lives. That includes systems nobody remembers, such as an old imaging server, a fax gateway, or a departmental database bought outside of IT. A scan of the network is not a risk analysis; the analysis has to identify threats, assess likelihood and impact, and record the decisions made.

Risk analysis is also the single most common finding in federal enforcement. The Office for Civil Rights has run a dedicated Risk Analysis Initiative, and the absence of a current, complete risk analysis is what turns an incident into an enforcement action.

For healthcare organizations, an annual risk analysis can provide a practical cadence for reviewing the organization’s technology and security environment. It should not, however, be treated as a once-a-year checkbox. The assessment should be updated any time the organization’s environment changes. Migrating to a new EHR or cloud application, implementing a new AI tool, introducing new connected medical devices, or bringing on a new location, vendor, or other system that creates, receives, maintains, or transmits ePHI can change the organization’s risk profile.

For Community Health Centers (CHCs) and Federally Qualified Health Centers (FQHCs), the same HIPAA risk-analysis requirement applies. HIPAA itself does not establish an annual deadline for completing the analysis. However, health centers also operate within the requirements of the HRSA Health Center Program and other federal requirements associated with their funding and programs, including Medicare and Medicaid requirements, the 340B Drug Pricing Program, the National Health Service Corps (NHSC) Program, and the Federal Tort Claims Act (FTCA) Medical Malpractice Program, etc. Maintaining compliance with applicable federal requirements is part of remaining in good standing with the Health Center Program and can factor into HRSA’s oversight and funding processes. Health centers should also consider any additional requirements that apply to their specific HRSA award, contracts, state requirements, or other funding and oversight programs.

How do you verify that an IT vendor is HIPAA compliant?

Ask for evidence, not assertions. Because no federal agency certifies HIPAA compliance, the only verifiable artifacts are a signed business associate agreement, a current risk analysis, independent audit reports such as a SOC 2 Type II, and written documentation of the specific safeguards the provider operates on your behalf.

Five requests separate a provider that can demonstrate compliance from one that cannot:

• A business associate agreement that names breach notification timelines in days, not “without unreasonable delay.”
• A SOC 2 Type II report, which tests whether controls operated effectively over a review period rather than existing on paper at one moment.
• HITRUST certification or an equivalent framework mapping, showing how the provider’s controls map to HIPAA requirements.
• The provider’s own risk analysis and remediation plan, which shows whether the provider applies to itself what it recommends to clients.
• Evidence of incident response testing, such as a tabletop exercise report from the past 12 months.

The 2026 HITRUST Trust Report, published in April 2026, found that 99.62% of HITRUST-certified environments reported no security breach during 2025, while more than 40% of organizations in the broader market did. These figures should not be read as proof that HITRUST certification prevents breaches. What certification does provide is independent validation that an organization has been evaluated against defined security and compliance requirements. That gives healthcare organizations something more concrete to evaluate than a vendor’s own statement that its security program is “strong” or “compliant.”

What are the penalties for HIPAA violations?

HIPAA civil monetary penalties are tiered by culpability, and HHS adjusts the amounts annually for inflation. Under the HHS tiers effective January 28, 2026, penalties run from $145 per violation for a violation the organization did not know about, up to $2,190,294 per violation category per year for willful neglect that is not corrected within 30 days.

Civil penalties are not the whole exposure. HIPAA also carries criminal penalties of up to 10 years in prison for obtaining protected health information for personal gain or with malicious intent, and state attorneys general can bring their own actions under HITECH.

The costs that fall outside enforcement are usually larger. The IBM Cost of a Data Breach Report 2026 put the average healthcare breach at $6.64 million, the highest of any industry for the thirteenth consecutive year.

What is changing in the HIPAA Security Rule?

HHS published a proposed overhaul of the HIPAA Security Rule in January 2025. The proposal would remove the distinction between required and addressable implementation specifications, mandate multi-factor authentication and expanded encryption, require technology asset inventories and network maps, and strengthen business associate oversight.

After more than 4,000 public comments, HHS moved the rulemaking to its long-term agenda in the Fall 2026 Unified Agenda, listing July 2027 as the anticipated date for final action. That date is a planning estimate, not a binding deadline.

The current HIPAA Security Rule remains fully enforceable during the delay. Organizations that want to reduce future rework can adopt the proposed direction now – asset inventory, multi-factor authentication everywhere, annual vendor attestations, and documented encryption standards – because each of those is defensible under the rule as it stands today.

What do healthcare organizations get wrong about HIPAA and IT?

The most common error is treating HIPAA compliance as a product a vendor supplies rather than a program the organization runs. An IT provider can operate most of the technical safeguards, but the covered entity keeps the risk analysis, workforce training, policies, and patient-facing obligations.

Four mistakes appear repeatedly in HIPAA compliance reviews at healthcare organizations:

Believing a vendor can be “HIPAA certified.” No federal certification exists. A vendor can hold SOC 2 Type II or HITRUST certification, which are independent attestations, but neither is issued by HHS.

Treating the risk analysis as a scan. A vulnerability scan reports technical findings. A risk analysis assesses threats, likelihood, and impact across all systems holding electronic protected health information, and records decisions.

Assuming encryption resolves the obligation. Encryption is an addressable specification that creates a breach notification safe harbor when implemented to HHS standards. It does not satisfy access control, audit controls, or contingency planning.

Leaving legacy systems out of scope. Imaging servers, fax gateways, and departmental applications bought outside IT hold protected health information and appear in enforcement actions with regularity.

The Verizon 2026 Data Breach Investigations Report found that 54% of healthcare breaches involved the human element, which is a reminder that training and access discipline carry as much weight as technical controls.

About Abacus

Abacus is a managed IT and cybersecurity provider serving financial services firms and healthcare organizations globally since 2004, with 24×7 monitoring and help desk coverage. With in-house incident response specialists, a cyber R&D team, and a deep bench of GRC experts, Abacus supports more than 1,200 clients and 100,000 users globally, holding SOC 2 Type II attestation and CREST accreditation, with infrastructure and processes designed to support HIPAA and HITRUST compliance requirements.

Next step

Schedule a Security Risk Assessment with Abacus. The session reviews your current risk analysis, your Security Rule safeguard coverage, and the gaps most likely to surface in an Office for Civil Rights review.