HIPAA Compliance Checklist for Healthcare Software in 2025

All electronic Protected Health Information must be encrypted at rest and in transit. Use AES-256 for data at rest and TLS 1.2 or higher for data in transit. This is now a hard requirement, not a recommendation.

Every user, including third-party vendors and administrators, must authenticate via MFA before accessing any system containing ePHI. Single-password access is no longer compliant.

Conduct and formally document a risk analysis identifying all threats and vulnerabilities to ePHI. Assess the likelihood and potential impact of each. This must be done at least annually and after any significant system change.

Implement unique user IDs, role-based permissions, and automatic session timeouts for inactivity. No user should have access beyond what their role requires. Audit access logs quarterly.

Zero Trust is now explicitly required for covered entities. No user or device is trusted by default — every access request is verified, regardless of whether it originates inside or outside the network perimeter.

Every third-party vendor who touches ePHI must have a signed, current BAA. The 2025 updates require BAAs to be reviewed and updated to reflect new mandatory requirements. Out-of-date agreements are no longer compliant.

Previously 60 days, the window to notify HHS of breaches affecting 500+ individuals is now 30 days (and some provisions reference 72 hours for post-contingency activation). Update your incident response procedures accordingly.

Mandatory semi-annual vulnerability scans of all systems handling ePHI, with remediation tracked and documented. Penetration testing is required annually.

All access to ePHI must be logged. Logs must capture who accessed what, when, and from where. These records must be retained for future audits and must be tamper-evident.

Patients now have a right to digital copies of their records within 15 days (reduced from 30). Your software must support secure export, authenticated patient portals, and FHIR-compliant data sharing with authorised third-party apps.

All employees who handle or could access PHI must complete annual HIPAA training. Records of completion must be maintained. Training must explicitly cover phishing, ransomware, and device security.

Appoint a named individual responsible for implementing and monitoring HIPAA compliance. For smaller organisations, this can be a part-time role but must be formally designated and documented.