{"head":{"title":"HIPAA Compliance Checklist for Software | OceanLab","description":"Every HIPAA Security Rule safeguard with its 45 CFR citation, Required or Addressable label and what it means in code. Track progress and export.","canonical":"https://oceanlab.in/tools/hipaa-checklist"},"tool":{"slug":"hipaa-checklist","path":"/tools/hipaa-checklist","name":"HIPAA checklist","h1":"HIPAA compliance checklist for software teams","lede":"Work through every Security Rule safeguard with its citation and what it means for your code, then export your progress.","category":"compliance","categoryTitle":"Compliance checklists","method":["The list follows 45 CFR Part 164 Subpart C, the HIPAA Security Rule, as published on eCFR on the checked date: administrative, physical and technical safeguards, plus policies and documentation.","Each item keeps its citation and its Required or Addressable label from the rule. The 'in code' line is OceanLab's plain-English reading for engineering teams.","Your ticks are saved in this browser only. Export them as Markdown or print the page."],"sources":[{"label":"45 CFR Part 164, Subpart C (Security Rule), eCFR","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C","checkedAt":"2026-10-23"},{"label":"45 CFR Part 164, Subpart D (Breach Notification), eCFR","url":"https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D","checkedAt":"2026-10-23"}],"faq":[{"question":"What does Addressable mean?","answer":"You must assess whether the safeguard is reasonable for you. If it is, implement it; if not, document why and use an equivalent measure. It does not mean optional."},{"question":"Which version of the rule is this?","answer":"The Security Rule text in force on eCFR on the checked date. Proposed changes are not included until they are final."},{"question":"Does a HIPAA-eligible cloud make my app compliant?","answer":"No. The provider covers its own infrastructure under a business associate agreement. Access control, audit logs and encryption in your app are still your job."},{"question":"Is this legal advice?","answer":"No. It is guidance for engineering teams. Your compliance officer or counsel decides what applies to you."}],"notice":{"title":"Guidance, not legal advice.","text":"This checklist helps engineering teams plan; your compliance officer or counsel decides what applies to you."},"updatedAt":"2026-10-25"},"related":[{"href":"/tools/soc-2-checklist","label":"SOC 2 checklist","detail":"Turn the SOC 2 criteria into engineering tasks, pick the categories in scope, and track what is still open."},{"href":"/tools/eu-ai-act-risk-checker","label":"EU AI Act risk checker","detail":"Answer a few questions about your AI system to see its likely risk tier, what you would have to do, and from when."},{"href":"/tools/software-rfp-template","label":"Software RFP template","detail":"Answer a short guided form and copy or download a requirements document you can send to any vendor."}],"studies":[{"meta":{"slug":"sutura","industry":"healthdata","projectType":"Patient data hub","country":"us","tags":["healthcare","enterprise"],"compliances":["HIPAA Privacy Rule","HIPAA Security Rule","42 CFR Part 2","21st Century Cures Act (information blocking)","HL7 v2","HL7 FHIR R4 and US Core","SMART on FHIR","HL7 DS4P security labels","TEFCA","CMS Conditions of Participation"],"cover":{"src":"/case-studies/sutura/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Sutura - HIPAA-Compliant Patient Data Hub over HL7 and FHIR","description":"Designed and built a clickable patient data hub for a US health system running Epic, Oracle Health, athenahealth and eClinicalWorks: a live monitor for every HL7 v2, FHIR and HIE feed, one matched enterprise patient with a provenance-tagged record, and a duplicates queue where a person decides every uncertain match.","category":"Health Data / Patient Data Hub","client":"Northfork Valley Health"}}},{"meta":{"slug":"headgate","industry":"healthdata","projectType":"Claims & EHR integration API","country":"us","tags":["healthcare","enterprise"],"compliances":["CMS-9115-F","CMS-0057-F","HIPAA Privacy and Security Rules","HIPAA X12 transactions","HL7 FHIR R4 and US Core","SMART App Launch","FHIR Bulk Data","Da Vinci CRD, DTR and PAS","CARIN Blue Button"],"cover":{"src":"/case-studies/headgate/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Headgate - FHIR Interoperability API Platform for Claims, Clinical Data and Prior Authorization","description":"Designed and built a clickable console for the FHIR APIs a US regional health plan must run under federal interoperability rules: API health across Patient Access, Provider Directory, Formulary, Provider Access, Payer-to-Payer and Prior Authorization, a security review queue for third-party apps, and one clock for every prior authorization request, however it arrived.","category":"Health Data / Interoperability","client":"Juniper Basin Health Plan"}}},{"meta":{"slug":"loupe","industry":"clinics","projectType":"Specialty EHR","country":"us","tags":["healthcare","enterprise","ai"],"compliances":["HIPAA","21st Century Cures Act","ONC certification (FHIR R4, US Core)","DEA EPCS","FTC Eyeglass Rule","FTC Contact Lens Rule","ICD-10-CM and CPT","CMS MIPS","DICOM"],"cover":{"src":"/case-studies/loupe/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Loupe - Ophthalmology EHR with Per-Eye Charting and Laterality-Aware Coding","description":"Designed and built a clickable ophthalmology EHR for a US eye care group with seven clinics: a clinician's day at a glance, a live patient flow board with dilation timers, patient search with break-the-glass access, a chart summary with right-eye and left-eye findings side by side, and a structured exam workspace per eye.","category":"Healthcare / Specialty EHR","client":"Cedar Hollow Eye Associates"}}},{"meta":{"slug":"waypost","industry":"telehealth","projectType":"Remote patient monitoring","country":"us","tags":["healthcare","iot","enterprise"],"compliances":["HIPAA","Medicare RPM billing (CPT 99453-99458)","FDA medical device rules","ACC/AHA BP guideline","HEDIS CBP","WCAG 2.1 AA","HHS Section 504"],"cover":{"src":"/case-studies/waypost/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Waypost - Remote Patient Monitoring Platform with Risk-Sorted Alerts","description":"Designed and built a clickable remote patient monitoring platform for a US cardiology and primary care group: home blood pressure, weight and SpO2 readings from cellular devices, a risk-sorted alert queue for nurses, triage with the practice's protocol on screen, and live progress toward each patient's Medicare RPM billing requirements.","category":"Healthcare / Remote Patient Monitoring","client":"Brightwater Ridge Medical Group"}}}],"more":[{"href":"/case-studies/industry/healthdata","label":"Health data & interoperability case studies","detail":"Every OceanLab product build in Health data & interoperability."},{"href":"/case-studies/industry/telehealth","label":"Telehealth & patient apps case studies","detail":"Every OceanLab product build in Telehealth & patient apps."},{"href":"/case-studies/industry/clinics","label":"Hospitals & clinics case studies","detail":"Every OceanLab product build in Hospitals & clinics."},{"href":"/case-studies","label":"All case studies","detail":"Every OceanLab product build."},{"href":"/ai-automation","label":"AI automation","detail":"AI built into real business workflows, with people in charge."}],"today":"2026-10-25"}