HIPAA compliance software helps hospitals and other healthcare organisations in the United States follow HIPAA, the US law that protects patients' health records. HIPAA stands for the Health Insurance Portability and Accountability Act, passed in 1996. The software is sold mainly in the US, and some of its sellers have engineering teams in India.
HIPAA's Security Rule requires every hospital, clinic and health insurer to carry out a security risk analysis. This is a written review of where patient records are kept, what could happen to them and how each risk is controlled. The rule applies to the hospital's suppliers too. A supplier that handles patient records, such as a billing company, is called a business associate. It must sign an agreement with the hospital and follow the same rule. If patient records leak, the US Department of Health and Human Services can fine the hospital, and a large breach must be reported publicly.
A hospital is hard to analyse. It has thousands of devices, from infusion pumps to MRI machines, and hundreds of software systems and suppliers. General GRC software does not know these. HIPAA compliance software comes with lists of hospital systems, their usual weaknesses and the controls that HIPAA expects.
Take, for example, a 400-bed hospital in Ohio. The software lists 310 systems that hold patient records, including the electronic health record, the lab system and an old fax server. For each one, it asks who can reach the records and how they are protected. It rates the old fax server as high risk, because it stores faxed referrals without encryption. The hospital decides to move these faxes to a secure cloud fax service, and the software records the decision and its deadline. It then checks the hospital's 150 suppliers. A billing company that has not signed a business associate agreement is flagged at once. This is third-party risk management, done with healthcare's own rules. Suppliers matter, because attacks often reach hospitals through them, in a supply chain attack.
Some hospitals also work towards HITRUST certification. HITRUST is a security framework and certificate built for US healthcare, and hospitals often ask their suppliers to hold it.
Some sellers also offer a managed security service, in which their analysts watch the hospital's security alerts. This is managed detection and response (MDR). The records being protected usually sit in a healthcare data platform.
India has no HIPAA. Today, Indian hospitals protect patient data under the Information Technology Act's rules for sensitive personal data, which include medical records. Hospitals that join the Ayushman Bharat Digital Mission (ABDM) also follow its rules. From 13 May 2027, the main duties of the Digital Personal Data Protection (DPDP) Act apply instead of those Information Technology Act rules.