Guide to Healthcare Software Compliance

The compliance burden for healthcare IT companies has grown markedly over the past several decades. The cost of noncompliance is substantial. In the US alone, companies face significant costs and fees for failing to follow healthcare software compliance rules. 

This blog will cover the standards, regulations, and compliance rules healthcare software companies must watch out for, and their rules related to incident management. We’ll cover the following pieces of legislation pertinent to healthcare software compliance:

What Is HIPAA?

HIPAA logo

The Health Insurance Portability and Accountability Act (HIPAA) is a piece of legislation that exists to protect healthcare information and set standards for storing, sharing, managing, and recording protected health information (PHI).

The category of PHI covers the following: name, address, dates, telephone number, fax number, email address, social security number, medical record number, health plan beneficiary number, account number, certificate/license number, vehicle identifiers, device identifiers, web URLs, IP address, biometric identifiers, full-face photos, and any unique identifying numbers.

From its introduction, HIPAA required organizations to follow healthcare software compliance rules around security, privacy, breach notification, and enforcement, detailed below:

The HIPAA Security Rule outlines measures to protect PHI including:

  1. Technical safeguards, requiring healthcare organizations to encrypt electronic PHI once it travels beyond internal servers and implement the following requirements:
    • Access control
    • ePHI authentication
    • Encryption and decryption
    • Activity logs and audit controls
    • Automatic log-offs
  2. Physical safeguards, which secure physical access to PHI and lay out measures for securing mobile devices and workstations, comprising the following requirements:
    • Facility access controls
    • Guidelines for locating and using workstations
    • Procedures for the usage of mobile devices
    • Inventory and hardware policies
  3. Administrative safeguards, that lay out high-level measures for PHI protection with the following requirements:
    • Risk assessment
    • Risk management policy
    • Training employees on securely handling health data
    • Developing a contingency plan
    • Testing a contingency plan
    • Restricting third-party access to data
    • Reporting security incidents

Other Rules

  • The Privacy Rule outlines measures on how PHI can be used and disclosed. This requires healthcare organizations to:
    • Train employees to ensure they know what information may and may not be shared outside of an organization’s security mechanism
    • Implement appropriate measures to maintain PHI integrity
    • Ensure written permission is received from patients before their health information is used for marketing, fundraising, or research
  • The Breach Notification Rule requires that if the PHI is compromised, healthcare organizations must promptly notify the affected patients and the Department of Health and Human Services of the breaches and issue a notice to the media if a breach affects more than five hundred patients
  • The Omnibus Rule incorporates important stakeholders such as third-party services and business associates

What Is HITECH? 


The Health Information Technology for Economic and Clinical Health Act (HITECH) was signed in 2009. It aimed to achieve stricter enforcement of HIPAA and speed up the adoption and meaningful use of health information technology.

  • HITECH requires providers to notify patients of unauthorized access to their data and run security audits to investigate if they comply with HIPAA’s Privacy and Security rules
  • It requires the sharing of PHI via secure methods

 What Is GDPR?

GDPR logo

The General Data Protection Regulation (GDPR) controls all issued data in the EU, with health information falling within its scope. GDPR applies to organizations based in the EU, and those outside it if they target EU-based individuals or store any data from EU citizens.

GDPR influenced the creation of the California Consumer Privacy Act (CCPA) and there’s still much debate on if there will be a U.S. standard as a follow-up. Many states are in debate about forming their own, ultimately creating a further burden on compliance requirements. 

Some critical steps of GDPR compliance include:

  • Appointing a Data Protection Officer to oversee archival and real-time data flows
  • Evaluating data-related risks by conducting a data protection impact assessment
  • Designing and implementing a data security strategy
  • Properly notifying impacted parties of data breaches within 72 hours

What Is HL7?

HL7 FHIR logo

HL7 is an industry-standard that sets out best practices for exchanging medical data between disparate healthcare systems. It has had two subsequent versions, v2 and v3:

  • HL7 v2 suits distributed environments and centralized patient care systems where patient data resides in departmental subsystems
  • HL7 v3 takes a new approach to exchange clinical information that relies on messages written in XML syntax

What Is FHIR?

FHIR logo

The Fast Healthcare Interoperability Resources (FHIR) standard is an HL7-compliant standard that sets out acceptable data formats and APIs for electronic health records

  • Provide a set of HTTP-based RESTful APIs to allow healthcare providers to share data in JSON and XML formats
  • FHIR combines the best features of previous standards into a common specification while being flexible enough to meet the needs of a wide variety of use cases within the healthcare ecosystem

What Are Some Other Data Standards?

Data transfer and science concept
  • The ICD-10 is a disease classification coding system
  • XDS (cross-enterprise document sharing) is an interoperability profile that describes how healthcare enterprises should share medical information with peers
  • XDS-I is an extension to the XDS protocol created specifically for sharing medical images
  • EVV (electronic visit verification) is a requirement to verify home medical visits with healthcare compliance solutions

How Much Does a Compliance Program Cost?

Healthcare and innovative technology: apps for medical exams and online consultation concept

HHS has provided an estimate of how much HIPAA compliance may cost:
$80 for an updated Notice of Privacy Practices

  • $763 for breach notification requirement updates
  • $84 for business associate agreement updates
  • $113 for security rule compliance
  • Grand total per organization: $1,040

However, in practice, HIPAA compliance might actually cost considerably more:

  • Total cost: $4,000 – $12,000 for a small covered entity
  • Total cost: $50,000 or more for a medium/large covered entity

For GDPR, 74% of small- and mid-sized organizations spent more than $100,000. Notably, 20% spent more than $1 million. Only 6% of all organizations spent less than $50,000.

KMS Healthcare logo on blue background

Are you a software developer, technologist, or healthcare software compliance manager who needs help in ensuring your regulatory and compliance software initiatives are affordable and time-effective?

If so, the team at KMS prides itself on being partners of choice for healthcare software development and compliance teams looking to do just that. Speak with our dedicated team of experienced developers today.

Get The Latest In Healthcare Straight To Your Inbox

Other Posts You Might Be Interested in

Agile Software Development in Healthcare Featured Image
Agile software development in healthcare has emerged as a game-changer in today’s...
MVP concept. Digital illustration of a rocket launching off.
Have you ever had a brilliant idea that could save lives? A healthcare software idea...
Mastering EDI - A Complete Overview of Electronic Data Interchange
Electronic Data Interchange (EDI) marked a significant milestone in the healthcare...
Frame 7 (1)
Artificial intelligence (AI) is revolutionizing every industry, with OpenAI, the...
Doctor team with 3D block chain network technology research and diagnosis patient illness. Medical innovation technology and digital healthcare service develop patient treatment and people wellbeing
Let’s start by saying: you have a brilliant healthcare software idea that can improve...
Abstract background with molecule DNA. Medical, science and digital symbolizing healthcare interoperability
A mind-boggling statistic to those outside the healthcare industry is that, as recently...
Pan left view of digital connections among artificial satellites emerging on orbit of planet Earth in space
How to overcome challenges for the effective integration of agile with offshore teams The...
Close up of Doctor is showing medical analytics data, Medical technology concept
Data is pivotal, and the healthcare industry stands at the forefront of a revolution....
Outsourced product development concept
Software product development differs significantly from enterprise software development,...

Confidently Cast Your Healthcare Technology Strategies with KMS Healthcare Consulting

Work smarter toward greater results by partnering with the KMS Healthcare Technology Consulting team—start today.