---
title: "Healthcare Software: Is Your Outsourcing Company HIPAA Compliant?"
description: delaPlex Software outlines the requirements for developing HiPAA compliant software development projects, and the impact on outsourcing.
image: https://blog.delaplex.com/hs-fs/file-3562808755-jpg/blog-files/hipaa.jpg
---
[ ](https://delaplex.com)
- About
- [How We Work](https://delaplex.com/how-we-work/)
- [IP Security](https://delaplex.com/about/#IPsec)
- [Leadership](https://delaplex.com/about/#team)
- [Partners](https://delaplex.com/about/#partners)
- [Careers](https://delaplex.com/careers/)
- Info Center
- [Case Studies](https://delaplex.com/info-center/#case_studies)
- [Client Testimonials](https://delaplex.com/info-center/#client_testimonials)
- [White Papers](https://delaplex.com/info-center/#white_papers)
- [Brochures](https://delaplex.com/info-center/#brochures)
- [Blog](https://blog.delaplex.com/)
- [News & Events](https://blog.delaplex.com/news)
- Development Services
- [Solutions](https://delaplex.com/development-services-solutions/)
- [Technology](https://delaplex.com/development-services-technology/)
- [Industries](https://delaplex.com/development-services-industries/)
- [Case Studies](https://delaplex.com/info-center/)
- [Capabilities](https://delaplex.com/development-services-capabilities/)
- [Software Development](https://delaplex.com/capabilities-software-development/)
- [Code Rescue](https://delaplex.com/capabilities-code-rescue/)
- [Dedicated Team](https://delaplex.com/capabilities-development-team/)
- [DevOps](https://delaplex.com/capabilities-devops/)
- [Quality Assurance](https://delaplex.com/capabilities-quality-assurance/)
- [Technology Consulting](https://delaplex.com/capabilities-technology-consulting/)
- Supply Chain
- [Consulting](https://delaplex.com/supply-chain-consulting/)
- [Integrations](https://delaplex.com/supply-chain-integrations/)
- [Implementation & Hosting](https://delaplex.com/supply-chain-implementations/)
- [TaaS (Testing as a Service)](https://delaplex.com/supply-chain-solutions-taas-testing-as-a-service/)
- [Custom Development](https://delaplex.com/supply-chain-solutions-custom-development/)
- [Centers of Excellence](https://delaplex.com/supply-chain-coe/)
- [Workforce Management CoE](https://delaplex.com/workforce-management-coe/)
- [Store Operations Management CoE](https://delaplex.com/store-ops-management-coe/)
- [Warehouse Management CoE](https://delaplex.com/warehouse-management-coe/)
- Cloud Services
- [Consulting](https://delaplex.com/cloud-consulting/)
- [Engineering](https://delaplex.com/cloud-engineering/)
- [Migration](https://delaplex.com/cloud-migration/)
- [Optimization](https://delaplex.com/cloud-optimization/)
- [Managed Cloud Services](https://delaplex.com/managed-cloud-services/)
- [Case Studies](https://delaplex.com/info-center/#case_studies)
- Data Science Services
- [DSaaS](https://delaplex.com/data-science-as-a-service/)
- [Predictive Analytics](https://delaplex.com/predictive-analytics/)
- [Data Engineering](https://delaplex.com/data-engineering/)
- [Data Monetization](https://delaplex.com/data-monetization/)
- [Data Modernization](https://delaplex.com/data-modernization/)
- [Business Intelligence](https://delaplex.com/business-intelligence/)
- [AI/ML](https://delaplex.com/ai-ml-services/)
- [DataOps](https://delaplex.com/dataops/)
- [Contact Us](http://delaplex.com/contact/)
#### Superior. Transparent. Exceptional.
We build relationships with our clients worldwide that transcend mere business. It’s the only way to understand their needs and be truly effective as a team.
[About delaplex](https://delaplex.com/about/)
- [How We Work](https://delaplex.com/how-we-work/)
- [Leadership](https://delaplex.com/about/#team)
- [Careers](https://delaplex.com/careers/)
- [IP Security](https://delaplex.com/about/#IPsec)
- [Partners](https://delaplex.com/about/#partners)
#### Browse. Learn. Engage.
Want to see whether we really walk our talk? Check out how we apply our Agile Business Framework to yield extraordinary results for our clients.
[Information Center](https://delaplex.com/info-center/)
- [Case Studies](https://delaplex.com/info-center/#case_studies)
- [White Papers](https://delaplex.com/info-center/#white_papers)
- [Blog](https://blog.delaplex.com/)
- [Client Testimonials](https://delaplex.com/info-center/#client_testimonials)
- [Brochures](https://delaplex.com/info-center/#brochures)
- [News & Events](https://blog.delaplex.com/news)
#### Customer-centric. Strategic. Forward-thinking.
Bring your strategy and vision to fruition.Prepare your technology software for tomorrow today by outsourcing services with delaPlex.
[Development Services](https://delaplex.com/development-services/)
- [Solutions](https://delaplex.com/development-services-solutions/)
- [Industries](https://delaplex.com/development-services-industries/)
- [Capabilities](https://delaplex.com/development-services-capabilities/)
- [Software Development](https://delaplex.com/capabilities-software-development/)
- [Code Rescue](https://delaplex.com/capabilities-code-rescue/)
- [Dedicated Team](https://delaplex.com/capabilities-development-team/)
- [DevOps](https://delaplex.com/capabilities-devops/)
- [Quality Assurance](https://delaplex.com/capabilities-quality-assurance/)
- [Technology Consulting](https://delaplex.com/capabilities-technology-consulting/)
- [Technology](https://delaplex.com/development-services-technology/)
- [Case Studies](https://delaplex.com/info-center)
#### Integrate. Automate. Empower.
delaPlex offers consulting, integration, customization, upgrades, hosting, migration, and development of supply chain software aimed at transforming your supply chain solution to meet your needs.
[Supply Chain](https://delaplex.com/supply-chain-services/)
[Centers of Excellence](https://delaplex.com/supply-chain-coe/)
- [Consulting](https://delaplex.com/supply-chain-consulting/)
- [Integrations](https://delaplex.com/supply-chain-integrations/)
- [Implementation & Hosting](https://delaplex.com/supply-chain-implementations/)
- [TaaS (Testing as a Service)](https://delaplex.com/supply-chain-solutions-taas-testing-as-a-service/)
- [Custom Development](https://delaplex.com/supply-chain-solutions-custom-development/)
- [Workforce Management CoE](https://delaplex.com/workforce-management-coe/)
- [Store Operations Management CoE](https://delaplex.com/store-ops-management-coe/)
- [Warehouse Management CoE](https://delaplex.com/warehouse-management-coe/)
#### Robust. Innovative. Comprehensive.
delaPlex Cloud Services deliver multiple benefits for businesses – including reduced IT overhead, flexibility, scalability, and better disaster recovery.
Cloud Services
- [Consulting](https://delaplex.com/cloud-consulting/)
- [Engineering](https://delaplex.com/cloud-engineering/)
- [Managed Cloud Services](https://delaplex.com/managed-cloud-services/)
- [Migration](https://delaplex.com/cloud-migration/)
- [Optimization](https://delaplex.com/cloud-optimization/)
- [Case Studies](https://delaplex.com/info-center/#case_studies)
#### Custom. Predictive. Insightful.
delaPlex offers a complete suite of data science services to help you unleash process improvements, anticipate customer sentiments and forecast market changes faster.
[Data Science Services](https://delaplex.com/data-science-services/)
- [DSaaS](https://delaplex.com/data-science-as-a-service/)
- [Predictive Analytics](https://delaplex.com/predictive-analytics/)
- [Data Monetization](https://delaplex.com/data-monetization/)
- [AI/ML](https://delaplex.com/ai-ml-services/)
- [Data Engineering](https://delaplex.com/data-engineering/)
- [Business Intelligence](https://delaplex.com/business-intelligence/)
- [Data Modernization](https://delaplex.com/data-modernization/)
- [DataOps](https://delaplex.com/dataops/)
# Healthcare Software: Is Your Outsourcing Company HIPAA Compliant?
Written by [delaPlex](https://blog.delaplex.com/author/delaplex)
June 09,2015
- [Tweet](https://twitter.com/share)
The Healthcare Information Portability and Accountability Act (HIPAA) was enacted to help protect workers and their dependents who lost their insurance coverage due to a change in employment as well as to safeguard the confidentiality of patient's health information. The law requires any entity that prints, stores, reviews or otherwise has access to personally identifiable health information to take certain steps to keep the data secure.
HIPAA was enacted in 1996, before smartphones, tablets, wearable devices and cloud computing. Advances in technology have increased the difficulty of complying with the regulations. With the passage of the Health Information Technology for Economic and Clinical Health Act, commonly known as HITECH, the stakes have been raised. HITECH is intended to encourage the use of electronic health records by penalizing healthcare providers who do not make "meaningful use" of digitized records and rewarding those that do with the opportunity to receive incentive payments from the federal government.
The deadline for HITECH is 2015, which has left many providers scrambling to outsource software development. Since HITECH does not supersede HIPAA, all software developed to comply with HITECH must still comply with HIPAA.
However, it is important to remember that not every software project connected to health requires HIPAA compliance. The regulations apply to the use, storage, collection or dissemination of protected health information by an entity other than the individual. Thus, if you are developing a mobile app that allows an athlete to record his pulse rate or workout duration for his personal analysis, for example, HIPAA regulations do not apply. If, however, this same app has the ability to transmit the data to the team's physician, it must be HIPAA compliant, even if the option to transmit is never used.
Assuming that you have determined that the project requires HIPAA compliance, you must bear the responsibility for ensuring your operation is HIPAA compliant. HIPAA compliance requires safeguards that are classified as administrative, technical or physical. When developing a project that must be HIPAA compliant, you should ensure that your company meets the minimum standards in all three categories.
### Administrative Duties
- Appoint a privacy officer
- Conduct an annual risk assessment
- Create or administer a program to train employees about HIPAA compliance
- If needed, execute a business associate agreement with any partner or subcontractor involved in the project
- Periodically review procedures and policies, updating as needed
### Technical Duties
- The software must require a unique user ID or number that can identify and track activity.
- An authentication procedure must be included to verify that the user or entity accessing the program is the person or entity claimed.
- An emergency access procedure is mandatory for obtaining information during an emergency.
- The program should include an automatic log-off after a set period of inactivity.
- There must be a mechanism for encrypting and decrypting data.
- Security measures and integrity controls must be in place to ensure that data cannot be modified without detection for as long as the data exists.
- Audit controls are required to record activity and permit review.
There should be an electronic mechanism to authenticate protected health information to make sure that it has not be subjected to unauthorized deletions or alterations.
### Physical Safeguards
- A disaster recovery and contingency operations plan is required.
- There must be policies and procedures in place to protect the facility and information stored there from unauthorized physical access, theft or tampering.
- Access to data used for development or testing must be restricted to only those with a need for access, and this need should be validated.
- Modifications or repairs to the facility that could affect its physical security (such as locks, doors or hardware) must be documented.
- Policies and procedures must be implemented for the disposal of electronic media as well as the devices on which such media has been stored.
- Records of the movement of hardware (such as servers) and media (such as flash drives) must be maintained that include the person responsible for the movement.
- If equipment must be moved, a complete and retrievable copy of the data must be made prior to the move.
- Workstations must be secured so that only authorized users can access them.
- Policies and procedures are required that define which functions can be performed on a workstation, how those functions must be performed and the physical attributes of an individual workstation or category of workstations.
In addition to the basics of HIPAA compliance, there are certain indicators that clients may look for to feel secure with an outsourced developer.
- Security: Access to the area where protected data is stored should require two-factor authentication, such as swiping a badge and entering a code.
- Video surveillance: Video logs should be maintained for a minimum of three months.
- Visitors' log: Visitors should be required to sign in. There should be a direct match between the video logs and the visitors' log as far back as the last audit that confirmed the match.
- Documented procedures: Policies and procedures should be documented and consistent. If so, employees should be able to give consistent answers to questions about specific policies or procedures.
There is no concept of safe harbor in HIPAA. It does not matter whether you accidentally transmit data to an unauthorized recipient, allow an unauthorized employee to access protected health information or fail to maintain proper system security against hackers. You can face hefty fines of up to $50,000 for each record or violation, and in some cases, you could even face criminal charges. It is therefore essential that you ensure that your company (as well as any associates or subcontractors you use) are fully compliant with HIPAA.
At delaPlex Software, we take security very seriously. We are [ISO-9001:2008 certified](http://www.iso.org/iso/publication_item.htm?pid=PUB200013), so our clients have the assurance of working with a provider who utilizes the most stringent security policies.
Our development facilities employ the services of a qualified third-party for continuous audit to ensure [HIPAA compliance](http://www.hhs.gov/ocr/privacy/). Staff members receive extensive training to make sure that the facility, equipment and all of our clients' data receive the protection that confidential information requires.
### Subscribe to Email Updates
### Posts by Topic
- [Software Development (50)](https://blog.delaplex.com/topic/software-development)
- [Learning Center (42)](https://blog.delaplex.com/topic/news)
- [Outsourcing Tips (30)](https://blog.delaplex.com/topic/outsourcing-tips)
- [My Business (28)](https://blog.delaplex.com/topic/my-business)
- [New Technology (25)](https://blog.delaplex.com/topic/new-technology)
- [Digital Transformation (5)](https://blog.delaplex.com/topic/digital-transformation)
- [Big Data (3)](https://blog.delaplex.com/topic/big-data)
- [Compliance Issues (3)](https://blog.delaplex.com/topic/compliance-issues)
- [Custom Software Development (3)](https://blog.delaplex.com/topic/custom-software-development)
- [ETL (3)](https://blog.delaplex.com/topic/etl)
- [Startup (3)](https://blog.delaplex.com/topic/startup)
- [AI (2)](https://blog.delaplex.com/topic/ai)
- [Broadcast (2)](https://blog.delaplex.com/topic/broadcast)
- [Supply Chain (2)](https://blog.delaplex.com/topic/supply-chain)
- [AWS (1)](https://blog.delaplex.com/topic/aws)
- [Blue Yonder ICON (1)](https://blog.delaplex.com/topic/blue-yonder-icon)
- [Burn Rate (1)](https://blog.delaplex.com/topic/burn-rate)
- [Cloud Migration (1)](https://blog.delaplex.com/topic/cloud-migration)
- [Cloud Services (1)](https://blog.delaplex.com/topic/cloud-services)
- [Data (1)](https://blog.delaplex.com/topic/data)
- [HealthTech (1)](https://blog.delaplex.com/topic/healthtech)
- [Healthcare (1)](https://blog.delaplex.com/topic/healthcare)
- [In-House Engineers (1)](https://blog.delaplex.com/topic/in-house-engineers)
- [Remote Work (1)](https://blog.delaplex.com/topic/remote-work)
- [Team Based Outsourcing (1)](https://blog.delaplex.com/topic/team-based-outsourcing)
- [Technical Debt (1)](https://blog.delaplex.com/topic/technical-debt)
- [Testing (1)](https://blog.delaplex.com/topic/testing)
- [Testing-as-a-Service (1)](https://blog.delaplex.com/topic/testing-as-a-service)
- [War for Talent (1)](https://blog.delaplex.com/topic/war-for-talent)
- [mobile app (1)](https://blog.delaplex.com/topic/mobile-app)
- [mobile development (1)](https://blog.delaplex.com/topic/mobile-development)
see all
[](https://delaplex.com)
##### Company
- [About delaPlex](https://delaplex.com/about/)
- [How We Work](https://delaplex.com/how-we-work/)
- [Careers](https://delaplex.com/careers/)
- [Leadership](https://delaplex.com/about/#team)
- [Testimonials](https://delaplex.com/info-center/#client_testimonials)
- [Partners](https://delaplex.com/about/#partners)
- [IP Security](https://delaplex.com/about/#IPsec)
##### Development
- [Services](https://delaplex.com/development-services)
- [Solutions](https://delaplex.com/development-services-solutions/)
- [Capabilities](https://delaplex.com/development-services-capabilities/)
- [Technology](https://delaplex.com/development-services-technology/)
- [Industries](https://delaplex.com/development-services-industries/)
- [Case Studies](https://delaplex.com/info-center/#case_studies)
##### Supply Chain
- [Services](https://delaplex.com/supply-chain-services/)
- [Consulting](https://delaplex.com/supply-chain-consulting/)
- [Integration](https://delaplex.com/supply-chain-integrations/)
- [TaaS](https://delaplex.com/supply-chain-solutions-taas-testing-as-a-service/)
- [Custom Development](https://delaplex.com/supply-chain-solutions-custom-development/)
- [Centers of Excellence](https://delaplex.com/supply-chain-coe/)
##### Cloud Services
- [Services](https://delaplex.com/cloud-services/)
- [Consulting](https://delaplex.com/cloud-consulting/)
- [Migration](https://delaplex.com/cloud-migration/)
- [Engineering](https://delaplex.com/cloud-engineering/)
- [Optimization](https://delaplex.com/cloud-optimization/)
##### Data Science
- [Services](https://delaplex.com/data-science-services/)
- [DSaaS](https://delaplex.com/data-science-as-a-service/)
- [Analytics](https://delaplex.com/predictive-analytics/)
- [Business Intelligence](https://delaplex.com/business-intelligence/)
- [Modernization](https://delaplex.com/data-modernization/)
- [AI/ML](https://delaplex.com/ai-ml-services/)
Stay Informed
---
[+1 (404) 876-3334](tel:+14048763334)
[2970 Clairmont Rd, Suite 630, Atlanta, GA 30329](https://www.google.com/maps/place/2970+Clairmont+Rd,+Atlanta,+GA+30329/@33.8440868,-84.3184256,17z/data=!3m1!4b1!4m5!3m4!1s0x88f5062a75459c23:0xf558d9885e7d1e9c!8m2!3d33.8440868!4d-84.3162369)
[sales@delaplex.com](mailto:sales@delaplex.com)
© 2024 delaPlex, Inc. All rights reserved.
[tel:14048763334](tel:14048763334)