HIPAA Security Rule update

    For radiology and teleradiology

    HIPAA compliance for radiology, imaging systems included.

    Live Compliance runs the HIPAA program for radiology and teleradiology groups: the risk analysis that covers imaging systems, the policies and staff training, vendor BAAs, and the security monitoring an audit examines, with a named compliance team on every plan.

    ~10 minutes · No credit card · No call required

    Radiology groups are on the client wall. Premier Radiology’s CTO calls the platform “much more than a portal.” Read the client stories.

    The Live Compliance security operations screen: findings by severity and every monitored workstation with its last scan time, the X-ray machine among them.

    Every workstation watched, the X-ray machine included

    Where it goes wrong

    Where radiology programs actually fail.

    Radiology runs on systems that hold images and reports full of ePHI, and on contracts with the hospitals and practices that send the studies. The failures auditors and buyers find live in four places.

    01

    The risk analysis skips the imaging systems

    The Security Rule requires an accurate and thorough risk analysis across the systems that create, receive, maintain, or transmit ePHI. Imaging workstations and the systems that store studies hold exactly that, and a risk analysis that covers the billing system but not the reading room does not meet the standard.

    45 CFR 164.308(a)(1)(ii)(A)

    In the programThe risk analysis runs in the platform and covers every system you name. On Professional and Enterprise, the security agent watches the workstations themselves, with findings logged by machine and severity.

    02

    Studies and reports move between entities

    Teleradiology is transmission: studies come in, reports go out, and the Security Rule requires technical security measures to guard against unauthorized access to ePHI being transmitted over a network. The transmission policies, and the evidence they are followed, are part of the record an auditor reads.

    45 CFR 164.312(e)(1)

    In the programTransmission security policies with tracked acknowledgments, organization-wide encrypted email on Professional and up, and the monitoring evidence beside them in one record.

    03

    Every reading contract is a business associate chain

    A group reading for a hospital is a business associate; the group’s own vendors are subcontractors in the same chain. Written satisfactory assurances are required before PHI moves, and hospital procurement teams ask for proof of the program before they sign.

    45 CFR 164.502(e)

    In the programVendor and BAA tracking on every plan, and the buyer-facing proof: the Seal of Compliance, a public Trust Center page, and the Statement of Satisfactory Assurance for the questionnaire.

    04

    Imaging hardware moves, retires, and disappears

    Device and media controls are written into the Security Rule: policies for the receipt and movement of hardware and media that hold ePHI, required disposal and media re-use procedures, and an addressable accountability record of who has what.

    45 CFR 164.310(d)

    In the programAsset Manager keeps the register: who has each device, encryption status, and the signed record when equipment is issued, recovered, or destroyed. Included with Professional and Enterprise.

    Accuracy and legal note. Plain-language summary of the HIPAA Security and Privacy Rules (45 CFR 164.308, 164.310, 164.312, 164.502), accurate as of November 2026. Regulations change. This is general educational information, not legal advice. Verify current requirements at hhs.gov/hipaa or with your compliance counsel.

    Straight answers

    Radiology and Live Compliance, in plain words.

    Live Compliance is the HIPAA compliance program for radiology and teleradiology groups: documentation, training, the security layer, and a named team, at a published price.

    It works beside the PACS vendor, the MSP, and the IT relationship you already have. It does not replace them; it runs the program an auditor and a hospital questionnaire examine.

    • Since 2010
    • 500+ organizations
    • 19 modules
    • Named team on every plan
    • 100% audit success rate

    Yes. A teleradiology group reading for hospitals is a business associate, directly subject to HIPAA, and the hospitals it reads for will ask for proof before and during the contract. Live Compliance runs the business associate program: the risk analysis, policies, training, vendor agreements, and the security operations a buyer's questionnaire asks about, with the Seal of Compliance, a public Trust Center page, and the Statement of Satisfactory Assurance to answer those questionnaires.

    Yes. The Security Rule requires an accurate and thorough risk analysis across systems that create, receive, maintain, or transmit ePHI, and imaging systems hold ePHI. Live Compliance runs the risk analysis in the platform, and on Professional and Enterprise the security agent watches the workstations themselves, with findings logged by machine and severity.

    From the program record. Every Live Compliance plan includes the Seal of Compliance for your website, a public Trust Center page that reads from your live program record, and the printed Statement of Satisfactory Assurance, four pages cited to the CFR, available on request for procurement, insurers, and auditors.

    Every price is published: $399, $895, or $1,450 a month plus $8.33 per employee per month, billed annually, with no add-on fees. Example: a 20-employee group runs $1,061.60 a month on Professional. That includes the platform, the monitoring, and a named compliance team.

    See the platform, on real screensEvery price on the page

    See where your program stands before an auditor does.

    Get your free 10-minute audit-readiness score. Then, if you want it, the guarantee: audit-ready in 60 days, or we keep working at no additional cost until you are.

    Or talk to a Specialist

    ~10 minutes · No credit card · No call required

    500+
    healthcare organizations
    100%
    audit success rate
    2010
    protecting healthcare since