HIPAA Security Rule update

    HIPAA compliance software

    HIPAA Compliance Software That Gets You Audit-Ready

    HIPAA compliance software is what healthcare organizations use to run their HIPAA compliance program. It holds what the rule requires in one place: your risk analysis, policies, training, business associate agreements, and incident log, with dated evidence for each. The Health Insurance Portability and Accountability Act (HIPAA) does not require software, and no product makes you compliant on its own.

    Request a Call with a HIPAA Specialist

    The score takes about 10 minutes · No credit card

    Built for healthcare organizations and the business associates that serve them, from a single-location practice to a health system running a dozen addresses.

    The requirement map

    What the software has to cover, requirement by requirement

    Start from the rule rather than from a feature list. These are the obligations an investigator asks about, and what a platform has to hold for each one.

    HIPAA requirements mapped to what compliance software must hold for each one
    What HIPAA requiresCitationWhat the software has to hold
    Risk analysis45 CFR 164.308(a)(1)(ii)(A)An accurate and thorough assessment of the risks to the electronic protected health information your organization holds, covering every system and every location, with the date and the scope recorded.
    Policies and procedures45 CFR 164.316(a), 164.530(i)Written policies that match what your organization actually does, reviewed as things change, with prior versions kept rather than overwritten.
    Workforce training45 CFR 164.308(a)(5), 164.530(b)Training for every workforce member, new hires included, and the completion record that proves it happened on a date you can produce.
    Business associate agreements45 CFR 164.308(b), 164.502(e)A signed written assurance from every vendor that creates, receives, maintains, or transmits protected health information on your behalf, in place before the vendor touches the data.
    Incidents and breach response45 CFR 164.308(a)(6), 164.400 to 164.414A record of security incidents, what was done about each one, and the breach determination behind any decision not to notify.
    Access and audit controls45 CFR 164.312(a), 164.312(b)A unique identifier for every user, and records of system activity that can be examined later, which is how access gets reviewed rather than assumed.
    Documentation retention45 CFR 164.316(b)(2)(i), 164.530(j)Six years of the above, kept from the date of creation or the date it was last in effect, whichever is later. This is the part spreadsheets lose.

    Required is not the same as addressable. In the Security Rule, every standard must be met, and each implementation specification under a standard is labeled Required or Addressable. The risk analysis (164.308(a)(1)(ii)(A)), security incident response and reporting (164.308(a)(6)(ii)), unique user identification (164.312(a)(2)(i)) and six-year retention (164.316(b)(2)(i)) are Required. The four specifications under security awareness and training (164.308(a)(5)(ii)) are Addressable. Addressable does not mean optional. You assess whether the specification is reasonable and appropriate for your organization, then either implement it, or document why it is not and implement an equivalent alternative if that is reasonable and appropriate. 45 CFR 164.306(d). The Privacy Rule and the Breach Notification Rule do not use these labels. Software that treats an addressable specification as optional, or skips the written reasoning, leaves you without the record the rule expects.

    Holding a control and proving it are two jobs. A policy that exists but cannot be dated is hard to lean on when somebody asks when it took effect. The same goes for training that happened before a workforce member opened a record, and for a vendor agreement signed before any data moved. Questions about a program tend to run backwards from a date, so the useful test to put to any platform you are weighing up is not whether it stores the document. It is whether the platform records when that document took effect, and whether it keeps the earlier version once somebody edits it.

    Ask a vendor to show you three things on a live screen before you decide: a policy with its revision history, a completed training with the name and the date attached, and a signed agreement you can open from the vendor record it belongs to. Anything that cannot produce those on demand is a filing cabinet with a search box, and you will end up rebuilding the trail by hand at exactly the moment you have the least appetite for it.

    Jim Johnson, Founder of Live ComplianceReviewed by Jim Johnson, Founder · Live Compliance
    Last reviewed November 2026

    How Live Compliance covers it

    Nineteen modules, two portals, and a named team

    Three chapters: the program you run, the security layer that watches it, and what is included rather than sold on top.

    01

    Run

    The program itself

    The audit-prep core, on every plan. This is the part that answers the table above.

    • Risk assessment, with a technical objective scan and an external penetration scan
    • Policies and procedures, with privacy and security templates
    • Training and LMS: HIPAA, OSHA for healthcare, and fraud, waste, and abuse
    • Employees and the Staff Portal
    • eSignature with automated routing
    • Vendors and business associate agreements
    • Incident logs and the anonymous reporting hotline
    • Exclusion verification
    02

    Watch

    The security layer most compliance vendors leave out

    Phishing simulation and dark web breach monitoring are on every plan. The rest arrives on Professional and above.

    • Enterprise SIEM across every workstation
    • Detect and Respond, with continuous vulnerability monitoring
    • Organization-wide encrypted email
    • Credential, license, and certification tracking
    • Asset Manager, a signed device and media register
    • Phishing simulation and education, on every plan
    • Dark web breach monitoring, on every plan
    03

    Include

    What comes with it rather than on top of it

    Nineteen integrated modules across two portals, and people attached to them.

    • A named compliance team on every plan, not a help desk
    • Works with the MSP or IT provider you already have, and does not replace them
    • Corrective action planning and remediation documentation
    • A comprehensive template and documentation library
    • The Seal of Compliance (a Live Compliance program badge, not a government certification) and your Trust Center page
    • A virtual HIPAA Security Officer, available on any plan
    • No add-on fees, no per-scan charges, no quote to request

    See all nineteen modules on real screens

    What it costs

    Every price is on the page

    Most vendors in this category make you ask. Three plans, each a monthly price plus $8.33 per employee per month, billed annually. No add-on fees, no per-scan charges, no quote to request.

    Essentials

    $399

    a month, plus $8.33 per employee per month

    Single-location practices and business associates

    Professional

    $895

    a month, plus $8.33 per employee per month

    Organizations that want the security layer built in

    Example: 20 employees, $1,061.60 a month

    Enterprise

    $1,450

    a month, plus $8.33 per employee per month

    Multi-location practices and health systems

    Example: 20 employees, $1,616.60 a month

    Every price, every plan, and what sits in each one

    The record

    Sixteen years of this, and the guarantee in writing

    500+

    healthcare organizations

    Since 2010

    protecting healthcare

    100%

    audit success rate

    The guarantee. Audit-ready in 60 days, or we keep working at no additional cost until you are. Every plan comes with a named compliance team, not a help desk.

    Built for your setting

    The same program, read for your setting

    The requirements do not change by specialty. Which ones bite first does. Each page below covers where HIPAA tends to go wrong in that setting, with the regulation cited.

    Radiology groupsTeleradiologyMSOs and medical groupsMulti-location practicesDental practicesPharmaciesEvery setting we serve

    Business associates run the same program. A billing company, an IT provider, or a software vendor holding protected health information is directly liable under HIPAA, and the Essentials plan is built for exactly that case. What tends to differ for a vendor is the audience: the questions arrive from the customers buying your service rather than from a regulator, they arrive during procurement, and they arrive on a deadline somebody else set. Having the risk analysis, the policies, and the training record already assembled turns a security questionnaire from a fire drill into an afternoon of copying from one place.

    How to evaluate vendors

    Three questions worth asking every vendor

    • Is the price published, or do you have to ask for it before you can compare anything?
    • Does the platform hold the evidence and the dates, or only the checklists?
    • Are the security operations included, or quoted separately once you are already signed?
    Compare HIPAA compliance softwareVendor against vendor, side by sideBest HIPAA compliance softwareThe ranked list, with why each one placedChoosing HIPAA compliance softwareThe questions to put to a vendor before you signvs. Compliancy Groupvs. Accountable HQvs. HIPAA Vaultvs. MedTrainer

    Straight answers

    Questions buyers actually ask first

    No. HIPAA names safeguards and documentation, not products, and no part of the rule tells you to buy a platform. What the rule does require is a current risk analysis, written policies, a trained workforce, signed business associate agreements, an incident record, and documentation retained for six years. A spreadsheet can hold all of that. What a spreadsheet rarely does is prove the dates when an investigator asks for them, which is the practical reason most organizations move to software. (Source: 45 CFR 164.316(b)(2)(i).)

    No. There is no official HIPAA certification. The U.S. Department of Health and Human Services (HHS) does not certify any product or organization as HIPAA compliant, and it does not endorse or recognize private “HIPAA certifications.” A certification from an outside company does not stop HHS from later finding a violation. A compliance badge means the vendor says so. What carries weight in an investigation is your own evidence: the risk analysis, the policies, the training records, the signed agreements, and the dates attached to each one. Why HIPAA does not certify products.

    Live Compliance publishes every price. Plans are $399, $895, or $1,450 a month, plus $8.33 per employee per month, billed annually, with no add-on fees, no per-scan charges, and no quote to request. Example: 20 employees. Professional works out at $1,061.60 a month. That covers the platform, the monitoring, and a named compliance team.

    No. The program works with the MSP or IT provider you already have, and it does not replace them. Your MSP runs the network. The platform runs the compliance program and keeps the evidence. Where the two meet, in the security operations on Professional and above, your own IT team can see the same monitoring you see rather than waiting on a vendor report. How it works alongside an MSP.

    They answer different questions. HIPAA compliance software manages your compliance program: the risk analysis, the policies, the training, the agreements, and the evidence behind them. “HIPAA-compliant software” is a marketing term for an application that handles protected health information, such as an electronic health record or a messaging tool. No software is HIPAA compliant on its own, and nobody certifies it. What counts is how you set it up and use it, and whether the vendor behind it is a business associate with a signed business associate agreement in place before it creates, receives, maintains, or transmits your patients’ information. One runs the program. The other is a vendor inside it.

    Live Compliance states it one way: audit-ready in 60 days, or we keep working at no additional cost until you are. The first weeks go to the risk analysis and the policies, because nearly everything else refers back to them. Training, vendor agreements, and the incident record follow. Day 60 is not the end of it either. The risk analysis gets revisited as your systems and your workforce change, which is what keeps the program current rather than merely finished.

    See where your program stands before an auditor does.

    Talk it through with a HIPAA specialist, or start with the score and decide afterwards. Either way the guarantee is the same: audit-ready in 60 days, or we keep working at no additional cost until you are.

    Request a Call with a HIPAA Specialist

    The score takes about 10 minutes · No credit card