HIPAA Compliance
Term 5 of 68 in the ERPStack technical glossary
What is HIPAA Compliance?
The Health Insurance Portability and Accountability Act (HIPAA) is a regulatory framework establishing national standards to protect sensitive patient health information (ePHI) from disclosure without consent.
HIPAA Compliance at a glance
- Statute
- Public Law 104-191 of 1996, extended by the HITECH Act, Public Law 111-5 of 2009
- Rules in code
- 45 CFR Part 164, titled Security and Privacy, is the operative regulation
- Technical safeguards
- Access control, audit controls, integrity, authentication and transmission security
- Contractual step
- 1 Business Associate Agreement per vendor touching electronic protected health information
- Built with
- PostgreSQL 18 in an AWS private subnet defined by Terraform, AES-256 keys in a managed key service, RBAC, SSO and audit trails in Next.js 16, Sentry payloads scrubbed of ePHI
- Numbers that matter
- 45 CFR Part 164; Public Law 104-191 of 1996; HITECH is Public Law 111-5 of 2009; 1 Business Associate Agreement per vendor touching ePHI
- Adjacent regimes
- SOC 2, ISO 27001, GDPR and FDA 21 CFR Part 11 Compliance
- Commonly paired with
- FHIR interfaces, AWS key management, a Virtual Private Cloud boundary, Terraform provisioning, RBAC, SSO and an Immutable Audit Trail
How HIPAA Compliance works in production
The ERPStack approach to HIPAA Compliance
We build HIPAA-compliant healthcare applications with FHIR v4 integrations. We use transparent database column encryption, automated session timeouts, and secure audit logging. We also assist you in signing Business Associate Agreements (BAAs) with cloud hosting providers.
Frequently asked questions about HIPAA Compliance
What does HIPAA Compliance require from a software system?
Safeguards around electronic protected health information, set out in 45 CFR Part 164. In engineering terms HIPAA Compliance means unique user identification and access control, audit controls that record who accessed what, integrity protections so records cannot be altered undetectably, and encryption of data in transit and at rest. It is a floor, not a ceiling — the rule describes outcomes and leaves implementation to you.
What is a Business Associate Agreement and who needs one?
A contract that extends HIPAA Compliance obligations to a vendor handling protected health information on a covered entity's behalf. Any cloud provider, hosting platform or processor touching that data needs 1 in place before it does so. This is the step most often discovered late, because a service can be technically suitable and still contractually unusable until the agreement is signed.
Does encryption alone make a system HIPAA compliant?
No. Encryption addresses 1 safeguard among several, and HIPAA Compliance also requires access control, audit controls, integrity verification, workforce procedures and breach response. A system with excellent encryption and a shared administrator login fails. The regulation is about a coherent set of controls, which is why architecture decisions matter more than any single cryptographic choice.
How does ERPStack approach healthcare builds?
By designing for the safeguards from the first schema. That means Role-Based Access Control, an immutable audit trail written in the same transaction as each change, database instances in a private subnet with no public route, and encryption keys held in a managed key service. ERPStack holds no certification; we build systems intended to be auditable for HIPAA Compliance, and the covered entity remains accountable for its own programme.