Custom Software for Life Sciences & Healthcare

There is no such thing as HIPAA certification for software. HHS issues none, recognises none, and states it plainly: “there is no standard or implementation specification that requires a covered entity to ‘certify’ compliance”, and “HHS does not endorse or otherwise recognize private organizations’ ‘certifications’ regarding the Security Rule”, which “do not absolve covered entities of their legal obligations”. OCR says separately that HHS and OCR “do not certify any persons or products as ‘HIPAA compliant’”. The federal programme that does certify health IT — the ONC Health IT Certification Program — is voluntary, and tests against certification criteria the HHS Secretary adopts for health IT, which is a different act from certifying compliance with the Security Rule. So ERPStack holds no HIPAA attestation, because none exists to hold; what a covered entity can inspect instead is a business associate agreement and the evidence the system produces for its own risk analysis. Every section number below was read in the eCFR and every enforcement action links to its HHS press release, checked 15 August 2026.

• § 164.308 administrative safeguards, and the four that are Required

  The security management process at 45 CFR 164.308(a)(1) carries four Required implementation specifications, so no risk assessment can argue them away: (a)(1)(ii)(A) risk analysis — “an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability” of ePHI; (a)(1)(ii)(B) risk management; (a)(1)(ii)(C) sanction policy; and (a)(1)(ii)(D) information system activity review — “regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports”. Access sits separately at § 164.308(a)(4) information access management, whose (a)(4)(ii)(C) access establishment and modification is Addressable, as is § 164.308(a)(3)(ii)(C) termination procedures — which is why a leaver whose account still resolves is a finding, not a tidiness problem. § 164.308(a)(8) then requires a periodic evaluation. A healthcare ERP built by ERPStack answers each with something queryable in PostgreSQL: the ePHI access table, an RBAC grant carrying an owner and an expiry, and a scheduled review whose own output is a row.

• § 164.312 technical safeguards, including what they do not say

  Access control at 45 CFR 164.312(a) has exactly four specifications: unique user identification (Required), emergency access procedure (Required), automatic logoff (Addressable) and encryption and decryption (Addressable). Read the omission: the rule fixes no session timeout, so purging a clinical terminal after five minutes of inactivity is a decision you defend under § 164.306(b)(2), never a number you cite. § 164.312(b) audit controls is a bare standard with no implementation specification at all — record and examine activity, schema left to you, which is precisely why it is where builds fail. Then (c)(2) a mechanism to authenticate ePHI (Addressable), (d) person or entity authentication, and (e) transmission security, whose integrity controls and encryption are also both Addressable.

• § 164.310 and § 164.316: the parts a cloud build still owns

  Physical safeguards read like the cloud provider’s problem, and two of them are not: 45 CFR 164.310(d)(2) makes disposal and media re-use Required, and a dropped read replica or a recycled backup volume is media. The sleeper is 45 CFR 164.316(b)(2)(i): retain the documentation this subpart requires “for 6 years from the date of its creation or the date when it last was in effect, whichever is later” (Required). Your risk analysis, your written justification for every Addressable specification you chose not to implement, and your activity-review records are therefore a retention schedule in their own right — so ERPStack builds one: a policy table, a disposition job, and a WORM copy on AWS S3 Object Lock. Where the same system also supports an FDA-regulated activity — a device history record, a clinical trial dataset — the 21 CFR Part 11 electronic-records duties stack on top of these with their own retention clock, and ERPStack keeps that as a separate control set rather than folding it into the HIPAA one.

• Four OCR actions whose root cause is a record the ERP was meant to produce

  OCR does not penalise architectures, it penalises missing evidence. Comstar, LLC, a billing business associate to more than 70 covered entities, settled for $75,000 and a two-year corrective action plan in an agreement OCR announced on 30 May 2025, after ransomware reached the ePHI of 585,621 individuals; the finding was failure to conduct an accurate and thorough risk analysis. Northeast Radiology, P.C. settled for $350,000, announced 10 April 2025, over unauthorised access to images on a PACS server affecting 298,532 patients — risk analysis again, with the corrective action plan adding a written process to regularly review records of information system activity. Warby Parker, Inc. did not settle: OCR imposed a $1,500,000 civil money penalty, announced 20 February 2025, for three Security Rule violations after credential stuffing reached 197,986 individuals — no risk analysis, security measures insufficient to reduce risk to a reasonable and appropriate level, and no procedures to regularly review records of information system activity. And OSF Healthcare System settled for $552,250, announced 29 July 2026, over a 2021 ransomware exfiltration affecting 53,907 individuals, where the findings included failing to notify affected individuals, and the Secretary, in time. OCR now numbers these: Northeast Radiology was the sixth action in its Risk Analysis Initiative, Comstar the ninth.

• Three breach clocks on one event, and the clause that starts them

  A business associate must tell the covered entity “without unreasonable delay and in no case later than 60 calendar days after discovery of a breach” — 45 CFR 164.410(b). The covered entity has the same outer limit to reach individuals under 45 CFR 164.404(b), and 45 CFR 164.408 sends a breach of 500 or more individuals to the Secretary contemporaneously with that notice, while breaches under 500 are logged and filed within 60 days of the year end. The clause that actually binds engineering is § 164.404(a)(2): a breach is discovered on the first day it is known, or would have been known by exercising reasonable diligence. Detection latency is therefore legal exposure — Comstar was accessed on 19 March 2022 and did not detect it until 26 March — so ERPStack wires anomaly alerting onto the same access table the audit control writes, with Sentry on the path.

• Build to the rule in force, not the rule proposed

  OCR issued the first proposed rewrite of the Security Rule since 2013 on 27 December 2024, and the HHS page announcing it says exactly what to do about that: “While the Department is undertaking this rulemaking, the current Security Rule remains in effect.” Reading the eCFR on 12 August 2026, § 164.308, § 164.310 and § 164.312 all still carried their 25 January 2013 amendment at 78 FR 5694, and the Required and Addressable distinction described above still stood. A healthcare ERP that hard-codes a proposed rule is wrong on the day it ships, so ERPStack versions the control set and dates it — and treats a deck quoting the proposal as current as a reason to check its other claims.