HIPAA Technical Safeguards: What Small Practices Actually Need

What Technical Safeguards Are

HIPAA’s Security Rule (45 CFR Part 164, Subpart C) requires covered entities to implement safeguards across three categories: administrative, physical, and technical. Technical safeguards are the technology side: the systems, software controls, and policies that protect electronic protected health information.

The Security Rule is technology-neutral. It doesn’t mandate specific products or encryption algorithms. It specifies outcomes: ePHI accessible only to authorized users, activity logged, data integrity maintained, transmission secured. How you achieve those outcomes can vary based on your practice’s size, risk environment, and existing systems.

A 5-person primary care clinic will implement these differently than a 200-person specialty group. The standard applies to both. What counts as “reasonable and appropriate” is where size actually matters.

The Four Standards

Access Controls (§ 164.312(a)(1))

Your systems must allow only authorized users to access ePHI. Required specifications: unique user identification (each workforce member gets their own login, no shared accounts), emergency access procedures (a documented process for accessing ePHI when normal methods fail), and automatic logoff (sessions terminate after a defined period of inactivity).

Addressable specifications include encryption and decryption of stored ePHI.

Your EHR, task management software, file storage, and any other system containing patient data must support individual accounts with role-based permissions. A front desk coordinator should not have the same access level as a physician. Your task management tool needs to enforce this, not just your EHR.

Audit Controls (§ 164.312(b))

Audit controls are required with no addressable subset. Your systems must implement hardware, software, and procedural mechanisms that record and examine activity in information systems containing ePHI.

A task management app that shows “last edited by [name]” is not an audit log. A real audit control captures who accessed a record, when, from what IP address, what they did (viewed, modified, deleted), and what the record contained at the time. These logs must be retained and reviewed on a regular schedule.

Integrity Controls (§ 164.312(c)(1))

Your systems must protect ePHI from improper alteration or destruction. The required specification is a policy covering how integrity is maintained. The addressable specification is electronic mechanisms that confirm ePHI hasn’t been altered or destroyed without authorization.

For software systems, integrity controls typically mean version history, checksums, tamper-evident logging, and access controls that prevent unauthorized deletion. For scanned paper records stored electronically, it means the storage system can detect unauthorized changes.

Transmission Security (§ 164.312(e)(1))

Any ePHI transmitted over a network must be protected. The addressable specifications are encryption (using something like TLS) and integrity controls for data in transit.

Encryption in transit is standard for HIPAA-compliant systems. HHS guidance makes clear that practices using unencrypted transmission need a well-documented reason and an equivalent alternative. Modern compliant tools handle TLS automatically. If a tool transmits data over standard HTTP, it isn’t suitable for ePHI.

Required vs. Addressable Specifications

Some practice administrators read “addressable” as optional. It isn’t — it means “implement this unless you can document a specific reason it doesn’t apply and show what you’re doing instead.”

Required specifications must be implemented as written. Addressable specifications must be implemented if they are reasonable and appropriate for your practice. If not, you document why and implement an equivalent alternative that achieves the same objective.

For small practices, most addressable specifications are reasonable and appropriate. The cases where a practice legitimately documents an alternative are genuinely narrow. And that documentation needs to be thorough enough to hold up when OCR asks for it.

Where Small Practices Actually Fail

EHR vendors have built HIPAA compliance into their products. BAAs are standard, and most clinicians know the EHR is regulated.

The secondary tool stack is a different story. A staff member who types a patient’s name into a Trello card, sends patient information from their personal Gmail, or shares a file via a personal Dropbox account has created an ePHI exposure in a system the practice cannot audit, cannot control, and has no BAA for.

Trello has no BAA at any tier. Standard Asana, Monday.com, and Notion (below their enterprise tiers) lack the audit controls and role-based access that ePHI requires. Personal Gmail and Yahoo accounts have no BAA and produce no audit log accessible to the practice. Consumer file sharing (personal Dropbox, personal Google Drive, iCloud) is not HIPAA-eligible. Standard Slack, iMessage, and WhatsApp are not compliant channels.

The pattern is the same across all of these: tools that staff find convenient, adopted for operational reasons, without anyone running them through a compliance check first.

How to Audit Your Current Tool Stack

For each tool your practice uses, work through five questions:

1. Does this tool ever contain a patient name, diagnosis, appointment detail, or billing information?
2. Does it support unique user accounts with role-based access controls?
3. Does it maintain an audit log of user activity — not just a “last edited” field, but a real activity history?
4. Does it encrypt data in transit (TLS) and at rest?
5. Will the vendor sign a BAA?

If the answer to question 1 is yes and any of 2 through 5 is no, you have a gap. The fix is either switching tools, upgrading to a HIPAA-eligible tier, or restructuring how you use the tool so ePHI never enters it.

PHIGuard is built to satisfy all four technical safeguard standards: unique user IDs with role-based permissions, full audit logs for every task action, data integrity controls, and TLS encryption in transit and at rest. A BAA is included at every pricing tier, Practice ($20/month) through Health System ($99/month).

We built it because the tools practices were already using for clinical coordination didn’t meet these requirements at prices a small practice could justify.