HIPAA Compliance Guide

📋 Compliance 30 min read Updated June 2026

HIPAA (Health Insurance Portability and Accountability Act) is the US federal law that governs how Protected Health Information (PHI) must be handled, stored, and transmitted. For MSPs, HIPAA compliance is not optional if any client operates in healthcare — and in 2026, enforcement is more aggressive than ever. This guide covers the full HIPAA regulatory landscape, exactly what MSPs must do as Business Associates, and how Gridlock automates continuous compliance monitoring.

Who HIPAA Applies To

HIPAA applies to two categories of organizations: Covered Entities and Business Associates. MSPs almost always fall into the Business Associate category — which means full HIPAA Security Rule obligations apply to you directly.

Covered Entities (CEs)

Covered Entities are the primary targets of HIPAA. They include:

• Healthcare providers — Doctors, hospitals, clinics, dentists, pharmacies, nursing homes, mental health providers, physical therapists, and any other provider that submits HIPAA-standard electronic transactions
• Health plans — Health insurance companies, HMOs, company health plans, Medicare, Medicaid, and other government health programs
• Healthcare clearinghouses — Entities that process nonstandard health information into standard formats (e.g., billing clearinghouses)

Business Associates (BAs) — Where MSPs Fit

A Business Associate is any person or organization that performs functions or activities on behalf of a Covered Entity that involve access to PHI. If your MSP does any of the following for a healthcare client, you are a Business Associate:

• Manage, operate, or maintain IT systems that store or process PHI
• Provide cloud storage, backup, or hosting services where PHI is present
• Handle technical support that gives access to PHI-containing systems
• Operate email or communications systems used for PHI
• Provide security monitoring or SIEM services over healthcare networks
• Perform data analytics or reporting on PHI datasets
• Manage EHR (Electronic Health Records) systems

Business Associate Subcontractors

If your MSP subcontracts work to another vendor (e.g., a cloud provider, NOC, or co-managed security provider) and that subcontractor will have access to PHI, they become a Business Associate Subcontractor. You are responsible for ensuring they have a Business Associate Agreement in place and that they comply with HIPAA requirements. This chain of responsibility flows down through every subprocessor.

The Three HIPAA Rules

HIPAA compliance is not a single set of requirements — it is composed of three distinct rules, each with its own scope and obligations. MSPs must understand all three.

HIPAA Security Rule — The MSP Focus

The Security Rule is where MSPs spend most of their compliance effort. It applies to all electronic PHI (ePHI) — any PHI created, received, maintained, or transmitted in electronic form. The Security Rule is organized into three safeguard categories: Administrative, Physical, and Technical. Within each category, requirements are designated as either Required (must be implemented) or Addressable (must be implemented or documented why an alternative was chosen).

Designation	Meaning	What Happens If You Skip It
Required	Must be implemented. No exceptions. No documentation alternative.	Automatic compliance failure. OCR will cite this as a violation in any investigation.
Addressable	Must either implement as described, implement an equivalent alternative, or document why it is not reasonable and appropriate for your environment.	If not implemented and not documented with rationale, treated as a violation. "Addressable" does not mean "optional."

Technical Safeguards

Technical safeguards are the technology controls and policies that protect ePHI and control access to it. These are the most directly relevant to MSPs managing healthcare IT environments.

Safeguard	Standard	Implementation Specifications	Gridlock
Access Control	Required	Unique user identification (Required); Emergency access procedure (Required); Automatic logoff (Addressable); Encryption and decryption (Addressable)	Monitored
Audit Controls	Required	Hardware, software, and procedural mechanisms to record and examine access to ePHI systems	Monitored
Integrity	Required	Protect ePHI from improper alteration or destruction; Electronic mechanisms to confirm ePHI is unaltered (Addressable)	Monitored
Person Authentication	Required	Procedures to verify that a person seeking access is who they claim to be (MFA strongly implied)	Monitored
Transmission Security	Required	Guard against unauthorized access to ePHI transmitted over networks; Encryption (Addressable)	Monitored

Encryption — The Critical Control

Although HIPAA designates encryption as "Addressable," OCR's enforcement record and 2024 HIPAA Security Rule updates make encryption effectively mandatory. Every OCR investigation involving a breach examines whether data was encrypted. Unencrypted ePHI on a lost or stolen device is the most common and most avoidable HIPAA violation.

Gridlock monitors encryption status across your entire managed environment:

• Data at rest — Verifies AES-256 encryption on all storage systems, databases, and backup repositories containing ePHI
• Data in transit — Confirms TLS 1.2+ (preferably TLS 1.3) on all network paths where ePHI is transmitted
• Endpoint encryption — Monitors BitLocker/FileVault status on all managed endpoints with access to ePHI
• Email encryption — Alerts when ePHI is detected in unencrypted email communications
• Mobile device encryption — Tracks MDM-enforced encryption on mobile devices

Access Control Implementation

Access control under HIPAA requires more than just usernames and passwords. A compliant access control framework includes:

• Unique user IDs — Every user accessing ePHI systems has their own unique identifier. Shared accounts are a HIPAA violation.
• Role-based access — Access to ePHI is limited to the minimum necessary for each user's job function.
• Multi-factor authentication — While not explicitly required by the 2003 Security Rule text, the 2024 HIPAA Security Rule update explicitly requires MFA for remote access to ePHI. Gridlock enforces this as required.
• Automatic logoff — Sessions terminate automatically after a period of inactivity on ePHI systems.
• Emergency access — Documented break-glass procedures for emergency access to ePHI when normal authentication is unavailable.

Audit Logs — What Must Be Logged

HIPAA requires audit controls that "record and examine activity in information systems that contain or use ePHI." Gridlock auto-collects and retains the following for a minimum of 6 years:

• All logins and logouts to ePHI systems, including failed attempts
• All data access events (view, create, modify, delete)
• All privileged actions (admin operations, configuration changes)
• System and application errors, particularly security-relevant errors
• Network connection events from/to ePHI systems
• File transfer events involving ePHI repositories

Administrative Safeguards

Administrative safeguards are the policies, procedures, and management processes that govern the selection, development, implementation, and maintenance of security measures. They represent roughly 50% of the HIPAA Security Rule requirements.

Standard	Key Requirements	Designation
Security Management Process	Risk analysis; Risk management; Sanction policy; Information system activity review	Required (risk analysis & management); Addressable (others)
Assigned Security Responsibility	Designate a security official responsible for HIPAA security policy development and implementation	Required
Workforce Security	Authorization/supervision of workforce access to ePHI; Workforce clearance procedures; Termination procedures	Addressable
Information Access Management	Isolating healthcare clearinghouse functions; Access authorization; Access establishment and modification	Mixed
Security Awareness and Training	Security reminders; Protection from malicious software; Login monitoring; Password management	Addressable
Security Incident Procedures	Respond to and report security incidents; Document incidents and outcomes	Required
Contingency Plan	Data backup plan; Disaster recovery plan; Emergency mode operation; Testing and revision; Applications criticality analysis	Mixed
Evaluation	Periodic technical and non-technical evaluation of security controls	Required
BA Contracts and Other Arrangements	Written contracts with all Business Associates ensuring HIPAA compliance	Required

Risk Analysis — The Most Critical Administrative Requirement

Risk analysis is the single most commonly cited deficiency in OCR investigations. It is a Required implementation specification — there is no workaround. A compliant risk analysis must:

1. Identify all ePHI locations (systems, devices, applications, physical media, cloud services)
2. Identify all reasonably anticipated threats to ePHI confidentiality, integrity, and availability
3. Assess the current security controls in place for each threat
4. Determine the likelihood and impact of each threat materializing
5. Assign a risk level to each threat (typically High/Medium/Low)
6. Document the analysis with sufficient detail to support your risk management decisions

Gridlock's Compliance Agent automates the asset discovery and threat mapping steps, dramatically reducing the time to produce a defensible risk analysis. The output is a structured report that meets OCR's documentation expectations.

Workforce Training Requirements

HIPAA requires ongoing security awareness training for all workforce members who access ePHI. "Ongoing" is not defined — OCR has cited organizations for annual-only training as insufficient when the threat landscape changed significantly. Best practice is annual formal training plus periodic security awareness updates (phishing simulations, policy reminders, breach notifications to the workforce).

Training must cover:

• What PHI and ePHI are, and how to recognize them
• The organization's HIPAA policies and their obligations under them
• How to identify and report potential security incidents
• Password security and multi-factor authentication
• Social engineering and phishing recognition
• Proper use of portable devices and remote access
• Consequences of non-compliance (sanction policy)

Contingency Planning

A HIPAA-compliant contingency plan has five components. Gridlock monitors the operational health of backup and recovery systems, but the planning and testing components require documented procedures:

• Data backup plan (Required) — Procedures to create and maintain exact retrievable copies of ePHI
• Disaster recovery plan (Required) — Procedures to restore access to ePHI following a disaster
• Emergency mode operation plan (Required) — Procedures to enable critical business processes and access to ePHI during emergencies
• Testing and revision procedures (Addressable) — Schedule and procedure for testing the DR plan and updating it based on test results
• Applications and data criticality analysis (Addressable) — Assessment of which ePHI applications and data are most critical to operations

Physical Safeguards

Physical safeguards govern the physical measures, policies, and procedures used to protect electronic information systems and related buildings and equipment from natural and environmental hazards and unauthorized intrusion.

Standard	Key Requirements	MSP Relevance
Facility Access Controls	Contingency operations; Facility security plan; Access control and validation procedures; Maintenance records	Applies to data centers, server rooms, and network closets where ePHI systems are housed. Cloud workloads inherit provider's facility controls.
Workstation Use	Policies specifying proper use of and functions performed on workstations that access ePHI	Applies to all MSP technician workstations used for remote access to healthcare client environments.
Workstation Security	Physical safeguards for workstations that access ePHI — preventing unauthorized access	Screen locks, clean desk policy, cable locks for unattended devices, clean desk when PHI is displayed.
Device and Media Controls	Disposal; Media re-use; Accountability; Data backup and storage	Secure disposal of hard drives and media from decommissioned healthcare client equipment. Chain of custody documentation. NIST 800-88 or equivalent data destruction.

How Gridlock Automates HIPAA Compliance Monitoring

Gridlock's Compliance Agent provides continuous HIPAA compliance monitoring across all three safeguard categories, with automated evidence collection and real-time gap alerting.

HIPAA Requirement	Gridlock Automation
Encryption monitoring	Continuously verifies AES-256 at rest and TLS 1.3 in transit across all ePHI systems. Alerts within 15 minutes if encryption is disabled or downgraded on any in-scope system.
Access control auditing	Monitors MFA enforcement rates, shared account usage, inactive account detection, privileged access inventory, and access review completion tracking.
Audit log management	Automatically collects, aggregates, and retains audit logs from all in-scope systems for the required minimum of 6 years. Tamper-evident log storage with integrity verification.
Risk analysis support	Auto-discovers ePHI locations, maps threats to assets, scores risk levels, and generates a structured risk analysis report. Updated continuously as the environment changes.
Incident detection	Monitors for behavioral anomalies, unauthorized access attempts, unusual data exfiltration patterns, and ransomware indicators — all specifically tuned for healthcare environments.
BAA tracking	Maintains an inventory of Business Associate Agreements, tracks expiration dates, and alerts when agreements are missing for vendors with ePHI access.
Backup verification	Monitors backup job completion, verifies backup integrity, tracks restore test history, and alerts on backup failures affecting ePHI systems.
Patch management	Tracks unpatched vulnerabilities on ePHI systems with aging reports, severity-based SLA enforcement, and evidence of patch deployment for audit purposes.
Workforce training tracking	Integrates with LMS platforms to monitor training completion rates and flag overdue employees with access to ePHI systems.

Continuous vs. Point-in-Time Monitoring

Traditional HIPAA compliance is assessed annually through a risk analysis snapshot. The problem: a lot can go wrong in 12 months. A misconfigured server, a lapsed BAA, a disabled encryption setting — any of these can sit undetected until the next annual review, or worse, until an OCR investigation.

Gridlock provides continuous monitoring — checks run daily or more frequently depending on criticality, and gaps generate real-time alerts. This means your HIPAA posture is visible at all times, not just on audit day.

BAA Requirements for MSPs

A Business Associate Agreement is a legally binding contract between a Covered Entity and a Business Associate that defines each party's HIPAA obligations. Without a signed BAA in place, an MSP cannot legally access or work with a healthcare client's ePHI — and both parties are in violation.

What a BAA must contain

Under 45 CFR § 164.504(e), a compliant BAA must include:

• A description of the permitted and required uses and disclosures of PHI
• A requirement that the BA not use or disclose PHI beyond what the BAA permits
• Appropriate safeguards to protect PHI from unauthorized use or disclosure
• A requirement to report to the CE any use or disclosure not provided for by the BAA
• A requirement to report security incidents, including breaches, to the CE
• A requirement to subcontract to downstream vendors only under equivalent BAA terms
• A requirement to make PHI available for individuals' rights requests
• A requirement to make internal practices, records, and books available to HHS
• At termination, either return or destroy PHI (or document why infeasible)

BAA best practices for MSPs

• Execute before access begins — A BAA must be in place before you have any access to ePHI. Retroactive BAAs are a red flag to OCR investigators.
• Use your own template — Do not simply sign whatever the CE sends. MSP-favorable BAAs limit your liability more precisely and align with your actual service scope.
• Track all BAAs — Gridlock maintains a BAA inventory and alerts on agreements approaching expiration or missing for vendors with ePHI access.
• Downstream BAAs — Execute BAAs with all your subcontractors that have ePHI access before their access begins. You are liable for their compliance.
• Amendment on scope change — If your services expand (e.g., you add cloud backup that touches ePHI), update the BAA to reflect the new scope.

PHI Handling in MSP Environments

PHI is any individually identifiable health information in any form. For MSPs, this manifests in unexpected places:

Where PHI hides in managed environments

• EHR systems — The obvious one. But also includes EHR test/dev environments that often contain real patient data.
• Email — Clinical staff routinely email PHI. Your managed email infrastructure (Exchange, M365, Google Workspace) is in scope.
• Backup systems — Backup jobs that include ePHI systems create PHI-containing backups. Backup media and cloud backup repositories are in scope.
• Network monitoring tools — Packet captures, SIEM logs, and network flow data can contain ePHI if the network carries clinical traffic. Handle with care.
• RMM tool data — Your RMM screenshots, session recordings, and remote support sessions may capture PHI displayed on screen.
• File shares — Clinical staff frequently store PHI in file shares, even when policy says not to. Scan for PHI on all managed file storage.
• Databases — Including SQL server instances for non-EHR applications like billing systems, scheduling, and lab systems.
• Endpoint memory and swap — Ephemeral PHI in RAM and swap files can be exposed by forensic tools or memory dumps.

Minimum necessary standard

When accessing PHI in the course of managed services work, the Privacy Rule's Minimum Necessary standard requires that you access only the PHI required to perform the specific task. Document your access policies and train technicians on this principle. Your RMM tool's audit logs serve as evidence of access scope compliance.

PHI in support tickets and documentation

Warn your helpdesk staff: never paste PHI (patient names, record numbers, dates of birth, diagnosis codes) into tickets, chat tools, or documentation systems unless those systems are covered by your BAA and have appropriate protections in place. This is one of the most common accidental HIPAA violations at MSPs.

2026 Enforcement Landscape

HIPAA enforcement has increased dramatically in scope and financial impact. Understanding the current enforcement environment helps MSPs prioritize their compliance investments.

Penalty tiers (2026)

OCR investigation trends in 2025–2026

• Ransomware as automatic breach — OCR has confirmed that ransomware infections affecting ePHI are presumed HIPAA breaches. The burden of proof to rebut this presumption is very high. Any ransomware event at a healthcare client triggers your Breach Notification Rule obligations.
• Business Associate investigations — OCR has dramatically increased direct investigations of Business Associates. You are no longer protected by the CE relationship if you are the source of a breach.
• Missing risk analysis — The most common finding in every OCR investigation. If you cannot produce a current, documented risk analysis for your healthcare clients, you will be cited.
• 2024 HIPAA Security Rule updates — The updated Security Rule (effective 2024) adds explicit requirements for MFA on remote access, network segmentation, vulnerability scanning, and asset inventories. These are now Required, not Addressable.
• State AG enforcement — Several state Attorneys General (including New York, California, and Texas) have pursued HIPAA-related enforcement independently of OCR. Multi-jurisdiction exposure is a real risk.
• Right of action expansion — Legislative proposals to create a private right of action for HIPAA violations have gained traction. While not yet law, passage would expose MSPs to class action litigation.

HIPAA Compliance Checklist

Use this checklist to assess your current HIPAA posture. Every item marked "Required" has no acceptable alternative — it must be implemented.

Business Associate foundation

• BA status assessed — Confirmed which client relationships make you a Business Associate
• BAAs executed — Signed BAA in place with every CE client before any ePHI access
• Subcontractor BAAs — Downstream BAAs in place with all subcontractors having ePHI access
• BAA inventory — Centralized tracking of all BAAs with expiration dates (Gridlock automates this)
• Security official designated — Named individual responsible for HIPAA security program

Risk analysis and management

• ePHI inventory — All locations where ePHI is created, received, maintained, or transmitted are documented
• Risk analysis completed — Current, documented risk analysis covering all ePHI systems (Required)
• Risk management plan — Documented plan to address identified risks with timelines and owners (Required)
• Sanction policy — Documented policy for disciplining employees who violate HIPAA policies (Required)
• Periodic evaluation — Schedule for re-assessment of security controls (Required)

Technical safeguards

• Unique user IDs — No shared accounts on ePHI systems (Required)
• MFA on remote access — Multi-factor authentication enforced for all remote access to ePHI (Required per 2024 update)
• Encryption at rest — AES-256 encryption on all ePHI storage (Addressable — document if not implemented)
• Encryption in transit — TLS 1.2+ on all network paths carrying ePHI (Addressable — document if not implemented)
• Audit logging — All ePHI system access logged and retained for 6 years (Required)
• Automatic logoff — Sessions terminate after inactivity on ePHI systems (Addressable)
• Integrity controls — Mechanisms to detect unauthorized alteration of ePHI (Addressable)

Administrative safeguards

• Security policies documented — Written HIPAA security policies in place and distributed
• Workforce training — All employees with ePHI access have completed HIPAA training (Addressable — treat as Required)
• Incident response plan — Documented procedures for detecting, responding to, and reporting security incidents (Required)
• Data backup plan — Documented backup procedures for ePHI with tested restoration (Required)
• Disaster recovery plan — Documented DR procedures tested within the last 12 months (Required)
• Termination procedures — Process to promptly revoke ePHI access upon employee termination (Addressable)
• Access reviews — Periodic review of who has access to ePHI systems (Addressable — treat as Required)

Physical safeguards

• Facility access controls — Physical access to ePHI systems is restricted and logged
• Workstation policy — Documented policy on proper use of workstations that access ePHI
• Device encryption — All endpoints with ePHI access have full disk encryption enabled
• Media disposal — NIST 800-88 compliant data destruction for decommissioned ePHI media with documentation

Gridlock automation

• Compliance Agent connected — Gridlock deployed on all healthcare client environments
• Encryption monitoring active — Continuous encryption status checks running
• Access control monitoring active — MFA compliance, shared accounts, and access reviews tracked
• Audit log collection active — Centralized log collection running with 6-year retention configured
• BAA tracking configured — All BAAs entered into Gridlock's BAA inventory module
• Risk analysis report generated — Current risk analysis report produced and reviewed
• Breach detection tuned — Healthcare-specific incident detection rules active on all ePHI environments

Related Resources