HIPAA's Security Rule defines specific technical safeguards that covered entities and business associates must implement to protect electronic Protected Health Information (ePHI). For healthcare websites and patient portals, this translates to concrete engineering requirements. This checklist covers the technical safeguards section (45 CFR § 164.312) with practical implementation guidance.
What Is ePHI?
Electronic Protected Health Information includes any health information that is created, stored, transmitted, or received electronically and identifies or could identify an individual. This includes: names, dates (birth, admission, discharge, death), geographic identifiers, phone numbers, email addresses, Social Security numbers, medical record numbers, health plan numbers, account numbers, and any other unique identifiers.
If your website collects appointment requests, patient intake forms, contact forms from patients describing symptoms, or any health-related data, you likely handle ePHI and are subject to HIPAA's technical safeguards.
1. Access Controls (Required)
HIPAA requires that access to ePHI systems is limited to authorized users. Technical implementation:
- Unique user identification — every user accessing ePHI systems must have a unique ID; no shared accounts or generic logins
- Emergency access procedure — documented procedure to access ePHI in an emergency when normal authentication is unavailable
- Automatic logoff — session timeout after a period of inactivity (typically 15 minutes for clinical workstations, acceptable up to 30 minutes for administrative portals)
- Encryption and decryption — a mechanism to encrypt and decrypt ePHI (addressable — must be implemented or equivalent protection documented)
// Example: Session timeout enforcement
// Set in your application session configuration
SESSION_TIMEOUT = 900 # 15 minutes in seconds
SESSION_COOKIE_SECURE = True
SESSION_COOKIE_HTTPONLY = True
// Implement idle timeout check on each request
def check_session_timeout(request):
last_activity = request.session.get('last_activity')
if last_activity:
elapsed = time.time() - last_activity
if elapsed > SESSION_TIMEOUT:
request.session.flush()
return redirect('/login?reason=timeout')
request.session['last_activity'] = time.time()
2. Audit Controls (Required)
Hardware, software, and procedural mechanisms must record and examine activity in information systems that contain ePHI. Your web application must log:
- All authentication events (login success, login failure, logout)
- All access to patient records — who accessed what, when
- All modifications to ePHI (create, update, delete)
- Failed access attempts to restricted resources
- Administrative actions (user creation, permission changes)
Logs must be tamper-evident (write to an append-only store or WORM storage), retained for a minimum of six years, and regularly reviewed for anomalies. Centralize logs in a SIEM or managed log service rather than relying on application-level log files that could be deleted or modified.
3. Integrity Controls (Addressable)
HIPAA requires mechanisms to protect ePHI from improper alteration or destruction. Technical controls include:
- Database checksums or cryptographic hashing to detect unauthorized modification of stored ePHI
- File integrity monitoring on servers that store or process ePHI
- Digital signatures for ePHI transmitted between systems
- Backup verification — regularly test that backups are intact and can be restored
At the database level, enable audit trails that record row-level changes including the previous value, new value, timestamp, and user who made the change.
4. Transmission Security (Required)
Any ePHI transmitted over a network must be protected against unauthorized interception. This is the most directly applicable requirement for web applications.
- TLS 1.2 or higher — required for all connections. TLS 1.0 and 1.1 are not acceptable for HIPAA-covered systems as of current HHS guidance
- No HTTP — all ePHI must travel over HTTPS only. Implement HSTS with at least a 1-year max-age
- Certificate validity — use certificates from trusted CAs, monitor for expiry, and do not use self-signed certificates in production patient-facing systems
- Cipher suites — disable weak ciphers (RC4, DES, 3DES). Use only AEAD cipher suites
# Nginx TLS configuration for HIPAA compliance
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
ssl_prefer_server_ciphers off;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
5. PHI in Web Applications — Common Mistakes
Beyond the formal safeguard categories, healthcare web applications frequently make these mistakes:
- ePHI in URL parameters —
/patient?id=12345&name=John+Smithexposes ePHI in access logs, browser history, and HTTP Referer headers. Use POST requests or opaque identifiers - ePHI in error messages — error pages that echo back form inputs or database fields can leak ePHI. Use generic error messages
- Unencrypted backups — database backups stored on unencrypted S3 buckets or NAS devices are a common breach cause. Encrypt all backups at rest
- Caching of ePHI pages — patient portal pages containing health information must have appropriate cache-control headers to prevent browser caching:
Cache-Control: no-store, no-cache, must-revalidate
6. What Triggers a HIPAA Breach?
A breach is the acquisition, access, use, or disclosure of unsecured PHI in a manner not permitted by the Privacy Rule. Unsecured means not encrypted to NIST-approved standards. Key thresholds:
- Under 500 individuals — notify the Secretary of HHS within 60 days of the end of the calendar year in which the breach was discovered; notify affected individuals without unreasonable delay
- 500 or more individuals in a state — notify the Secretary within 60 days of discovery AND notify prominent local media outlets
- 500 or more individuals total — listed publicly on the HHS "Wall of Shame" (OCR Breach Portal)
Encryption is a safe harbor: if the ePHI that was accessed or disclosed was encrypted to NIST standards (AES-128 or higher for data at rest, TLS 1.2+ for data in transit), the disclosure is not a reportable breach even if unauthorized access occurred.
7. HITECH Act Updates
The Health Information Technology for Economic and Clinical Health (HITECH) Act strengthened HIPAA enforcement. Key updates relevant to web applications: Business Associates are now directly liable for HIPAA compliance (not just the covered entity), breach notification timelines are stricter, and penalty tiers were restructured with maximums up to $1.9 million per violation category per year.
Security Scanning for HIPAA Compliance
Regular vulnerability assessments are a HIPAA requirement under the Risk Analysis provision (§ 164.308(a)(1)). Automated web scanning provides documented evidence of continuous monitoring. The scan report should be retained as part of your HIPAA documentation package — it demonstrates that you identified and remediated risks on an ongoing basis, which is exactly what auditors look for.