HIPAA's Security Rule defines specific technical safeguards that covered entities and business associates must implement to protect electronic Protected Health Information (ePHI). For healthcare websites and patient portals, this translates to concrete engineering requirements. This checklist covers the technical safeguards section (45 CFR § 164.312) with practical implementation guidance.

What Is ePHI?

Electronic Protected Health Information includes any health information that is created, stored, transmitted, or received electronically and identifies or could identify an individual. This includes: names, dates (birth, admission, discharge, death), geographic identifiers, phone numbers, email addresses, Social Security numbers, medical record numbers, health plan numbers, account numbers, and any other unique identifiers.

If your website collects appointment requests, patient intake forms, contact forms from patients describing symptoms, or any health-related data, you likely handle ePHI and are subject to HIPAA's technical safeguards.

1. Access Controls (Required)

HIPAA requires that access to ePHI systems is limited to authorized users. Technical implementation:

// Example: Session timeout enforcement
// Set in your application session configuration
SESSION_TIMEOUT = 900  # 15 minutes in seconds
SESSION_COOKIE_SECURE = True
SESSION_COOKIE_HTTPONLY = True

// Implement idle timeout check on each request
def check_session_timeout(request):
    last_activity = request.session.get('last_activity')
    if last_activity:
        elapsed = time.time() - last_activity
        if elapsed > SESSION_TIMEOUT:
            request.session.flush()
            return redirect('/login?reason=timeout')
    request.session['last_activity'] = time.time()

2. Audit Controls (Required)

Hardware, software, and procedural mechanisms must record and examine activity in information systems that contain ePHI. Your web application must log:

Logs must be tamper-evident (write to an append-only store or WORM storage), retained for a minimum of six years, and regularly reviewed for anomalies. Centralize logs in a SIEM or managed log service rather than relying on application-level log files that could be deleted or modified.

3. Integrity Controls (Addressable)

HIPAA requires mechanisms to protect ePHI from improper alteration or destruction. Technical controls include:

At the database level, enable audit trails that record row-level changes including the previous value, new value, timestamp, and user who made the change.

4. Transmission Security (Required)

Any ePHI transmitted over a network must be protected against unauthorized interception. This is the most directly applicable requirement for web applications.

# Nginx TLS configuration for HIPAA compliance
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
ssl_prefer_server_ciphers off;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

5. PHI in Web Applications — Common Mistakes

Beyond the formal safeguard categories, healthcare web applications frequently make these mistakes:

6. What Triggers a HIPAA Breach?

A breach is the acquisition, access, use, or disclosure of unsecured PHI in a manner not permitted by the Privacy Rule. Unsecured means not encrypted to NIST-approved standards. Key thresholds:

Encryption is a safe harbor: if the ePHI that was accessed or disclosed was encrypted to NIST standards (AES-128 or higher for data at rest, TLS 1.2+ for data in transit), the disclosure is not a reportable breach even if unauthorized access occurred.

7. HITECH Act Updates

The Health Information Technology for Economic and Clinical Health (HITECH) Act strengthened HIPAA enforcement. Key updates relevant to web applications: Business Associates are now directly liable for HIPAA compliance (not just the covered entity), breach notification timelines are stricter, and penalty tiers were restructured with maximums up to $1.9 million per violation category per year.

Security Scanning for HIPAA Compliance

Regular vulnerability assessments are a HIPAA requirement under the Risk Analysis provision (§ 164.308(a)(1)). Automated web scanning provides documented evidence of continuous monitoring. The scan report should be retained as part of your HIPAA documentation package — it demonstrates that you identified and remediated risks on an ongoing basis, which is exactly what auditors look for.