Scrutineer · By framework

HIPAA compliance software that proves your safeguards

HIPAA compliance is not a certificate you earn once; it is a set of administrative, physical and technical safeguards you have to keep demonstrating, especially when handling protected health information across vendors. Scrutineer maps your controls to the HIPAA Security Rule safeguards and collects the evidence that each one is in place.

The platform tracks your risk analysis, business associate agreements and access controls in one view, and flags gaps such as an expired BAA, an over-permissioned account or a missing encryption control. Continuous evidence means you can show a regulator or a partner exactly how PHI is protected. Scrutineer is decision-support for HIPAA readiness, not legal advice or an official compliance attestation.

or try it below ↓

Control-mapped findings · linked evidence · you decide what to remediate

The Scrutiny Desk

Illustrative sample · not an audit attestation

SOC 2 ISO 27001 HIPAA GDPR PCI DSS

Controls in evidence-linked report out

AI scrutinizes you decide

Why it works

What you get with HIPAA

Safeguards mapped

Scrutineer maps your controls to the administrative, physical and technical safeguards of the Security Rule, so you see exactly where PHI is protected and where it is exposed.

BAAs and access tracked

Business associate agreements and access to PHI are tracked centrally, so an expired BAA or an over-permissioned account is flagged, not discovered after a breach.

Risk analysis kept current

Your HIPAA risk analysis stays live as systems change, with remediation tracked to close rather than filed away and forgotten.

What it handles

Controls in, an evidence-linked report out

Point Scrutineer at a framework or a vendor and it maps every control, pulls the evidence it can find, flags the gaps and scores the risk, returning a report with linked evidence and a prioritized remediation list. Scrutineer is decision support for readiness, an accredited auditor still issues the attestation.

Maps controls to the HIPAA Security Rule safeguards
Maintains your required risk analysis
Tracks business associate agreements and renewals
Monitors access to protected health information
Flags encryption, access and safeguard gaps
Keeps evidence ready for regulators and partners

HIPAA readiness_report

READINESS · 82%

ACCESS CONTROL 91

evidence · MFA enforced and access reviews evidenced.

CHANGE MGMT 78

evidence · Mostly covered; one approval log left untested.

VENDOR RISK 64

evidence · Two subprocessors missing a current review.

ENCRYPTION 86

evidence · Data encrypted in transit and at rest, evidenced.

Example report layout, not customer data

Why Scrutineer

One platform that maps controls and scores risk

Not a static questionnaire, not a pass-fail black box, and not a spreadsheet you maintain by hand. Live control mapping across SOC 2, ISO 27001, HIPAA, GDPR and PCI, automatic evidence and a prioritized gap list, returned as a report you can act on. The AI scrutinizes, you decide.

Mapped to real controls

Every framework is broken down into the controls it actually requires, each scored on a red to amber to green scale, so readiness stays transparent and consistent.

Evidence behind every finding

Each control links to the exact evidence that satisfies it, the policy, the config, the log line, so the finding is auditable and your readiness is defensible.

A prioritized gap list

Open gaps roll up into a ranked remediation list, so the highest-risk findings sit at the top and your team fixes what matters before the audit begins.

Security Rule reference

The HIPAA Security Rule safeguards, section by section

The Security Rule is organized into three safeguard sections plus the organizational and documentation requirements. Each section contains standards, and most standards contain implementation specifications that are either required or addressable.

Section	Standards it contains	What proves it in an audit
Administrative safeguards, 45 CFR 164.308	Eight standards under 164.308(a): security management process, assigned security responsibility, workforce security, information access management, security awareness and training, security incident procedures, contingency plan, and evaluation. The business associate contracts standard sits at 164.308(b).	A current risk analysis, a named security official, joiner and leaver records, training completion, an incident log, and tested backup and recovery plans.
Physical safeguards, 45 CFR 164.310	Four standards: facility access controls, workstation use, workstation security, and device and media controls.	Badge and visitor logs, a facility security plan, workstation policy, and disposal or media re-use records for retired hardware.
Technical safeguards, 45 CFR 164.312	Five standards: access control, audit controls, integrity, person or entity authentication, and transmission security.	Unique user IDs, an emergency access procedure, automatic logoff settings, audit log configuration, and encryption of ePHI in transit and at rest.
Organizational, policies and documentation, 45 CFR 164.314 and 164.316	Business associate contract content, plus the requirement to keep written policies and to retain documentation for six years.	Signed BAAs with the right clauses, versioned policies with review dates, and retention of every record for six years from creation or last effective date.

Required implementation specifications must be implemented. Addressable ones are not optional: you either implement them, or document why they are not reasonable and appropriate and what you did instead. Scrutineer maps controls to these standards and keeps the evidence current; an accredited auditor or your regulator, not Scrutineer, judges the result.

Good questions

Questions about HIPAA

HIPAA has no official certification. Scrutineer maps the Security Rule safeguards, maintains your risk analysis and organizes evidence so you can demonstrate compliance to regulators and partners. It is readiness and decision-support, not legal advice.

Yes. Scrutineer tracks each BAA, its scope and renewal date, and flags expirations or vendors handling PHI without a current agreement, so a missing BAA is caught before it becomes a finding or an incident.

HIPAA compliant software implements the Security Rule technical safeguards: unique user authentication, role-based access control, audit logging, encryption of PHI at rest and in transit, and automatic session timeouts, and the vendor signs a business associate agreement. Scrutineer helps you verify those safeguards across every system and vendor that touches PHI.

The risk analysis required by 45 CFR 164.308(a)(1) is a documented assessment of where PHI lives, the threats to it and the controls protecting it. HIPAA requires it to stay accurate and current, which in practice means at least annually and after any material change. Scrutineer keeps it live as systems and vendors change.

No. HIPAA has no certification, so healthcare buyers often ask for HITRUST instead, because the HITRUST CSF maps the Security Rule safeguards into scored requirement statements a third party can validate. A HITRUST certification is strong evidence of a serious program, but your HIPAA obligations run to you regardless of what any framework says, and the Office for Civil Rights enforces against the rule, not against a certificate.

HIPAA compliance automation is the practice of producing the evidence behind the Security Rule safeguards continuously rather than reconstructing it before an audit or a breach investigation. Read-only connections to your identity, cloud, endpoint and ticketing systems pull the proof that access was restricted, that workforce members were removed on their leaving date, that encryption and audit logging stayed on, and that the risk analysis was reviewed, and they timestamp each artifact so the record shows the safeguard operated across the period. The security risk analysis itself, the sanction decisions and the business associate relationships remain judgement calls you own. What automation removes is the annual scramble, which is also where most HIPAA findings originate.

They are different claims and the confusion is costly. HIPAA compliant software means a product can be used within a covered entity or business associate environment without breaking the rules, which usually comes down to encryption, access controls, audit logging and a willingness to sign a business associate agreement. HIPAA compliance software is tooling that helps you run and evidence the program itself: the risk analysis, the safeguards, the workforce training record and the BAA inventory. Buying the first does not give you the second, and neither one makes an organization HIPAA compliant on its own.

As of July 2026 there are no new HIPAA rules in force. The proposed Security Rule overhaul was published in the Federal Register on January 6, 2025, the comment period closed on March 7, 2025, and HHS has since moved it to its long-term regulatory agenda with July 2027 given as the anticipated date for final action. The existing Security Rule remains fully enforceable in the meantime. If finalized, it would be the first major update in over twenty years, and its headline change is that many currently addressable specifications would become required.

Read every compliance and risk question

Keep reading

Guides that go deeper on HIPAA

The HIPAA compliance checklist

The administrative, physical and technical safeguards the Security Rule requires, and what evidence proves each one.

Read the guide

Running a cybersecurity risk assessment

The NIST SP 800-30 method in eight steps, which is the backbone of the risk analysis HIPAA requires.

Read the guide

What SOC 2 compliance actually is

The framework most healthcare vendors are asked for alongside HIPAA, and where the two control sets overlap.

Read the guide

HITRUST vs SOC 2

The certification healthcare buyers ask for when they cannot ask for a HIPAA certificate, compared with SOC 2 on cost, scope and who issues it.

Read the guide

Explore more

More ways to scrutinize compliance and risk with Scrutineer

SOC 2 compliance

Map controls to the Trust Services Criteria, collect evidence, and close gaps before audit.

Learn more

SOC 2 compliance software

A platform that maps SOC 2 controls, automates evidence, and tracks readiness continuously.

Learn more

ISO 27001 compliance

Map your ISMS to Annex A, automate evidence, and stay certification-ready.

Learn more

See every use case See pricing Back to Scrutineer

Stop guessing about readiness. Scrutinize on real evidence.

Point Scrutineer at a framework or a vendor and it maps every control, gathers evidence and scores the risk, returning an evidence-linked report and a prioritized gap list. The AI scrutinizes, you decide.

See pricing

SOC 2, ISO 27001, HIPAA, GDPR & PCI · evidence-linked controls · readiness, not certification