---
title: Examining the 2024 NIST Guide for HIPAA-Compliant Software
description: NIST’s updated HIPAA guide is the easiest way to build and maintain HIPAA-compliant software. Learn what’s new in the 2024 edition of this core document.
image: https://vitaminsoftware.com/hubfs/blog%20and%20newsletter%20covers/17.png
---

[Skip to content](https://vitaminsoftware.com/blog/examining-the-2024-nist-guide-for-hipaa-compliant-software#main-content)

This is a search field with an auto-suggest feature attached.

- There are no suggestions because the search field is empty.

[![Vitamin Software logo png](https://vitaminsoftware.com/hubfs/logo--text-orange.svg "Vitamin Software logo png")](https://vitaminsoftware.com/)

- Who we are 
    - [About us](https://vitaminsoftware.com/about-us)
    - [Get in touch](https://vitaminsoftware.com/contact-us)
- What we do 
    - [Services](https://vitaminsoftware.com/services)
    - [Clients](https://vitaminsoftware.com/clients)
- Resources 
    - [Blog](https://vitaminsoftware.com/blog)
    - [Executive insights](https://vitaminsoftware.com/schedule-a-meeting-w-andrei)

- [Contact](https://vitaminsoftware.com/contact-us)
- Search Search
  
  Search

- [Healthcare Resources](https://vitaminsoftware.com/blog/tag/healthcare-resources),
- [Healthcare Regulations](https://vitaminsoftware.com/blog/tag/healthcare-regulations),
- [HIPAA Compliance](https://vitaminsoftware.com/blog/tag/hipaa-compliance)

# Examining the 2024 NIST Guide for HIPAA-Compliant Software

![Examining the 2024 NIST Guide for HIPAA-Compliant Software](https://vitaminsoftware.com/hubfs/blog%20and%20newsletter%20covers/17.png)

- April 23, 2024

![Andjela Markovic](https://vitaminsoftware.com/hubfs/angela.jpeg)

[Andjela Markovic](https://vitaminsoftware.com/blog/author/andjela-markovic)

A big update for organizations building HIPAA-compliant software: in February 2024, **the National Institute of Standards and Technology (NIST) finalized its updated resource guide**. This document helps you understand and follow the HIPAA Security Rule, building on NIST’s earlier work from 2008.

The Vitamin cybersecurity department examined these regulations and how they relate to creating compliant SaaS products. Let’s see what they’ve discovered.

## NIST Updates Its HIPAA Guidebook

Although the HIPAA Security Rule was established in 1998, many healthcare entities remain vulnerable to cybersecurity threats and leaks. Among other reasons, that’s because covered entities may struggle to implement HIPAA-compliant software and procedures.

The HHS periodically releases updates and adjustments to the Act to accommodate these entities and their evolving needs. The latest update arrived this February when **the National Institute of Standards and Technology (NIST) released updated HIPAA guidance**. *Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide* is meant to help covered entities comply with the HIPAA Security Rule.

### What Does the Guide Say?

The HIPAA Security Rule is flexible and adaptable, with scalable procedures for PHI protection. The Resource Guide provides a range of customizable recommendations, suiting various needs and levels of cybersecurity maturity.

This guide breaks down each Security Rule standard into key PHI protection activities. As such, it’s helpful for regulated entities who can’t adopt HIPAA successfully using the Act alone.

The NIST HIPAA Guide contains these helpful sections:

- **Key activities**. Everything an organization might do to achieve HIPAA compliance, like security management, assigning responsibilities, and having procedures for incidents.
- **Descriptions**. Expansions of each activity, complete with suggested implementation strategies. It’s a step-by-step guide to assessing risks and finding ways to mitigate them.
- **Sample questions**. Our favorite section because it encourages organizations to think critically about their cybersecurity practices. If the answer to any is ‘no,’ it’s grounds for further work.

Here’s how it looks in practice:

![HIPAA guidelines from the new guide](https://lh7-us.googleusercontent.com/OAo52rXZYuZZEjYeKr-07aNTQuA4HjBtNM15hEVll2mPAjYKne-lCfG-TtRjQDgiDVwMvl36JIKIzXl-IwgGKiucQxkC0eEFoibLM6MQ7YzfWtEsschUBXFl-BFnvTSb5yFTbFperUslW9V5UPnC1o8)

Then there’s risk assessment.

HIPAA-compliant software includes two types of controls: required and addressable. The former is necessary for all covered entities and third parties, while each organization may choose some of the latter. The new guide contains a section on risk assessments, **detailing the seven steps to evaluate your organization and determine the necessary addressable controls**.

### Additional Resources

The [Cybersecurity and Privacy Resource Tool (CPRT) has been updated.](https://csrc.nist.gov/projects/cprt/catalog#/cprt/home) Companies can click through from basic to specific tools to help them understand and adopt cybersecurity measures.

Within this document, the [latest NIST HIPAA guide is available in PDF form](https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-66r1.pdf). Have your teams examine them to emphasize security.

Also, check out the revised NIST’s Cybersecurity Framework (CSF). It provides guidelines and best practices for organizations to improve their cybersecurity posture, regardless of sector or industry. While not specific to healthcare, many providers and third parties use the NIST CSF as a foundation for their security programs.

[CSF 2.0 Informative References](https://www.nist.gov/informative-references) contain practical tips to apply this standard. [The Quick Start Guides](https://www.nist.gov/quick-start-guides) are great for organizations starting their security journey.

Other resources for good healthcare technology practies include [ONC's strategy for health IT for 2030](https://vitaminsoftware.com/blog/federal-health-it-strategic-plan-onc-aims-for-2030). Security is one of its core features, as are broader implementation and health equity.

## What Does This Mean for Healthcare Software Development?

![Considering different aspects of software](https://lh7-us.googleusercontent.com/oMrHgE1eZxdFMbi-Dg6jgwDLwfnCaiCjsGYT4wIyW7saXo3X15lnizy0i7wi5qN3V4Zb_0ZsohmOkYsRnu7UgL6gEVUSGHryl3zs5rWyqufd0qBKyCsRfadWWxz9kkaDBvsnDnhxZZRKl7c2VEkZNws)

According to NIST, what is the key to HIPAA compliance? Here are our takeaways:

- **Understand NIST guidelines**. Familiarize yourself with NIST Special Publication 800-66 Rev 2. It outlines best practices and recommendations for securing ePHI.
- **Conduct risk assessments**. Follow NIST’s recommended risk assessment methods to identify potential risks to ePHI.
- **Determine access controls**. Control employee access to sensitive data by restricting it based on necessity and implementing strict access protocols.
- **Install cybersecurity measures**. Implement cybersecurity practices like network security and malware protection to safeguard data per NIST and HIPAA.
- **Data encryption**. Encrypt data during transmission and storage to mitigate security risks in case of breaches.
- **Audit your HIPAA-compliant software**. Conduct periodic audits, including policy reviews, access control assessments, and encryption checks.
- **Train the end-users**. Provide comprehensive training on HIPAA principles and data security policies to all staff who handle medical information. As a developer, you can organize demos to ensure everybody’s on the same page.

The risk assessment and mitigation have to be long-term, too. Assess and update procedures, policies, and security systems regularly to meet compliance requirements.

## The Vitamin Approach to Healthcare Security

The Vitamin team considers security a top priority while developing HIPAA-compliant software for healthcare. The infographic below contains the basics of our approach. To learn more, visit our healthcare compliance and security page.

![Vitamin Software's cybersecurity techniques](https://vitaminsoftware.com/hs-fs/hubfs/cybersecurity%20infographic.png?width=800&height=2000&name=cybersecurity%20infographic.png)

## Final Thoughts & Next Steps

The updated NIST guide for HIPAA-compliant software is a milestone in boosting healthcare cybersecurity. It clarifies existing regulations and lets healthcare providers efficiently improve their security standing.

Healthcare providers and vendors, as well as software developers, should prioritize NIST guidelines. This guide made the task easier and brought us closer to a secure, digitized ecosystem of secure patient data and excellent healthcare outcomes.

**Need help with creating and maintaining HIPAA-compliant software?** The Vitamin team is several clicks away as your trusted strategic partner for building compliant healthcare SaaS. [Talk with our leadership, cybersecurity, or engineering teams about the best implementation and adherence strategies](https://vitaminsoftware.com/vs-contact-us).

 Vitamin Software

## You might want to read this next.

At its core, HIPAA compliance is about protecting the patients. This focus on better care shows at the level of the federal government in its plans for 2024-2030. Read more about it here:

### Federal Health IT Strategic Plan: ONC’s Objectives for 2030

[![Best Practices for Running a Secure Healthcare Data Warehouse](https://vitaminsoftware.com/hubfs/blog%20and%20newsletter%20covers/18.png)](https://vitaminsoftware.com/blog/best-practices-for-running-a-secure-healthcare-data-warehouse)

[Healthcare Project Tips](https://vitaminsoftware.com/blog/tag/healthcare-project-tips), [Technology in Healthcare](https://vitaminsoftware.com/blog/tag/technology-in-healthcare), [HIPAA Compliance](https://vitaminsoftware.com/blog/tag/hipaa-compliance)

### [Best Practices for Running a Secure Healthcare Data Warehouse](https://vitaminsoftware.com/blog/best-practices-for-running-a-secure-healthcare-data-warehouse)

 May 20, 2024

 Is your information about patients, payers, and providers well-organized and easy to manage? If not, you might need a...

[Read more](https://vitaminsoftware.com/blog/best-practices-for-running-a-secure-healthcare-data-warehouse)

[![What AI Regulations Should Your Healthcare Software Follow?](https://vitaminsoftware.com/hubfs/blog%20and%20newsletter%20covers/7.png)](https://vitaminsoftware.com/blog/what-ai-regulations-should-your-healthcare-software-follow)

[Healthcare Resources](https://vitaminsoftware.com/blog/tag/healthcare-resources), [Healthcare Regulations](https://vitaminsoftware.com/blog/tag/healthcare-regulations), [AI for Healthcare](https://vitaminsoftware.com/blog/tag/ai-for-healthcare)

### [What AI Regulations Should Your Healthcare Software Follow?](https://vitaminsoftware.com/blog/what-ai-regulations-should-your-healthcare-software-follow)

 April 23, 2024

 The regulation of AI in healthcare is becoming a hot topic for anybody building or using software in this industry....

[Read more](https://vitaminsoftware.com/blog/what-ai-regulations-should-your-healthcare-software-follow)

[![Bridge the Gap: Decoding Technical Speak for Health Tech Execs](https://vitaminsoftware.com/hubfs/blog%20covers%20(4).png)](https://vitaminsoftware.com/blog/bridge-the-gap-decoding-technical-speak-for-health-tech-execs)

[Healthcare Resources](https://vitaminsoftware.com/blog/tag/healthcare-resources), [Healthcare Project Tips](https://vitaminsoftware.com/blog/tag/healthcare-project-tips)

### [Bridge the Gap: Decoding Technical Speak for Health Tech Execs](https://vitaminsoftware.com/blog/bridge-the-gap-decoding-technical-speak-for-health-tech-execs)

 July 1, 2024

 As an executive of a health tech company, we understand that you're no stranger to the complex maze of healthcare...

[Read more](https://vitaminsoftware.com/blog/bridge-the-gap-decoding-technical-speak-for-health-tech-execs)

[Check all articles](https://vitaminsoftware.com/blog)

 Check out Vitamin's additional resources

### Software Savvy CEO by Vitamin

Our CEO creates a weekly newsletter sharing all things healthcare software executives need to succeed. You won't find this stuff in guidebooks, so become a part of his network.

 Subscribe to the newsletter

 Subscribe to

### Our Blog

Get your daily dose of healthcare tech insights with the Vitamin blog.

[![Vitamin Software logo](https://vitaminsoftware.com/hubfs/logo--text-orange.svg "Vitamin Software logo")](https://www.vitaminsoftware.com/)

### Navigation

- [Home](https://vitaminsoftware.com)
- [Compliance and Security](https://vitaminsoftware.com/healthcare-compliance-and-security)
- [Services](https://vitaminsoftware.com/services)
- [Clients](https://vitaminsoftware.com/clients)
- [Knowledge base](https://vitaminsoftware.com/blog)
- [About](https://vitaminsoftware.com/about-us)
- [Contact us](https://vitaminsoftware.com/contact-us)
- [Project Manager Breakfast Club](https://vitaminsoftware.com/breakfast-club)

#### Latest articles

- [2024 NIST Guide for HIPAA-Compliant Software](https://vitaminsoftware.com/blog/examining-the-2024-nist-guide-for-hipaa-compliant-software)
- [AI Regulations in Healthcare](https://vitaminsoftware.com/blog/what-ai-regulations-should-your-healthcare-software-follow)
- [Managing Healthcare Project Timelines](https://vitaminsoftware.com/blog/navigating-project-timelines-in-healthcare-software-development)
- [Executive Reporting Guide for PMs](https://vitaminsoftware.com/blog/updating-health-tech-leaders-executive-report-template)
- [Key TEFCA Takeaways for Developers](https://vitaminsoftware.com/blog/epic-tefca-alignment-key-takeaways-for-development-companies)

#### Contact

- 404 Error
- 500 Error
- Email subscription preferences
- Unsubscribe backup pages
- Subscription update confirmation
- Password Prompt
- Search Results

---

- Terms and Services
- Privacy Policy

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Andjela Markovic",
    "url" : "https://vitaminsoftware.com/blog/author/andjela-markovic"
  },
  "dateModified" : "2024-07-10T13:52:20.114Z",
  "datePublished" : "2024-04-23T20:22:26.000Z",
  "headline" : "Examining the 2024 NIST Guide for HIPAA-Compliant Software",
  "image" : [ "https://vitaminsoftware.com/hubfs/blog%20and%20newsletter%20covers/17.png" ],
  "mainEntityOfPage" : {
    "@id" : "https://vitaminsoftware.com/blog/examining-the-2024-nist-guide-for-hipaa-compliant-software",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://vitaminsoftware.com/hubfs/logo--text-orange.svg"
    }
  }
}
```