The three rules in 60 seconds
HIPAA has three operationally relevant rules:
- The Privacy Rule — how protected health information (PHI) may be used and disclosed
- The Security Rule — the safeguards that must protect electronic PHI (ePHI)
- The Breach Notification Rule — what you must do if PHI is exposed without authorization
Small-agency HIPAA, in practice, is mostly about the Security Rule and the Breach Notification Rule. The Privacy Rule shapes your forms and your consents; the Security Rule shapes your software and operations.
The Security Rule, broken down
The Security Rule requires administrative, physical, and technical safeguards. In small-agency terms:
Administrative safeguards
- A designated security officer (this is a role, not necessarily a full-time job)
- Workforce training on PHI handling
- Access management — who gets access, how, when removed
- Sanctions for policy violations
- Periodic risk assessments
Physical safeguards
- Workstation and device security — including how staff handle laptops at home
- Facility access controls
- Disposal procedures for media containing PHI
Technical safeguards
- Access control (unique user IDs, automatic logoff, encryption)
- Audit controls — system activity recorded
- Integrity controls — protection from improper alteration or destruction
- Transmission security (encryption in transit)
The technical safeguards are usually where small agencies are most exposed — because they depend on the software you use. Software that handles PHI without encryption, without access logging, or with shared accounts is a compliance liability you can't easily fix from the outside.
What a Business Associate Agreement actually does
A Business Associate Agreement (BAA) is the contract between your agency (the "covered entity") and any vendor that handles PHI on your behalf (the "business associate"). It's required by HIPAA, and it does three things:
- Establishes the vendor's responsibility for safeguarding PHI
- Sets breach notification obligations running from the vendor to you
- Limits the vendor's permitted uses of PHI to what your contract authorizes
If you use a software product that touches PHI and the vendor won't sign a BAA, that's a hard stop. You can't be compliant using their product, regardless of how secure their marketing claims to be.
CozziTech signs BAAs for every product that touches PHI. This isn't unusual — it's the floor. Use it as a screening test for any vendor you evaluate.
What "HIPAA-compliant software" really means
"HIPAA-compliant" is a marketing phrase that doesn't have a legal definition. What you actually want from a HIPAA-aware software product is:
- Encryption of PHI at rest and in transit. Both. Not just one.
- Role-based access controls with least-privilege defaults.
- Audit trails on every access and modification of PHI, including the identity of the accessing user, the time, and the action.
- Account lifecycle management — accounts can be created, modified, and de-provisioned with auditable records.
- Session controls — automatic logoff, session expiration.
- A signed BAA.
- Documented incident response — what the vendor does if something happens.
This is exactly what we build into every CozziTech product. HIPAA-compliant software isn't a feature — it's the posture.
Breach notification, the part nobody plans for
If PHI is exposed without authorization, the Breach Notification Rule kicks in. For breaches affecting more than 500 individuals, you have to notify HHS, the affected individuals, and (in some cases) the media — and you have hard deadlines.
The small-agency advice is: have a plan before you need one. Know who you call, what you say, and what the timeline looks like. Most agencies write the plan once, review it annually, and never need it. The agencies that do need it are very glad they have it.
An audit posture you can actually sustain
Small agencies usually can't dedicate a full-time compliance role. What you can do, sustainably, is build a quarterly rhythm:
- Q1: Review access — who has access to what, do we still need it, anyone leave?
- Q2: Review vendor BAAs — are they all current? Any new vendors that need one?
- Q3: Refresh workforce training
- Q4: Risk assessment & policy review
Four small reviews a year, each of which is an afternoon's work for a designated security officer, beats one annual fire drill. And it produces the artifact trail an auditor — or a breach investigator — will want to see.
The bottom line
HIPAA for small agencies is more manageable than the acronym soup suggests. Pick software that handles the technical safeguards by default. Sign BAAs with every vendor that touches PHI. Train your workforce. Have a breach plan. Review quarterly.
Do those five things and you'll be in better shape than most agencies your size.