HIPAA and Medical Device Manufacturers

Why this matters

HIPAA enforcement against Business Associates is no longer rare. HHS OCR's Annual Report to Congress on HIPAA Privacy, Security, and Breach Notification Rule Compliance shows year-over-year growth in Business Associate enforcement actions and settlement amounts, with several seven-figure resolutions against vendors whose products touched PHI on behalf of a hospital. The 2024 Change Healthcare incident, the largest healthcare breach on record, was a Business Associate failure, not a Covered Entity failure, and it is the proximate cause of the January 6, 2025 NPRM (90 FR 898).

At the same time, the FDA's Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (Feb 3, 2026 final guidance) and Section 524B of the FD&C Act formalize cybersecurity as a clearance gate. Manufacturers are now squeezed from two directions: the FDA on safety and effectiveness, OCR on PHI. Hospitals enforce both through procurement using MDS2 (the HSCC-aligned Manufacturer Disclosure Statement for Medical Device Security) and the Joint Security Plan.

Official sources: FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026); HHS HIPAA for Professionals; FDA Cybersecurity resources for medical devices.

Does HIPAA apply to medical device manufacturers?

In most cases, not directly. HIPAA applies to Covered Entities (health plans, healthcare clearinghouses, and most healthcare providers) and to Business Associates (vendors that create, receive, maintain, or transmit PHI on behalf of a Covered Entity). A medical device manufacturer selling a standalone device into a hospital is typically neither.

You cross the line into Business Associate status when:

• Your cloud backend ingests, stores, or processes PHI generated by the device on the hospital's behalf
• You provide a remote monitoring service, managed analytics, or hosted reporting
• You operate a patient portal or companion app that handles PHI as a service to the provider
• You host or administer infrastructure where PHI lives

Selling a device that creates PHI used only inside the hospital's own infrastructure does not, by itself, make you a Business Associate. The triggering question is always "are you handling PHI on behalf of a Covered Entity?" If yes, you need a Business Associate Agreement (BAA) and you owe the full HIPAA Security Rule, Breach Notification Rule, and applicable Privacy Rule provisions.

The three indirect ways HIPAA reaches manufacturers

Even when HIPAA does not apply directly, it shapes the manufacturer's obligations through three predictable channels.

1. Business Associate exposure through the cloud backend

The moment a connected device sends PHI to a manufacturer-operated cloud, you are a Business Associate. The Security Rule then applies in full: administrative safeguards (§164.308), physical safeguards (§164.310), and technical safeguards (§164.312), plus Breach Notification (§164.410) requiring you to notify the Covered Entity without unreasonable delay and in no case later than 60 days after discovery.

2. Procurement gating via MDS2 and the HSCC Joint Security Plan

Hospitals must comply with HIPAA, and they extend that obligation to vendors through procurement. The MDS2 questionnaire is a HIPAA Security Rule checklist in everything but name, covering unique user IDs, automatic logoff, audit controls, encryption, transmission security, and emergency access. The HSCC Joint Security Plan formalizes the same expectations for the device lifecycle. A device that cannot support these controls cannot be deployed in a way that lets the hospital meet its HIPAA obligations, which means the hospital cannot buy it.

3. The January 6, 2025 HIPAA Security Rule NPRM

The proposed update at 90 FR 898 raises the floor for every Business Associate and, by extension, every device whose backend touches PHI. The controls become prescriptive, not "addressable." See the next section.

HIPAA Security Rule controls that map to device design

The §164.312 technical safeguards translate almost one-for-one into device design requirements:

These map directly onto the FDA's expectations in the Feb 3, 2026 guidance, which means the same control evidence (test reports, design documentation) typically serves both regulators if it is written for that purpose from the start.

What changes under the 2025 HIPAA Security Rule NPRM

The HHS Notice of Proposed Rulemaking published January 6, 2025 (90 FR 898) is the most significant Security Rule update since 2013. If finalized as proposed, the headline changes for device manufacturers operating as Business Associates include:

See also: 510(k) Cleared, No Postmarket Cybersecurity: Legal?, De-identification vs Anonymization: HIPAA & GDPR, and Medical Device Data Sovereignty: HIPAA, GDPR, and Hospital Reviews.

• Encryption becomes mandatory, not "addressable." Encryption at rest and in transit for all ePHI, with limited exceptions.
• Multi-factor authentication required for access to systems containing ePHI.
• Annual penetration testing and vulnerability scanning with documented remediation.
• asset inventory and network map maintained and updated.
• Network segmentation required to limit lateral movement.
• Contingency-plan activation notification: the NPRM proposes BA notification to the covered entity within 24 hours of activation of the BA’s contingency plan, not within 24 hours of every security incident.
• Written verification annually from Business Associates that their safeguards meet Security Rule requirements, signed by a person with authority.
• Contingency planning with 72-hour restoration targets for critical systems.

For a manufacturer acting as a BA, the NPRM’s proposed contingency-plan activation notice and annual safeguard verification would add administrative duties distinct from FDA cybersecurity documentation. The 24-hour proposal is not a general BA incident clock.

HIPAA vs FDA cybersecurity: where they overlap and where they don't

The control families overlap heavily. The documentation, the auditor, and the enforcement consequence do not. Treating one set of evidence as sufficient for both is the recurring mistake.

Talk to us about your HIPAA and FDA cybersecurity strategy →

Breach notification: dual obligations to OCR and the FDA

A single cybersecurity event involving a connected device can trigger:

• HIPAA Breach Notification Rule: notify affected individuals without unreasonable delay and within 60 days for breaches of unsecured PHI. Covered entities notify HHS within 60 days for breaches affecting 500 or more individuals; smaller breaches are logged and reported within 60 days after the calendar year ends. Media notice applies when more than 500 residents of a state or jurisdiction are affected.
• FDA postmarket reporting under 21 CFR 803 if the event caused or could have caused death or serious injury (a ransomware event that delays therapy can qualify).
• Coordinated vulnerability disclosure under the FDA's postmarket cybersecurity guidance and CISA's CVD framework.
• State breach notification laws, which vary and sometimes have shorter clocks than HIPAA.
• Under the 2025 NPRM, a BA would notify the covered entity within 24 hours of activating its contingency plan, not of every reportable security incident.

The playbook needs to be written before the event, and it needs to live in both the Security Risk Management File (for the FDA) and the HIPAA incident response plan (for OCR).

How Blue Goat approaches HIPAA for medical device manufacturers

Blue Goat Cyber's medical device practice is led by engineers with CISSP, OSCP, and prior military red-team backgrounds. For HIPAA-adjacent engagements we map every PHI flow to both regimes: the FDA's threat model, Security Architecture Views, and labeling on one side, and the HIPAA Security Rule's §164.308/310/312 safeguards on the other. The same control evidence (encryption design, audit logging, access control) is produced once and used twice.

For manufacturers operating cloud backends, we build the Business Associate posture against the 2025 NPRM baseline, not the 2013 baseline, because that is where enforcement is heading. See our medical device cybersecurity services for scope. If the FDA raises a cybersecurity question, we answer it at no extra cost until the cybersecurity portion is closed.

If HIPAA applies to your product, our HIPAA compliance program for MedTech covers the policies and evidence you need.

FAQ

Is a medical device manufacturer a Covered Entity under HIPAA?

Almost never. Covered Entities are health plans, healthcare clearinghouses, and most healthcare providers. A device manufacturer becomes a Business Associate, not a Covered Entity, when it handles PHI on behalf of a Covered Entity. Selling a device that creates PHI used only inside the hospital does not, by itself, make the manufacturer a Covered Entity or a Business Associate.

When does a manufacturer become a Business Associate?

The trigger is handling PHI on behalf of a Covered Entity. Operating a cloud backend that ingests PHI from the device, providing remote monitoring as a service, hosting a patient portal, or running managed analytics all create Business Associate status. The day data starts flowing is the day the obligation begins, with or without a signed BAA.

What is the 2025 HIPAA Security Rule NPRM?

The January 6, 2025 NPRM proposes stronger safeguards, including encryption, MFA, inventories, testing, and BA notification within 24 hours of contingency-plan activation. It does not propose a universal 24-hour incident-reporting deadline. Verify final-rule status and effective dates before treating proposed provisions as obligations.

Does HIPAA require encryption today?

Under the existing Security Rule, addressable encryption specifications require a documented assessment of whether implementation is reasonable and appropriate. Implement them if so; otherwise document why and implement an equivalent alternative if reasonable and appropriate. Addressable does not mean optional. The 2025 NPRM proposes required encryption with limited exceptions.

How does HIPAA relate to the FDA's Feb 2026 cybersecurity guidance?

The two regimes overlap in control families (risk analysis, access control, audit logging, encryption, incident response) but have different enforcers, documentation audiences, and consequences. HIPAA protects PHI and is enforced by HHS OCR. The FDA's guidance protects device safety and effectiveness and is enforced by CDRH. Manufacturers operating cloud backends typically need to satisfy both, and the evidence can be produced once if planned that way.

What happens if my device has a breach?

For a breach of unsecured PHI, assess individual, HHS, and media notice separately under 45 CFR 164.404, 164.406, and 164.408; BA notice to the covered entity follows 164.410. Assess FDA reporting independently using the death, serious injury, and qualifying malfunction criteria in 21 CFR 803.50. The NPRM’s proposed 24-hour BA notice concerns contingency-plan activation, not every incident.

CTA

Building a connected device with a cloud backend, or already getting hospital security questionnaires you cannot answer? We build the HIPAA Business Associate posture against the 2025 NPRM baseline and align it with your FDA cybersecurity documentation so the same evidence serves both regulators. Schedule a discovery session →