Healthcare Software Compliance: Common Gaps and Fixes

Healthcare software teams rarely fail compliance on purpose. They fail because the recurring work, such as policy reviews, access reviews, vendor BAAs and incident drills, lives in tickets, shared drives and inboxes with no owner and no date. The fix for nearly every gap below is the same: turn each obligation into a dated task with a named owner and a clear definition of the evidence it leaves behind.

This guide covers seven common gaps in providers, payers and health tech vendors, and what to do about each.

This article is general information, not legal advice. What applies to you depends on your organisation, product, data and jurisdiction.

Start by deciding what "compliance" covers for you

Healthcare software compliance mixes three things: regulations, security frameworks and promises you've made in contracts. Teams get caught out when they manage one layer, usually HIPAA policies, and forget the others, like a vendor renewal or how long evidence must be kept.

In the US, the usual anchors are:

• the HIPAA Privacy and Security Rules, which apply to covered entities and their business associates (see the HHS Security Rule overview)
• the HIPAA Breach Notification Rule, which sets hard deadlines once a breach is discovered
• FDA device rules, if your software meets the definition of a medical device
• CMS, payer and accreditation requirements, plus whatever your BAAs and customer contracts add on top

Write down which apply, then link each one to the systems and records that prove you meet it.

Once the scope is written down, most "surprise" findings turn out to be predictable process failures.

Gap 1: Nobody can say which systems hold PHI

You'll recognise this one. Answering "which systems store or send PHI?" takes a week of Slack messages. Integrations with the EHR, billing, scheduling and analytics tools keep growing, and nobody has drawn the data flows. There's a software list, but it isn't tied to owners, vendors or renewal dates.

You can't protect what you can't list. And the HIPAA Security Rule makes risk analysis a required step, which HHS describes as an ongoing process. You can't analyse risk on systems you don't know about. Inventory gaps lead straight to missing BAAs, unmanaged access and patchy retention.

Fix it with a working inventory, not a perfect one. For each system, record:

• system name, business owner and technical owner
• vendor, with links to the contract and BAA
• what data it holds (PHI, other personal data, financial, internal)
• its main integrations
• renewal dates and how much notice each contract needs

Then pick the three workflows that touch the most PHI, say patient intake, a telehealth visit and billing, and trace which systems each one touches.

Gap 2: Policies exist, but nobody controls their review

Policies sit in a shared drive. Review dates slip. There are three "final" versions, training quotes the old wording, and leadership approval happened in a hallway.

A policy is a control, so it has to be current, approved and provable. HIPAA requires you to keep policies and procedures, and records of the actions they require, for six years from creation or the date they were last in effect, whichever is later. The same section says to review them periodically. Customer security questionnaires ask for the same proof.

Fix it by giving every policy a lifecycle with dates and proof:

• Name a policy owner and a backup.
• Set a review date. Annual suits most policies, and high-risk areas may need more.
• Require approval by a role, not a person, so it survives staff changes.
• Keep the evidence: minutes, a sign-off record, a ticket ID or an e-signature.
• Tie training and staff acknowledgements to the version number.

Gap 3: Access drifts until an audit or an incident finds it

Former staff still have accounts. A shared login was set up "temporarily" two years ago. Admin rights spread one exception at a time, and MFA is on in some systems but not others.

Access drift turns an ordinary mistake into a reportable incident. It's also easy for auditors to test and hard to explain. The Security Rule asks for procedures to end access when someone leaves and to regularly review records of system activity.

Two controls do most of the work. First, a joiner, mover and leaver process covering account creation, role changes, termination and emergency access. Second, a scheduled access review of high-risk systems that leaves a record.

Gap 4: BAAs and vendor reviews live in email

Some vendors have no BAA, or nobody knows where it is. Security questionnaires get filled in and lost. A SOC 2 report arrives, gets read once and vanishes. Contracts auto-renew without anyone checking whether the vendor's security has changed.

HHS lets you share PHI with a business associate only once you have satisfactory written assurances, normally a BAA. A missing one is a finding on its own, however good the vendor's security is.

Treat each vendor as a set of renewable obligations. For every vendor that touches PHI or supports critical operations, track:

• contract and BAA start dates
• renewal date and the notice window for cancelling
• what they owe you each year: SOC 2 report, pen test summary, insurance certificate, list of subcontractors
• an owner, and who it escalates to

A SaaS contract with a 60-day cancellation window needs its first reminder well before that window opens, so there's time to review the vendor's latest SOC 2 report and decide.

Gap 5: Evidence is scattered, so every audit is a rebuild

Proof lives in inboxes, tickets and someone's downloads folder. The "real" evidence is a screenshot taken last year. You did the work, but you can't show it quickly.

Decide what evidence each recurring task must leave, and attach it when the task is closed. For example:

• Annual risk analysis: final report attached, reviewer's approval noted.
• Incident response tabletop: attendees, scenario notes and follow-up actions attached.
• Vendor review: SOC 2 report stored, exceptions noted, fixes raised as tasks.

Run a monthly audit drill. Pick 10 obligations at random and time how long it takes to produce the evidence. If it takes hours, you have a system problem, not a people problem. Our piece on document retention deadlines covers how long to keep it.

Gap 6: Changes ship without a record of who approved them

Releases go out fast, but nobody can show who approved what. Security review happens on some changes and not others. Emergency fixes skip the process and never get written up afterwards.

HIPAA doesn't prescribe a development process. Healthcare buyers still expect you to manage change responsibly, especially when software touches clinical workflows or PHI, and their due diligence questionnaires will ask.

What helps is a short change record for regulated systems. You don't need bureaucracy. You need to be able to answer six questions: what changed, why (ticket or requirement), what's the risk to PHI or uptime, who approved it, when it went live, and how you'd roll it back.

Gap 7: The incident plan has never been tested

The incident response plan is a PDF nobody has practised. The contact list is out of date. Legal, compliance, IT and leadership each think someone else sends the breach notices.

Here the deadlines are fixed by law. Under the Breach Notification Rule, you must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach. If 500 or more people are affected, you must tell HHS within the same 60 days, and the media too if more than 500 residents of one state are involved. Smaller breaches go to HHS within 60 days of the end of the calendar year. The HHS breach portal lists the large ones publicly.

Run incident readiness as recurring work, like any other renewal:

• a tabletop exercise each quarter on a realistic scenario
• a monthly check of on-call and escalation contacts
• a first-24-hours checklist: contain, preserve evidence, brief internally
• a follow-up checklist: root cause, corrective actions, the notification clock

If you only work on incident response after an incident, you'll be learning the process while the 60-day clock runs.

The seven gaps on one page

Close the biggest gaps in 30 days

You're not aiming for perfect. You're aiming for recurring work that's owned, scheduled and provable.

Where ExpiryEdge fits

Every gap above comes back to dated work with no system behind it. ExpiryEdge for healthcare tracks the dates: BAAs and vendor contracts, policy and access review cycles, staff licences and certificates. It reminds the owner by email, SMS, WhatsApp, Slack or Teams and escalates overdue items to a manager.

It can also request the renewed document, a vendor's new SOC 2 report or insurance certificate say, and file it against the obligation, with an audit trail you can export. It isn't a full GRC platform or an access management tool. It's the part that makes sure recurring work happens on time and leaves proof.

Whatever tool you use, aim for this: every obligation has an owner, a date, a checklist and attached evidence. That's when audits stop being reconstruction and become retrieval. To test it on your own list, start a 14-day free trial (no credit card) and import your vendor register first.