No government agency certifies HIPAA compliant DME software, and HHS does not recognize private HIPAA certifications. What you can verify is whether a vendor signs a business associate agreement, holds an independent audit such as SOC 2, and logs user activity. Brightree and NikoHealth both publish SOC 2 statements, and NikoHealth documents an audit log of all user activity.
What “HIPAA Compliant DME Software” Really Means
HHS states that it “does not endorse or otherwise recognize private organizations’ ‘certifications’ regarding the Security Rule” (HHS FAQ on Security Rule certification). Compliance belongs to your organization. The vendor’s part is to protect the data it holds for you, under a signed business associate agreement (HHS on business associate contracts).
What HIPAA Requires for Audit Trails
The Security Rule’s audit controls standard requires mechanisms “that record and examine activity in information systems” containing electronic patient data (45 CFR 164.312). A useful audit trail shows who opened or changed a record, what changed, and when, and it can be exported for an investigation.
What to Verify With Any Vendor
Safeguard | What to verify | Evidence to ask for |
Business associate agreement | Signed before any patient data moves | The signed agreement |
Independent audit | SOC 2 scope covers the application you will use | The current report, under NDA |
Audit log | Records views and edits by user | A sample export |
Access control | Permissions by role and user | A live permissions demo |
Encryption | Data protected in transit and at rest | Security documentation |
Partner access | Integrations see only the data they need | A list of connected partners and their scope |
Software cannot do your risk analysis, train your staff, or review the logs for you. This HIPAA compliance checklist for DME providers covers those steps, and our cloud-native vs. server-based FAQ explains how hosting changes who runs backups.
Where Platforms Stand
Brightree states its business management software is “SSAE-18 SOC2 compliant” with annual compliance and security audits.
NikoHealth’s security and compliance page lists SOC 2 Type II, ISO 27001, and HIPAA compliance, AES-256 encryption in transit and at rest, per-user permissions, and a reportable audit log of all activity. It signs a BAA on request, and its partner access rules limit each integration to the data it needs.
