Check business associate devices for HIPAA security reviews.
The proposed HIPAA Security Rule would change business associate verification requirements. PosturePass replaces paper attestations with a check at every login.
HIPAA Security Rule NPRM (Jan 2025). The proposal would change technical-safeguard verification and encryption requirements.
What PosturePass makes possible
What one PosturePass check covers
6 checks
against your security policy
Verify the device, not the paperwork
PosturePass checks six security settings at sign-in. The result feeds your access policy.
Export
from the dashboard or API
Support proposed HIPAA verification requirements
Every check writes a timestamped record. Export records to support reviews of the proposed annual technical-safeguard verification requirements.
About 5 min
typical installation time
Onboard BAs without enrolling them in MDM
BAs install a lightweight check, not an MDM profile. They keep their own device. Most self-remediate without a help-desk ticket.
Your situation
Common starting points
Privacy Officer / Compliance
I need defensible evidence for the next OCR audit
The proposed rule calls for written technical-safeguard verification. PosturePass produces device-check records to support evidence reviews.
See the audit evidenceCISO / Security Architect
I need to verify devices I don't manage
Business associates and external clinicians touch ePHI from devices outside your control. See what PosturePass verifies and how it plugs into Entra Conditional Access.
See the architectureThird-Party Risk Manager
I need to plan for proposed annual BA verification
The proposed rule calls for annual BA verification. PosturePass runs device checks at sign-in, then every hour.
See the workflowThree steps
How PosturePass verifies a BA device before ePHI access.
The BA signs in as they do today. PosturePass runs the check, posts the result to your access policy, and logs it.
BA attempts to access your portal
PosturePass checks the device during sign-in through Microsoft Entra ID or Okta. No corporate enrollment is required.
Device posture is verified in seconds
Encryption, anti-malware, firewall, OS patch level, screen lock. If something fails, the BA gets guided steps to fix it before reaching ePHI.
Evidence is logged automatically
Every check produces a timestamped record: BA, device, controls, result, remediation. Export records to support reviews of the proposed annual verification requirements.
The regulatory shift
The proposed rule would move business associate oversight from "documented" to "verified."
The January 2025 NPRM proposes Security Rule changes. Three proposed provisions address BA oversight.
§164.308
Proposed annual written verification
The proposal would require covered entities to obtain annual written verification of business associates' technical safeguards.
§164.312
Proposed encryption requirements
The proposal would require encryption of ePHI at rest and in transit, with limited exceptions. It would remove the addressable approach to encryption.
§164.306
Proposed annual compliance audits
The proposal would require covered entities and business associates to conduct documented compliance audits at least annually.
Why not just…
Compare approaches against proposed verification requirements.
The proposal would shift emphasis toward verification of business associates' technical controls. Several common approaches focus on documentation instead.
| Approach | Where it breaks |
|---|---|
| Annual paper attestations from each BA | Documents intent, not implementation. May not address the proposed technical-safeguard verification requirements. |
| Vendor risk questionnaires (Vanta, OneTrust, etc.) | Captures policy, not actual device state. Doesn't verify deployed safeguards. |
| Issue managed devices to all BAs | Cost-prohibitive at scale. BAs typically refuse to swap their working device. |
| Force BAs into your MDM (Intune, Jamf) | BAs reject enrollment of personal devices. Onboarding slows from minutes to weeks. |
| VDI / virtual desktop access only | Expensive licenses, degraded UX, and no insight into the underlying device. |
| Enterprise browser (Island, Talon) | Higher cost than needed. Forces a browser change. Not a posture-verification product. |
| PosturePass | $2.50 to $5 per user per month, depending on volume. No MDM. Works through Entra ID or Okta and creates an audit record for each check. |
Timing
Timing for the proposed rule
Review the proposed requirements when planning business associate verification. This timeline does not assume a final-rule date or compliance deadline.
January 2025
HHS publishes NPRM
First major Security Rule update since 2013. About 5,000 public comments submitted by March.
Proposal review
Review proposed requirements
Review the proposal without assuming a final-rule date or compliance deadline.
Proposed requirements
Annual BA verification proposal
The proposal includes annual business associate technical-safeguard verification.
Typical rollout
Policy, pilot, phased migration
A typical rollout takes about 12 weeks and includes a free 30-day pilot.