Is IRB Submission Software HIPAA Compliant? Here’s How to Check

IRB submission software can support HIPAA obligations, but there is no single federal “seal” that makes a product compliant by default. Compliance depends on how the software is built, where it runs, how it’s configured, and how you use it with Protected Health Information (PHI). Use the steps below to evaluate a vendor against the HIPAA Security Rule and your organization’s risk posture.

Review Compliance Certifications

Start by validating independent attestations. While there is no official HIPAA certification, recognized frameworks demonstrate maturity and provide evidence that controls align with the HIPAA Security Rule.

What to look for

• HITRUST CSF certification (r2) covering the specific product and its hosting environment, not just corporate offices.
• SOC 2 Type II with explicit HIPAA mapping and a recent reporting period; confirm the scope includes application, infrastructure, and key subprocessors.
• ISO/IEC 27001 for the ISMS, optionally paired with 27017/27018 (cloud and PII) and 27701 (privacy), showing governance over Data Access Controls and Data Encryption Standards.
• For public-sector contexts, FedRAMP Moderate/High can indicate strong baselines (not a HIPAA substitute).
• Cloud Hosting Compliance evidence: a current BAA with the cloud provider and a list of HIPAA-eligible services actually used.
• Recent independent penetration test results and documented vulnerability management SLAs.

Questions to ask

• Which certifications cover the production IRB submission service, and when do they expire?
• Do reports include controls for encryption in transit/at rest, key management, logging, and access governance?
• Are gaps noted, and have corrective actions been completed?

Examine Data Handling Practices

Compliance hinges on what data the software touches and how. Map real workflows to confirm whether PHI is created, received, maintained, or transmitted.

Key checks

• Scope PHI precisely: protocol attachments, recruitment lists, waiver documentation, e-consent artifacts, and correspondence can all contain PHI or a limited data set.
• Apply the minimum necessary standard: restrict collection, fields, and visibility so users only see what they need.
• De-identification options: determine if the product supports safe-harbor removal or expert-determination workflows when feasible.
• Retention and deletion: verify configurable retention periods, secure deletion on schedule and on request, and sanitized logs and backups.
• Subprocessors and support: confirm support channels for sensitive data, redaction tools, and whether vendors prohibit PHI in tickets and email.
• Environment separation: ensure no PHI is copied into dev/test environments without equivalent safeguards.

Assess Data Residency and Hosting

Where data lives and moves matters. Confirm the hosting model and the jurisdictions governing storage, backups, and disaster recovery replicas.

Cloud Hosting Compliance essentials

• Region control: ability to pin PHI storage to U.S. regions if required by policy or sponsor agreements.
• Service inventory: only HIPAA-eligible cloud services are used, and all are covered by a cloud BAA.
• Replication and backups: documentation of where databases, object storage, search indices, logs, and snapshots reside.
• Encryption and keys: encryption at rest with strong Data Encryption Standards (for example, AES-256), plus options for customer-managed keys or HSM-backed KMS.
• Network isolation: virtual private cloud segmentation, private connectivity, and restricted administrative access pathways.
• Business continuity: defined RTO/RPO, regional failover design, and periodic DR testing with results available on request.

Evaluate Business Associate Agreements

If the vendor creates, receives, maintains, or transmits PHI on your behalf, you need a Business Associate Agreement (BAA). Marketing claims do not replace a signed BAA with enforceable terms.

BAA must-haves

• Permitted uses and disclosures clearly limited to delivering the IRB submission service and support.
• Downstream obligations requiring subcontractors to sign equivalent BAAs and follow the same safeguards.
• Breach notification timelines, incident cooperation, and responsibilities for investigation and mitigation.
• Return or destruction of PHI at contract end, with verification that backups and logs are addressed.
• Safeguards that reflect the HIPAA Security Rule: risk analysis, access management, audit logging, and encryption.
• Right to audit or receive third-party audit results; evidence of security training and background checks.
• Appropriate insurance coverage to back contractual promises.

Note that some research workflows may use de-identified data or a limited data set under a Data Use Agreement, but once PHI is involved the BAA becomes central to your compliance posture.

Understand Software Role in Data Processing

Clarify how the IRB submission platform processes data so you can assign obligations correctly and minimize risk.

Points to confirm

• Role and purpose: whether the vendor acts as a Business Associate (processing PHI) or only handles de-identified data.
• Feature implications: e-consent, document storage, messaging, and review notes can all carry PHI—configure features accordingly.
• Integrations and APIs: ensure secure connectors to identity providers, research systems, or EHRs; verify token scopes and IP restrictions.
• Analytics and product improvement: confirm PHI is excluded from telemetry and not used to train models without explicit agreements.
• Export and reporting: control who can export records, enforce watermarks, and log every export event.
• Change management: how updates are tested and deployed without exposing PHI, including segregation of duties.

Verify Security Measures

Strong, well-documented controls protect PHI and demonstrate day-to-day adherence to the HIPAA Security Rule.

Data Encryption Standards

• Transport: TLS 1.2+ with modern cipher suites and perfect forward secrecy.
• At rest: AES-256 (or equivalent) for databases, file storage, search indices, and backups.
• Key management: centralized KMS/HSM, key rotation policies, and options for customer-managed keys.

Data Access Controls

• SSO via SAML or OIDC, enforced MFA, strong session management, and device posture checks where applicable.
• Granular RBAC/ABAC with least-privilege defaults, just-in-time access for admins, and documented break-glass procedures.
• Comprehensive privilege audit reports and automated deprovisioning tied to your identity lifecycle.

Operational security

• Continuous vulnerability scanning, timely patching SLAs, and annual third-party penetration tests.
• Secure SDLC with code review, secrets management, SAST/DAST, and supply-chain controls.
• Network protections: WAF, rate limiting, DDoS mitigation, and isolation of management planes.
• Incident response playbooks with tested tabletop exercises and clear customer communication paths.
• Device and media controls restricting local storage, clipboard use, and bulk exports where feasible.

Monitor Audit Trails

Audit Trail Requirements are essential for HIPAA’s “information system activity review.” You need reliable, tamper-evident records of who accessed what, when, and how.

What a good audit trail includes

• Immutable, time-synchronized logs for logins, view/edit/delete events, permission changes, data exports, API calls, and failed access attempts.
• User attribution that ties every action to a verified identity (not shared accounts) and records source IP or device details.
• Configurable retention aligned to policy, with secure, write-once storage options and backup of logs.
• Real-time monitoring and alerts, plus SIEM integration for correlation with network and endpoint telemetry.
• Easy export for investigations and sponsor audits, and support for accounting of disclosures where applicable.

Conclusion

No IRB submission software is “HIPAA compliant” in isolation. Compliance emerges when a capable product, Cloud Hosting Compliance, and your operational safeguards fit together. Validate certifications, map PHI flows, pin down residency, lock in a strong Business Associate Agreement, verify technical controls, and ensure complete auditability. Do that, and you can confidently use IRB submission software while meeting HIPAA Security Rule expectations.

FAQs.

What certifications indicate HIPAA compliance for software?

There is no official HIPAA certification. Instead, look for HITRUST CSF certification, SOC 2 Type II with HIPAA mapping, and ISO/IEC 27001 (often with 27017/27018 and 27701). These attestations, combined with evidence of Data Encryption Standards, Data Access Controls, and Cloud Hosting Compliance, show the vendor’s controls align with the HIPAA Security Rule.

How does a Business Associate Agreement affect HIPAA compliance?

A Business Associate Agreement makes the vendor contractually responsible for safeguarding PHI and following HIPAA’s rules. It sets permitted uses/disclosures, requires downstream BAAs for subcontractors, defines breach notification timelines, and ensures PHI is returned or destroyed at the end of the engagement.

What security measures are required for HIPAA compliance?

HIPAA mandates administrative, physical, and technical safeguards. Practically, expect encryption in transit and at rest, strong identity and access management (SSO, MFA, RBAC/ABAC), logging and monitoring with robust audit trails, vulnerability management, incident response, and secure development and change controls that match the HIPAA Security Rule.

Is data residency important for HIPAA compliance?

Yes. You should know exactly where PHI is stored, replicated, and backed up. Many organizations require U.S.-only residency and HIPAA-eligible cloud services under a cloud BAA. Residency, combined with encryption and access controls, is a core part of Cloud Hosting Compliance.