Is Theranostics Dosimetry Software HIPAA Compliant?

Theranostics dosimetry software may be used in a HIPAA-compliant way, but the software is not automatically HIPAA compliant just because it is designed for healthcare or used to calculate patient-specific radiation doses. Compliance depends on the information it handles, the vendor’s role, the safeguards and agreements in place, and how your organization deploys and uses it.

Before entering patient data, assess the full workflow with your privacy and security teams. The key question is whether the software and everyone involved in its data flows appropriately protect protected health information (PHI) and electronic protected health information (ePHI).

Does theranostics dosimetry software handle protected health information?

It can. Dosimetry results, imaging data, treatment details, and related records may be PHI when they are identifiable and handled by a HIPAA-regulated organization. The same information in electronic form may be ePHI when it is maintained or transmitted electronically.

Whether a particular data set is PHI depends on its content and context—not simply on the fact that it contains radiation measurements. Patient names, medical-record numbers, or other identifiers linked to treatment information can make records identifiable. Removing obvious identifiers does not automatically establish that information has been de-identified under HIPAA.

Map the information the software receives, generates, stores, displays, and transmits. Include imaging files, dose calculations, user accounts, support records, and logs where applicable. HHS’s HIPAA Security Rule summary explains that the Rule protects ePHI maintained or transmitted electronically.

What HIPAA safeguards apply to dosimetry software deployments?

The HIPAA Security Rule requires covered entities and business associates to use reasonable and appropriate administrative safeguards, physical safeguards, and technical safeguards to protect ePHI. The safeguards must address confidentiality, integrity, and availability, and be appropriate to the organization’s size, infrastructure, and risks. HIPAA does not prescribe one identical software configuration for every deployment. HHS’s Security Rule summary describes these requirements and the Rule’s flexible, risk-based approach.

For a dosimetry workflow, the organization’s risk analysis might examine who can access patient records, how access is authenticated, whether activity can be reviewed, how information is protected during storage and transmission, and how backups and recovery are handled. These are practical areas to assess, not a complete checklist that applies identically to every organization.

Administrative safeguards also matter: assign responsibility for security, manage workforce access, document policies and procedures, and periodically evaluate whether protections remain appropriate. The organization remains responsible for its own HIPAA obligations even when it uses a vendor’s software.

How do hosting and data flows affect HIPAA compliance?

Deployment architecture can determine which vendors receive, maintain, or transmit ePHI. A locally installed application may involve different data flows from a hosted service, but local installation alone does not establish compliance. Remote troubleshooting, backups, telemetry, integrations, or support access may also bring a vendor or subcontractor into contact with ePHI.

If a cloud service provider creates, receives, maintains, or transmits ePHI on behalf of a covered entity or business associate, HHS says the parties generally need a business associate agreement (BAA), and the organization must otherwise comply with the HIPAA Rules. HHS also says that storing only encrypted ePHI without access to the decryption key does not, by itself, remove a cloud provider from business associate status. See HHS guidance on cloud services and ePHI.

Ask where data is processed and stored, which parties can access it, and what happens to it when support ends or the contract terminates. Review whether the BAA and any service-level agreement address permitted uses, subcontractors, security responsibilities, incident reporting, availability, backups, and data return or deletion.

What should a covered entity verify with a software vendor?

Before using patient data, document how the product will operate in your environment. The following review points can help your privacy, security, clinical, and IT teams assess the deployment; they are practical questions, not a substitute for a risk analysis or legal review.

• Data handled: Identify the PHI and ePHI the application receives, creates, stores, or transmits, including imaging, calculations, user information, and support data.
• Vendor access and role: Determine whether the vendor or its subcontractors can access PHI through hosting, maintenance, troubleshooting, or another service.
• BAA: If the vendor is acting as a business associate, confirm that an appropriate BAA is in place before permitting access to PHI. The agreement should reflect the actual services and responsibilities.
• Security responsibilities: Clarify which protections the vendor provides and which your organization must configure or manage, such as user access, authentication, monitoring, backups, and incident response.
• Data lifecycle: Confirm how long data and backups are retained, how they can be returned, and how they are handled after service termination.
• Evidence and review: Request relevant documentation about security controls and subcontractors, then evaluate it as part of your organization’s own risk management.

HHS explains that a software vendor’s role depends on what it does: merely selling software does not by itself create a business associate relationship if the vendor has no access to PHI, while hosting patient information or accessing it during troubleshooting can make the vendor a business associate. See HHS’s guidance on software vendors and business associate status.

Does FDA clearance establish HIPAA compliance?

No. FDA clearance and HIPAA compliance address different questions. FDA’s 510(k) process evaluates whether a device is substantially equivalent to a legally marketed predicate device, based on safety and performance considerations. It does not determine whether a healthcare organization’s deployment satisfies HIPAA requirements.

Therefore, verify any FDA marketing-status claims separately from your privacy and security review. A product’s FDA clearance does not replace an assessment of ePHI data flows, applicable safeguards, vendor responsibilities, or a required BAA. The FDA describes the purpose of 510(k) clearance in its overview of the medical-device clearance process; HHS separately describes the HIPAA Security Rule requirements in its Security Rule summary.

What compliance limitations should healthcare organizations consider?

No software product, vendor statement, or private “HIPAA certification” automatically establishes that an organization is compliant. HHS says it does not endorse or recognize private certifications as proof of Security Rule compliance, and an external certification does not remove an organization’s legal obligations. See HHS guidance on Security Rule certifications.

Implementation matters. Incorrect permissions, unreviewed integrations, unmanaged devices, or unclear responsibilities between your organization and a vendor can undermine protections even when a product offers security features. A BAA is important when required, but it does not replace the organization’s own risk analysis, policies, workforce practices, and oversight.

In short, theranostics dosimetry software can support a HIPAA-compliant workflow, but compliance depends on how identifiable patient data flows through the product and how your organization and vendors protect it. Verify the data handling, safeguards, responsibilities, and agreements before using the software with patient information.

FAQs.

Is theranostics dosimetry software automatically HIPAA compliant?

No. Whether a deployment meets HIPAA requirements depends on the ePHI involved, the organization’s safeguards and practices, the vendor’s role, and any required agreements. Evaluate the complete workflow rather than relying on a general product claim.

Does FDA clearance mean dosimetry software is HIPAA compliant?

No. FDA clearance concerns a medical device’s regulatory pathway and safety or performance review; it does not establish HIPAA compliance. Assess privacy and security obligations separately.

When is a dosimetry software vendor a HIPAA business associate?

A vendor may be a business associate when it creates, receives, maintains, or transmits PHI on behalf of a covered entity or business associate, such as by hosting patient data or accessing it to provide support. Merely providing software without access to PHI does not, by itself, create that relationship, according to HHS guidance.

What should a healthcare organization verify before using dosimetry software with patient data?

Map the data and identify all parties that may access or maintain it. Review the vendor’s security responsibilities, hosting and subcontractors, applicable BAA, access controls, incident procedures, backups, and data retention or return arrangements. Complete the organization’s own risk analysis before deployment.