Most HIPAA software checklists are written for the team building a patient-facing app. This one is written for the CFO signing the Business Associate Agreement. The two readers have different jobs, and conflating them is why finance teams at healthcare-adjacent companies keep ending up with vendor contracts that look complete on paper and fall apart the first time an auditor asks who touched what.
If you run finance at a healthcare practice, a healthtech vendor, a healthcare-adjacent SaaS company, or any business where Protected Health Information moves through your AP, billing, payroll, or approval workflows, the question is not whether to architect an encryption scheme. The question is whether you can answer six concrete things about every system in the stack before you put your name on the contract.
This is that checklist.
Why finance leaders need a different HIPAA checklist
Walk through the top of the search results for HIPAA compliance checklists and you find the same article published under fifteen logos: a developer’s guide to building HIPAA-compliant software. Encrypt PHI at rest. Hash passwords. Use TLS. Implement audit logging at the application layer. Those checklists are useful for the team writing code. They are not the checklist the CFO needs.
The finance leader’s exposure is structural and contractual, not architectural. PHI flows through systems you did not build and rarely chose for their PHI-handling characteristics. AP automation. ERP. Billing platforms. Document storage. The automation platform someone in operations spun up two quarters ago to chase invoices. Each of those is a potential business associate under HIPAA, and each one you authorize to touch PHI without the right paperwork in place is exposure that lives on your audit trail, not the developer’s.
Here is what most HIPAA software checklists will not say plainly: encryption is the easy part. The hard part is keeping track of which systems are touching PHI, whether a Business Associate Agreement covers them, and whether you could produce the audit evidence to prove it twelve months after the fact. That is a finance and operations problem, not a security-team problem, and it does not get solved by a TLS cipher recommendation.
The six-item HIPAA software checklist for finance
Run this against every system in the stack that might touch PHI. Run it before you sign the contract, not after.
1. A signed BAA on file for every vendor that touches PHI
A Business Associate Agreement is the contract that obligates a vendor to handle PHI under HIPAA’s rules. The U.S. Department of Health and Human Services explicitly requires one between a covered entity and any vendor that creates, receives, maintains, or transmits PHI on its behalf.
The work is the inventory, not the signature. Walk every system that touches the finance side of the operation and ask which ones are likely to see PHI even incidentally:
- ERP (patient statement printing, EOB processing, payment posting)
- AP automation (medical-supply invoices with patient identifiers, EOBs that arrive as invoices)
- Billing platform (the obvious one)
- Document storage and shared drives (anywhere a screenshot, fax, or PDF lands)
- Approval workflows that route patient-linked transactions
- Email systems that handle PHI in attachments
- Any automation or AI platform that reads, writes, or routes data from the above
For each one, the BAA is either signed, available on request, or missing. Missing is the gap you act on. Available-on-request is the second gap.
2. Access controls and role-based permissions
Finance staff should not see clinical data. Clinical staff should not see banking detail. The system either supports that distinction or it does not. Ask the vendor to walk a sample permission matrix that lets a billing clerk see the line items needed to reconcile a payment without exposing the diagnosis codes, treatment notes, or any element of PHI not required for the financial task.
If the answer is “everyone with login access can see everything,” the system is not in scope for a healthcare-adjacent finance stack regardless of what else it does well.
3. An audit trail covering who accessed what and when
HIPAA’s documentation retention rules, anchored in the HHS regulatory text, require covered entities and business associates to retain documentation for a minimum of six years. That includes audit logs, policies, and the records of access and modification that prove the system is operating as the contract says.
The question to ask the vendor is concrete: produce a sample audit log for one transaction. Walk it from the moment a record entered the system to the moment it left or was last modified. If the vendor cannot show that log inside the demo, six years from now you cannot produce it for an auditor either.
4. Encryption at rest and in transit
This is the part the developer checklists handle well. It is also table stakes, not a differentiator. Ask the vendor for documentation rather than taking marketing claims at face value: which encryption protocols, which key management, who holds the keys, how key rotation works. Then move on. Encryption is the floor; the BAA, the access controls, and the audit trail are the building.
5. A breach notification process
HIPAA’s Breach Notification Rule, published by HHS, requires business associates to notify covered entities of a discovered breach without unreasonable delay and within 60 days. That is the regulatory floor. It is not a maximum acceptable internal target.
The questions to ask:
- What is the vendor’s contractual notification window? It must be at or below 60 days.
- What is their internal detection process? A 60-day notification window is meaningless if it takes 55 days to notice the breach.
- Who at the vendor is responsible, and how is the notification delivered?
If the vendor cannot answer in concrete terms, the rule is on paper only.
6. Exception handling and human review for automated workflows
This is the item most checklists do not have, and it is the one that most affects finance teams running AI agents and automation platforms over PHI-adjacent data.
Any automation touching PHI eventually hits an edge case the rule did not anticipate: a duplicate patient identifier, an unusual claim format, an invoice with mixed PHI and non-PHI line items. The system either silently processes the edge case (and your audit trail loses the moment of judgment) or it pauses and pulls a human in with the full context attached.
The second pattern is what holds up under audit. The first pattern is what creates the breaches nobody noticed until the quarterly review. Ask the vendor what happens when their automation hits an exception involving PHI: who gets pulled in, what context they see, and how the decision is captured against the underlying record.
Where finance software stacks fail the checklist
The six-item list is the easy 70% of the work. The gaps that recur across the healthcare-adjacent finance stacks I look at:
- Legacy ERPs predate HIPAA-aware access controls. Older Dynamics NAV and Great Plains installations rely on perimeter security rather than row-level permissions. The system “is HIPAA compliant” in the sense that nobody outside the network can see anything, but every finance user inside the network sees every patient line item the ERP holds.
- AP automation tools without a signed BAA. Finance assumed the vendor was not handling PHI because AP is “just invoices.” Then a stack of EOBs and patient statements started flowing through and the BAA question never got re-asked. This is the single most common BAA gap on the finance side.
- Approval workflows that live in email and shared inboxes. A clerk emails the controller for approval on a patient refund. The controller replies “approved.” Twelve months later the audit asks who approved that refund and on what basis, and the answer requires inbox archaeology. Approval evidence stored in email is harder to reconstruct than approval evidence captured against the underlying record. The same architectural problem covered for purchase orders in PO Approval Workflow: What It Is and Where Most of Them Break applies double when the transaction is patient-linked.
- Piecemeal AI agents built by consultants. A consultant set up an agent to do invoice matching three quarters ago. It works. Nobody knows what data it touches, where the prompt is stored, or how to produce its execution log. That fails the audit trail test on its own merits and fails the BAA test on top.
Each gap is patchable in isolation. The pattern that compounds is what one of the finance leaders I talked to called the piecemeal problem: there is no broad strategy, only point fixes accumulating across the stack.
How to evaluate automation platforms specifically
The automation layer deserves its own treatment because it is the seam between every other system on the list. An automation platform reads from the ERP, writes to the billing system, pulls vendor data from AP, and routes approvals through email or chat. If the platform is in scope for PHI, every connection it owns is in scope.
The questions to ask a candidate automation vendor:
- Do you sign a BAA, and at what plan tier? A vendor whose BAA only comes at the top tier is fine if that tier is your tier; if it is not, the conversation ends here.
- Can I see a sample audit log for a workflow execution? It should show which integrations were called, what data was passed, who or what triggered the execution, and what the outcome was. Not a system uptime log. The execution log for one run of one workflow.
- How does a human reviewer get pulled in when an automation hits an exception involving PHI? This is the human-in-the-loop question. The vendor’s answer is either a coherent description of how the platform pauses, routes the exception to a named person with full context, and captures the decision back against the record, or it is a marketing slide.
- What happens to the data after the workflow runs? Is it retained inside the platform, and for how long? Six-year retention is the HIPAA floor on documentation; the data itself has its own retention question that needs a direct answer.
FlowRunner is designed against this list deliberately. Audit logs and human-in-the-loop exception handling are designed to meet common audit requirements rather than treated as bolt-on features above a tier line. That is a category position, not a HIPAA-certification claim; HIPAA has no certification program, and any vendor offering one is selling something other than HIPAA compliance.
The broader point is structural. A finance stack at a healthcare-adjacent company has half a dozen systems of record: ERP, billing, AP, document storage, payroll. None of them see each other. Native ERP modules do not see the AP automation. The AP automation does not see the billing platform. The billing platform does not see the document storage. Each one holds part of the story. The audit trail asks for the whole story, tied to one patient or one transaction.
That is the category problem. The work between the systems of record, and the human judgment between those systems, has no native home in any of them. An orchestration layer is the category name for the home it needs. It sits above the systems of record. It subscribes to what they emit, joins the context the individual rules never had, and pauses the workflow when the data lands on an exception. Then it writes the answer back against the record so the trail is whole when an auditor asks. FlowRunner is built for that layer. It does not replace the ERP or the billing platform. It makes their outputs reconstructible end to end and the exceptions handlable without inbox archaeology, which is the part the six-item checklist exists to surface.
For the AP-side mirror of the same exception pattern in non-PHI finance work, the same architecture handles vendor invoices flowing into the ERP with exception routing and the approval-routing pattern that captures approver identity against the underlying record. The PHI-adjacent versions of those workflows live on the same plumbing; FlowRunner’s healthcare industry page covers the broader pattern.
A 30-day action plan
Run the checklist as a project, not a meeting.
- Week 1. Inventory every software system that touches PHI or PHI-adjacent finance data. Walk every integration, every shared drive, every approval channel, every automation. The list is almost always longer than memory suggests.
- Week 2. Pull the BAA status for each vendor on the list. Mark each one signed, available, or missing. Flag every “missing” or “available on request” as an open item.
- Week 3. Run the six-item checklist against each system. Document gaps in plain language tied to which item failed. For automation platforms specifically, ask the four questions in the section above.
- Week 4. Prioritize the gaps by exposure. A vendor processing PHI without a BAA is higher priority than a system with weak audit logs. A system with no exception-handling for AI-driven workflows on patient data is higher than either. Work the list top-down. The gaps that get closed in the first week of work are the same gaps that would have shown up in the first hour of an audit.
The point of the checklist is not to produce a tidy spreadsheet for the next compliance meeting. The point is to make the moment of inspection survivable. A finance stack that can answer the six questions about each system, with the BAA on file and the audit trail reconstructible, is a stack the CFO can sign for. A stack that cannot is one quarterly review away from a much harder conversation.
Quick answers
Is HIPAA compliance certification a real thing for software vendors?
No. HIPAA has no certification program. A vendor can be designed to support HIPAA workflows and willing to sign a Business Associate Agreement, but no government body certifies software as HIPAA compliant. Treat any vendor claiming certification with caution.
Does every finance vendor need a BAA?
Only the ones that create, receive, maintain, or transmit Protected Health Information on your behalf. Many AP, billing, and document-storage tools touch PHI without finance realizing it, which is why the inventory step matters more than the contract step.
How long do HIPAA audit logs need to be retained?
HIPAA requires covered entities and business associates to retain documentation, including audit logs and policies, for a minimum of six years from creation or last effective date. Verify your vendor can produce a log on request and that retention matches that floor.