--- title: "HIPAA Compliance for HR Departments: What's Changed, What's Coming, and What to Do Now" description: Does HIPAA apply to HR departments? It depends. Learn which employers must comply, 2025 Security Rule changes, and how to protect PHI in email and files. image: https://www.virtru.com/hubfs/assets/images/blog/HIPAA-for-HR-teams.webp --- [Skip to Main Content](https://www.virtru.com/blog/compliance/hipaa/employers#main-content) [Sign In](https://secure.virtru.com/dashboard) [I received a Virtru email](https://www.virtru.com/data-protection-platform/email-encryption/send) [![Virtru](https://www.virtru.com/hubfs/assets/images/logos/virtru/blue/virtru_LOGOMASTER_BLUE.svg) ](https://www.virtru.com/) - Products - Solutions - Developers - Company - Resources - [Support](https://support.virtru.com) - [Pricing](https://www.virtru.com/data-security-platform/pricing-packages) - Book a Demo - Search all Virtru content ![](https://www.virtru.com/hubfs/assets/images/icons/link-arrow-black.svg) Email Workflows Protect data shared via email - [Virtru for Gmail ](https://www.virtru.com/data-security-platform/email-encryption/gmail) - [Virtru for Outlook ](https://www.virtru.com/data-security-platform/email-encryption/outlook) - [Virtru Gateway ](https://www.virtru.com/data-security-platform/virtru-data-gateway) - [Email Integrations ](https://www.virtru.com/products/integrations?product=data_protection_gateway&category=email) File Workflows Protect files shared across your workflows - [Virtru Secure Share ](https://www.virtru.com/data-security-platform/virtru-secure-share) - [Virtru for Desktop ](https://www.virtru.com/data-security-platform/desktop) - [File Integrations ](https://www.virtru.com/products/integrations?category=file_sharing) Collaboration Workflows FedRAMP authorized file storage and collaboration - [Virtru Collaborate ](https://www.virtru.com/data-security-platform/virtru-collaborate) Manage Private Encryption Keys Maintain complete sovereignty and governance - [Virtru Private Keystore ](https://www.virtru.com/data-security-platform/virtru-private-keystore) - [Google Client Side Encryption (CSE) ](https://www.virtru.com/data-security-platform/google-workspace-client-side-encryption) Develop Data Security Solutions Data-centric security, built on open standards - [Virtru Data Security Platform ](https://www.virtru.com/data-security-platform) - [Developer Experience ](https://www.virtru.com/data-security-platform/developer-experience) - [Platform Integrations ](https://www.virtru.com/partners/technology) 6,100+ Customers Trust Virtru for Data Security and Privacy Protection ![Omada Logo](https://www.virtru.com/hubfs/assets/images/logos/customers/omada-logo.webp) ![UC Berkley Logo](https://www.virtru.com/hubfs/assets/images/logos/customers/ucberkley-logo.webp) ![Associated Press Logo](https://www.virtru.com/hubfs/assets/images/logos/customers/associatedpress-logo.webp) ![US Department of Defense Logo](https://www.virtru.com/hubfs/assets/images/logos/customers/dod-logo.webp) - Compliance - [CJIS ](https://www.virtru.com/compliance/cjis) - [CMMC / NIST / DFARS ](https://www.virtru.com/compliance/cmmc) - [FERPA ](https://www.virtru.com/compliance/ferpa) - [FTC Safeguards Rule ](https://www.virtru.com/compliance/data-encryption-ftc-safeguards-rule) - [GDPR ](https://www.virtru.com/compliance/gdpr) - [HIPAA ](https://www.virtru.com/compliance/hipaa-email) - [ISO 27001 ](https://www.virtru.com/compliance/iso-27001) - [ITAR ](https://www.virtru.com/compliance/itar) - [PCI / GLBA / FINRA / SOX ](https://www.virtru.com/compliance/financial) - Commercial - [Aerospace ](https://www.virtru.com/industry-solutions/aerospace-and-defense/) - [Education ](https://www.virtru.com/industry-solutions/education/) - [Finance ](https://www.virtru.com/industry-solutions/financial-services/) - [Healthcare ](https://www.virtru.com/industry-solutions/healthcare/) - [Legal ](https://www.virtru.com/industry-solutions/legal) - [Technology & Telecom ](https://www.virtru.com/industry-solutions/telecom-it-and-software) - [Threat Intelligence ](https://www.virtru.com/industry-solutions/threat-intelligence) - Global Public Sector - [Federal - Defense ](https://www.virtru.com/global-public-sector/defense) - [Federal - Intelligence ](https://www.virtru.com/global-public-sector/intelligence) - [State & Local Government ](https://www.virtru.com/industry-solutions/state-local-government) - [Systems Integrators ](https://www.virtru.com/global-public-sector/systems-integrators) - [Mission Partner Environments ](https://www.virtru.com/industry-solutions/mission-partner-environments) [View All Solutions](https://www.virtru.com/compliance) [![Three rings forming three overlaps in a triangle formation](https://www.virtru.com/hubfs/assets/images/icons/rings-navicon.svg) Virtru for Global Mission Partners Data-centric security aligned with ACP-240 and TDF Learn More ](https://www.virtru.com/industry-solutions/mission-partner-environments) [![Microsoft Icon](https://www.virtru.com/hubfs/assets/images/icons/microsoft-navicon.svg) Virtru for Microsoft 365 Protect data stored and shared via Microsoft 365 Learn More ](https://www.virtru.com/data-security-platform/microsoft-365) [![Google Icon](https://www.virtru.com/hubfs/assets/images/icons/google-navicon.svg) Virtru for Google Workspace Protect data stored and shared via Google Workspace Learn More ](https://www.virtru.com/data-security-platform/google-workspace) - Developers - [Virtru Data Security Platform The Security Standard that Powers Our Products ](https://www.virtru.com/data-security-platform) - [Trusted Data Format Secure Collaboration and Policy Enforcement ](https://www.virtru.com/data-security-platform/trusted-data-format) - [Virtru Developer Experience Build Secure Solutions from the Ground Up ](https://www.virtru.com/data-security-platform/developer-experience) - Developer Community - [OpenTDF: Open Source Project Open Standard Now Available on GitHub ](https://opentdf.io/) - [Technology Partners Building integrations with the Virtru Platform ](https://www.virtru.com/partners/technology) - [Partner Training Bootcamp Request training on the Virtru Data Security Platform ](https://www.virtru.com/data-security-platform/training-request) ![Looking over the shoulder of somebody on their smart phone. ](https://www.virtru.com/hubfs/assets/images/stock%20photos/People%20On%20Device/person-on-phone.webp) A trusted platform for secure data sharing Built on the open TDF standard, the Virtru Data Security Platform provides persistent control over the information you share with others. [Virtru Data Security Platform](https://www.virtru.com/data-security-platform) - About Virtru - [About Us ](https://www.virtru.com/about-us) - [Leadership ](https://www.virtru.com/leadership/) - [Careers & Culture ](https://www.virtru.com/careers) - [Contact Us ](https://www.virtru.com/contact-us) - In the News - [Headlines & Press Releases ](https://www.virtru.com/newsroom) - [Decrypted Blog ](https://www.virtru.com/blog) - [Hash It Out Podcast ](https://www.virtru.com/hash-it-out) Award-winning security solutions for every organization ![Cyber Security Breakthrough Award Logo for 2023](https://www.virtru.com/hubfs/assets/images/logos/award%20badges/cybersecurity-breakthrough-award-badge-2023.webp) ![Virtru wins a G2 Top 50 Security Products Award for 2024](https://www.virtru.com/hubfs/assets/images/logos/award%20badges/G2-Leader-2025.webp) ![Washington Post Top Work Places 2023 Award](https://www.virtru.com/hubfs/assets/images/logos/award%20badges/twp-washington-2023.webp) ![Inc Power Partner 2024](https://www.virtru.com/hubfs/assets/images/logos/award%20badges/IncPowerPartner-2024.webp) [Read Customer Reviews](https://www.virtru.com/why-virtru/reviews) - Resources - [Decrypted Blog Tips, Takes, and Expertise ](https://www.virtru.com/blog) - [Hash It Out Podcast Join us as we talk about cybersecurity ](https://www.virtru.com/hash-it-out) - [Voice of the Customer Case Studies, Webinars, and Videos ](https://www.virtru.com/resources?type=webinar,case-study) - [Events & Webinars Upcoming Events, Conferences, and Digital Webinars ](https://www.virtru.com/events-and-webinars/) - [Resource Library Whitepapers, Guides, and Videos ](https://www.virtru.com/resources) - [DMV Rising Our annual event bringing together the cyber community in the DMV ](https://dmvrising.com/) - [Headlines & Press Virtru in the News ](https://www.virtru.com/newsroom) - [Product Updates The latest on new products, features, and fixes ](https://www.virtru.com/products/updates) - [Virtru Academy Live Helpful how-to content for admins and end users ](https://www.virtru.com/virtru-academy-live) ![Professional on a laptop](https://www.virtru.com/hubfs/assets/images/stock%20photos/business/Business-3.webp) ![Wealthforge Logo](https://www.virtru.com/hubfs/assets/images/logos/customers/Wealthforge%20Logo.webp) 100% Increase in delivery rate for a broker-dealer working to comply with SEC regulations. [Read the Case Study](https://www.virtru.com/case-studies/wealthforge-sec-compliance-gateway) - Products - Email Workflows Protect data shared via email - [Virtru for Gmail ](https://www.virtru.com/data-security-platform/email-encryption/gmail) - [Virtru for Outlook ](https://www.virtru.com/data-security-platform/email-encryption/outlook) - [Virtru Gateway ](https://www.virtru.com/data-security-platform/virtru-data-gateway) - [Email Integrations ](https://www.virtru.com/products/integrations?product=data_protection_gateway&category=email) - File Workflows Protect files shared across your workflows - [Virtru Secure Share ](https://www.virtru.com/data-security-platform/virtru-secure-share) - [Virtru for Desktop ](https://www.virtru.com/data-security-platform/desktop) - [File Integrations ](https://www.virtru.com/products/integrations?category=file_sharing) - Collaboration Workflows FedRAMP authorized file storage and collaboration - [Virtru Collaborate ](https://www.virtru.com/data-security-platform/virtru-collaborate) - Manage Private Encryption Keys Maintain complete sovereignty and governance - [Virtru Private Keystore ](https://www.virtru.com/data-security-platform/virtru-private-keystore) - [Google Client Side Encryption (CSE) ](https://www.virtru.com/data-security-platform/google-workspace-client-side-encryption) - Develop Data Security Solutions Data-centric security, built on open standards - [Virtru Data Security Platform ](https://www.virtru.com/data-security-platform) - [Developer Experience ](https://www.virtru.com/data-security-platform/developer-experience) - [Platform Integrations ](https://www.virtru.com/partners/technology) - Solutions - Compliance - [CJIS ](https://www.virtru.com/compliance/cjis) - [CMMC / NIST / DFARS ](https://www.virtru.com/compliance/cmmc) - [FERPA ](https://www.virtru.com/compliance/ferpa) - [FTC Safeguards Rule ](https://www.virtru.com/compliance/data-encryption-ftc-safeguards-rule) - [GDPR ](https://www.virtru.com/compliance/gdpr) - [HIPAA ](https://www.virtru.com/compliance/hipaa-email) - [ISO 27001 ](https://www.virtru.com/compliance/iso-27001) - [ITAR ](https://www.virtru.com/compliance/itar) - [PCI / GLBA / FINRA / SOX ](https://www.virtru.com/compliance/financial) - Commercial - [Aerospace ](https://www.virtru.com/industry-solutions/aerospace-and-defense/) - [Education ](https://www.virtru.com/industry-solutions/education/) - [Finance ](https://www.virtru.com/industry-solutions/financial-services/) - [Healthcare ](https://www.virtru.com/industry-solutions/healthcare/) - [Legal ](https://www.virtru.com/industry-solutions/legal) - [Technology & Telecom ](https://www.virtru.com/industry-solutions/telecom-it-and-software) - [Threat Intelligence ](https://www.virtru.com/industry-solutions/threat-intelligence) - Global Public Sector - [Federal - Defense ](https://www.virtru.com/global-public-sector/defense) - [Federal - Intelligence ](https://www.virtru.com/global-public-sector/intelligence) - [State & Local Government ](https://www.virtru.com/industry-solutions/state-local-government) - [Systems Integrators ](https://www.virtru.com/global-public-sector/systems-integrators) - [Mission Partner Environments ](https://www.virtru.com/industry-solutions/mission-partner-environments) - Developers - Developers - [Virtru Data Security Platform The Security Standard that Powers Our Products ](https://www.virtru.com/data-security-platform) - [Trusted Data Format Secure Collaboration and Policy Enforcement ](https://www.virtru.com/data-security-platform/trusted-data-format) - [Virtru Developer Experience Build Secure Solutions from the Ground Up ](https://www.virtru.com/data-security-platform/developer-experience) - Developer Community - [OpenTDF: Open Source Project Open Standard Now Available on GitHub ](https://opentdf.io/) - [Technology Partners Building integrations with the Virtru Platform ](https://www.virtru.com/partners/technology) - [Partner Training Bootcamp Request training on the Virtru Data Security Platform ](https://www.virtru.com/data-security-platform/training-request) - Company - About Virtru - [About Us ](https://www.virtru.com/about-us) - [Leadership ](https://www.virtru.com/leadership/) - [Careers & Culture ](https://www.virtru.com/careers) - [Contact Us ](https://www.virtru.com/contact-us) - In the News - [Headlines & Press Releases ](https://www.virtru.com/newsroom) - [Decrypted Blog ](https://www.virtru.com/blog) - [Hash It Out Podcast ](https://www.virtru.com/hash-it-out) - Resources - Resources - [Decrypted Blog Tips, Takes, and Expertise ](https://www.virtru.com/blog) - [Hash It Out Podcast Join us as we talk about cybersecurity ](https://www.virtru.com/hash-it-out) - [Voice of the Customer Case Studies, Webinars, and Videos ](https://www.virtru.com/resources?type=webinar,case-study) - [Events & Webinars Upcoming Events, Conferences, and Digital Webinars ](https://www.virtru.com/events-and-webinars/) - [Resource Library Whitepapers, Guides, and Videos ](https://www.virtru.com/resources) - [DMV Rising Our annual event bringing together the cyber community in the DMV ](https://dmvrising.com/) - [Headlines & Press Virtru in the News ](https://www.virtru.com/newsroom) - [Product Updates The latest on new products, features, and fixes ](https://www.virtru.com/products/updates) - [Virtru Academy Live Helpful how-to content for admins and end users ](https://www.virtru.com/virtru-academy-live) - [Support](https://support.virtru.com) - [Pricing](https://www.virtru.com/data-security-platform/pricing-packages) - Book a Demo - Search all Virtru content ![](https://www.virtru.com/hubfs/assets/images/icons/link-arrow-black.svg) HIPAA Healthcare. April 30, 2026 # HIPAA Compliance for HR Departments: What's Changed, What's Coming, and What to Do Now ![Editorial Team](https://www.virtru.com/hubfs/assets/images/logos/virtru/logomark/blue/virtru_LOGOMARKMASTER_BLUE_FINAL.svg) By Editorial Team Share post: [![Share on Facebook](https://www.lean-labs.com/hs-fs/hubfs/LLv2/images/icon-blog-facebook.png?noresize&width=24&name=icon-blog-facebook.png)](http://www.facebook.com/share.php?u=https%3A%2F%2Fwww.virtru.com%2Fblog%2Fcompliance%2Fhipaa%2Femployers%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on LinkedIn](https://www.lean-labs.com/hs-fs/hubfs/LLv2/images/icon-blog-linkedin.png?noresize&width=24&name=icon-blog-linkedin.png)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.virtru.com%2Fblog%2Fcompliance%2Fhipaa%2Femployers%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on Twitter](https://www.virtru.com/hs-fs/hubfs/opentdf/assets/images/icons/x-logo.webp?width=24&name=x-logo.webp)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fwww.virtru.com%2Fblog%2Fcompliance%2Fhipaa%2Femployers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fwww.virtru.com%2Fblog%2Fcompliance%2Fhipaa%2Femployers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=HIPAA%20Compliance%20for%20HR%20Departments%3A%20What%27s%20Changed%2C%20What%27s%20Coming%2C%20and%20What%20to%20Do%20Now) ## TABLE OF CONTENTS See Virtru In Action Book a Demo Share post: [![Share on Facebook](https://www.lean-labs.com/hs-fs/hubfs/LLv2/images/icon-blog-facebook.png?noresize&width=24&name=icon-blog-facebook.png)](http://www.facebook.com/share.php?u=https%3A%2F%2Fwww.virtru.com%2Fblog%2Fcompliance%2Fhipaa%2Femployers%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on LinkedIn](https://www.lean-labs.com/hs-fs/hubfs/LLv2/images/icon-blog-linkedin.png?noresize&width=24&name=icon-blog-linkedin.png)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.virtru.com%2Fblog%2Fcompliance%2Fhipaa%2Femployers%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on Twitter](https://www.virtru.com/hs-fs/hubfs/opentdf/assets/images/icons/x-logo.webp?width=24&name=x-logo.webp)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fwww.virtru.com%2Fblog%2Fcompliance%2Fhipaa%2Femployers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fwww.virtru.com%2Fblog%2Fcompliance%2Fhipaa%2Femployers%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=HIPAA%20Compliance%20for%20HR%20Departments%3A%20What%27s%20Changed%2C%20What%27s%20Coming%2C%20and%20What%20to%20Do%20Now) ![HR teammates discuss data security for HR HIPAA compliance](https://www.virtru.com/hubfs/assets/images/blog/HIPAA-for-HR-teams.webp) OCR collected $9.9 million in HIPAA fines in 2024. The average penalty was $579,000. In March 2025, HHS confirmed Phase 3 compliance audits were still underway — 50 covered entities and business associates selected for review. If your HR team is still treating HIPAA as someone else's problem, that number is worth sitting with. ## Does HIPAA Actually Apply to HR? The short answer: it depends on what your organization does with employee health data. [HIPAA's Privacy Rule ](https://www.hhs.gov/hipaa/for-professionals/privacy/index.html)doesn't regulate employer-employee relationships directly. It governs how health plans and providers handle [protected health information (PHI) ](https://www.virtru.com/blog/compliance/hipaa/phi-vs-pii)— not how employers store vacation requests or routine sick day notes. But that boundary blurs fast. If your organization administers a self-insured health plan, your HR department is almost certainly handling PHI — and HIPAA requirements apply. The same is true if HR staff access health plan records to administer benefits, process accommodation requests, or manage workers' compensation claims that involve diagnosis or treatment data. The practical rule: if HR touches data generated through your company's sponsored health plan, HIPAA governs how that data is stored, shared, and protected. ## A Quick Glossary (The Terms That Actually Matter) **PHI:** Any data relating to a person's physical or mental health, treatment, or payment for care. Names, Social Security numbers, medical records, and insurance IDs all qualify when linked to health information. **Covered Entity:** An organization that handles PHI — health plans, healthcare providers, clearinghouses. If your company runs a self-insured plan, that plan is a covered entity even if your broader company isn't. **Business Associate Agreement (BAA):** The contract required when a covered entity shares PHI with a third party. Any vendor or platform that touches PHI — including email providers and file-sharing tools — needs one. As a practical note, [Virtru has a BAA for HIPAA compliance](https://support.virtru.com/hc/en-us/articles/360005927613-HIPAA-Compliance-BAAs).  **Privacy Rule:** Governs individual rights and PHI access across all formats — paper, digital, verbal. **Security Rule:** Specifically covers [electronic PHI (ePHI) ](https://www.virtru.com/blog/compliance/hipaa/ephi)and requires technical, physical, and administrative safeguards to protect it. ## The Security Rule Is About to Get Significantly Stricter In January 2025, HHS published a sweeping [proposed overhaul of the HIPAA Security Rule](https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information) — the first major revision since 2003. The comment period closed in March 2025. A final rule is expected in 2026, with a compliance window likely 180 days after publication. HR teams and their organizations should start preparing now, not after the final rule drops, as it contains substantial changes. **Encryption becomes mandatory.** The current Security Rule treats encryption as "addressable" — organizations can decide whether it's reasonable given their risk analysis. The proposed rule eliminates that flexibility. Encryption of ePHI both at rest and in transit would be required, with no exceptions. **Multi-factor authentication.** MFA would be required across all systems that access or process ePHI. **Annual compliance audits.** Covered entities and business associates would need to conduct internal HIPAA compliance audits at least once every 12 months. **Scheduled vulnerability testing.** Vulnerability scans every six months, penetration tests annually. **Technology asset inventories.** Organizations would need to maintain a documented inventory of all technology assets that handle ePHI, reviewed annually. The bigger structural shift is that the proposed rule removes the "required vs. addressable" distinction entirely. What was once optional guidance becomes mandatory baseline. ## What HR Teams Need to Protect Right Now Whether or not the proposed rule is finalized as written, current Security Rule requirements already cover the ground where most HR teams have gaps. Three safeguards matter most for how HR actually handles data day-to-day: **Access controls.** Systems holding ePHI should restrict access to employees who need it for specific job functions. Not everyone in HR needs access to health plan records. Audit who has access and whether it's still warranted. **Audit controls.** Logging system activity involving ePHI is what makes breach detection possible after the fact. If you can't reconstruct what happened to a file or email containing PHI, you can't demonstrate compliance. ![gateway-audit-crop](https://www.virtru.com/hs-fs/hubfs/assets/images/product%20page/Gateway/gateway-audit-crop.webp?width=908&height=622&name=gateway-audit-crop.webp) **Transmission security.** When ePHI moves — through email, file transfers, or shared drives — it must be protected in transit. [Unencrypted email is not HIPAA-compliant](https://www.virtru.com/blog/compliance/hipaa/email-service). A standard shared link with broad access permissions is not HIPAA-compliant. ## Where HR Teams Often Slip: Email and File Sharing The most common compliance gaps aren't in the policy — they're in the daily workflow. Benefits paperwork emailed to employees. Insurance documents sent to third-party administrators. Medical leave documentation shared via a standard file link. These feel routine because they are. That's exactly why they're where PHI exposure happens. **Email.** Standard Gmail and Outlook messages don't satisfy HIPAA's transmission security requirements on their own. Any workflow where HR sends PHI externally — to carriers, TPAs, or providers — needs encryption in place. Jason Karn, Chief Compliance Officer at [Total HIPAA](https://www.virtru.com/case-studies/total-hipaa-phi-encryption), described this well: "Just having data encrypted point-to-point doesn't solve the problem. If that's all it took, then Gmail, Google Workspace, and Office 365 would be sufficient. The real issue is, ‘What do you do when you send PHI to the wrong person?’ Virtru is a minimal expense for the security and safety it provides." [Virtru for Gmail](https://www.virtru.com/data-security-platform/) and [Virtru for Outlook](https://www.virtru.com/data-security-platform/) let HR teams send encrypted messages directly from tools they already use. Recipients open protected messages without installing software or creating a new account. Access can be revoked after the fact, and every message carries a persistent, auditable policy — not just a one-time encryption event. **File sharing.** PHI travels in attachments, shared drives, and collaboration platforms. Standard sharing links don't give you control after sending — anyone with the link can access the file indefinitely. [Virtru Secure Share](https://www.virtru.com/data-security-platform/virtru-secure-share/healthcare) wraps encryption around individual files rather than relying on platform-level permissions. HR teams can share PHI through Microsoft OneDrive, SharePoint, Teams, or Google Drive and retain the ability to revoke access, set expiration dates, and track who has viewed what. Recipients access the file through their browser — no software installation, no new account. ## Don't Forget the HIPAA BAA If your HR team uses any external platform to process or share PHI — email, file storage, HR information systems, third-party administrators — a signed BAA is a hard requirement, not a best practice. Virtru executes BAAs as part of its standard HIPAA-eligible offerings, covering both Virtru for Email and Virtru Secure Share. ## What to Do Before the New Security Rule Lands The proposed Security Rule won't be finalized overnight. But the enforcement environment is already serious — nearly $10 million in fines last year, and Phase 3 audits actively underway. Organizations that wait for final rulemaking to start closing gaps are organizations that fail compliance reviews. Start with the basics: document what PHI your HR team touches, who has access to it, and how it moves. Then close the email and file-sharing gaps. The proposed rule's encryption mandate reflects where OCR's enforcement focus has been pointing for years. Getting ahead of it will make the difference between managing risk and reacting to it. See how Virtru protects PHI across email and file sharing. [Book a demo with our team today. ](https://www.virtru.com/contact-us) ![Editorial Team](https://www.virtru.com/hubfs/assets/images/logos/virtru/logomark/blue/virtru_LOGOMARKMASTER_BLUE_FINAL.svg) ### Editorial Team The editorial team consists of Virtru brand experts, content editors, and vetted field authorities. We ensure quality, accuracy, and integrity through robust editorial oversight, review, and optimization of content from trusted sources, including use of generative AI tools. [View more posts by Editorial Team](https://www.virtru.com/blog/author/editorial-team) See Virtru In Action Book a Demo Sign Up for the Virtru Newsletter ## Dive Deeper ![](https://www.virtru.com/hubfs/assets/images/icons/left-arrow-circle-blue.webp) [![](https://www.virtru.com/hubfs/assets/temporary%20(use%20this%20for%20uploading%20unoptimized%20images,%20videos,%20etc)/blog%20-%20cyera%20oasis/cyera-oasis.webp) Commentary July 29, 2026 ### The Coin Has Two Sides: What Cyera's Acquisition of Oasis Tells Us About the Future of Security ](https://www.virtru.com/blog/data-centric-security/cyera-oasis) [![](https://www.virtru.com/hubfs/26-Competitor-Blog%20-%20Virtru%20vs%20Box%20copy.webp) File Encryption July 28, 2026 ### Virtru Collaborate vs. Box: Secure File Sharing for Businesses of Any Size ](https://www.virtru.com/blog/virtru-collaborate-vs-box-enterprise) [![](https://www.virtru.com/hubfs/assets/temporary%20(use%20this%20for%20uploading%20unoptimized%20images,%20videos,%20etc)/blog%20-%20william%20mcborrough%20recap/cmmc-compass-will-mcborrough.webp) Compliance July 22, 2026 ### The $600,000 Problem: What the CMMC Pause Actually Revealed About the Defense Industrial Base ](https://www.virtru.com/blog/compliance/mcglobaltech-cmmc-compass) [![](https://www.virtru.com/hubfs/assets/temporary%20(use%20this%20for%20uploading%20unoptimized%20images,%20videos,%20etc)/blog%20-%20three%20stories/three-stories.webp) Zero Trust July 21, 2026 ### Last Week in Critical Infrastructure: Three Stories You Should Read as One ](https://www.virtru.com/blog/data-centric-security/three-stories-converge) [![](https://www.virtru.com/hubfs/assets/temporary%20(use%20this%20for%20uploading%20unoptimized%20images,%20videos,%20etc)/blog%20-%20cmmc%20on%20hold/CMMC-Pause-CUI-Not.webp) Public Sector July 14, 2026 ### CMMC Phase II Is Officially on Hold. NIST and DFARS aren't. ](https://www.virtru.com/blog/compliance/cmmc-phase-2-on-hold-nist-dfars) [![](https://www.virtru.com/hubfs/assets/temporary%20(use%20this%20for%20uploading%20unoptimized%20images,%20videos,%20etc)/2026%20Newsletter%20Assets/jk-HIO.png) Zero Trust July 10, 2026 ### We Asked Kindervag: Why Are So Many Organizations Still Getting Zero Trust Wrong? ](https://www.virtru.com/blog/zero-trust/kindervag-yeske) [![](https://www.virtru.com/hubfs/assets/temporary%20(use%20this%20for%20uploading%20unoptimized%20images,%20videos,%20etc)/blog%20-%20ShareFile%20Takedown/26-Competitor-Blog-Blog%20-%20Virtru%20vs%20Sharefile.jpg) File Encryption July 10, 2026 ### Looking for a ShareFile Alternative? Here's What Regulated Organizations Need to Know. ](https://www.virtru.com/blog/file-encryption/citrix-progress-sharefile) [![](https://www.virtru.com/hubfs/assets/temporary%20(use%20this%20for%20uploading%20unoptimized%20images,%20videos,%20etc)/blog%20-%20sendsafely%20takedown/26-Competitor-Blog-Blog%20-%20Virtru%20vs%20SendSafely%20(1).jpg) File Encryption July 08, 2026 ### SendSafely vs. Virtru: Which Secure File Sharing Platform Protects Your Data After Download? ](https://www.virtru.com/blog/file-encryption/sendsafely) [![](https://www.virtru.com/hubfs/assets/images/blog/26-Competitor-Blog-Blog%20-%20Virtru%20vs%20Dropbox.webp) File Encryption July 07, 2026 ### Dropbox Alternatives for Secure File Sharing: What IT Teams Are Missing ](https://www.virtru.com/blog/dropbox-alternatives-secure-file-sharing) [![](https://www.virtru.com/hubfs/assets/temporary%20(use%20this%20for%20uploading%20unoptimized%20images,%20videos,%20etc)/blog%20-%20alex%20karp/alex-karp.jpg) Commentary July 07, 2026 ### Alex Karp Is Right About the AI Problem. He's Missing the Solution. ](https://www.virtru.com/blog/zero-trust/alex-karp-palantir-data-sovereignty) [![](https://www.virtru.com/hubfs/assets/temporary%20(use%20this%20for%20uploading%20unoptimized%20images,%20videos,%20etc)/blog%20-%20SACR%20Report/anna-perrone-commentary%20copy.webp) Email Encryption June 29, 2026 ### The Email Security Report Every CISO Should Read, And the Questions It Should Inspire ](https://www.virtru.com/blog/email-security/sacr-anna-perrone-report-2026) ![](https://www.virtru.com/hubfs/assets/images/icons/right-arrow-circle-blue.webp) ## Book a Demo ## Become a Partner Contact us to learn more about our partnership opportunities. ## Become a Compliance Champion Contact us to learn more about our partnership opportunities. - Products - [Product Overview](https://www.virtru.com/data-security-platform/product-overview) - [Virtru for Google Workspace](https://www.virtru.com/data-security-platform/google-workspace) - [Virtru for Microsoft 365](https://www.virtru.com/data-security-platform/microsoft-365) - [Data Protection Gateway](https://www.virtru.com/data-security-platform/virtru-data-gateway) - [Pricing](https://www.virtru.com/data-security-platform/pricing-packages) - Compliance - [HIPAA](https://www.virtru.com/compliance/hipaa-email) - [ITAR](https://www.virtru.com/compliance/itar) - [GDPR](https://www.virtru.com/compliance/gdpr) - [CJIS](https://www.virtru.com/compliance/cjis) - [NIST CUI](https://www.virtru.com/compliance/nist) - [CCPA](https://www.virtru.com/compliance/ccpa) - [FERPA](https://www.virtru.com/compliance/ferpa) - [CMMC](https://www.virtru.com/compliance/cmmc) - Industries - [Healthcare](https://www.virtru.com/industry-solutions/healthcare/) - [Education](https://www.virtru.com/industry-solutions/education/) - [IT & Software](https://www.virtru.com/industry-solutions/telecom-it-and-software) - [Federal Government](https://www.virtru.com/global-public-sector) - [State & Local Government](https://www.virtru.com/industry-solutions/state-local-government) - [Manufacturing](https://www.virtru.com/industry-solutions/manufacturing) - [Financial Services](https://www.virtru.com/industry-solutions/financial-services/) - Platform - [Email Encryption](https://www.virtru.com/data-security-platform/email-encryption) - [File Encryption](https://www.virtru.com/data-security-platform/file-encryption) - [Platform Architecture](https://www.virtru.com/data-security-platform/saas) - [Trusted Data Format](https://www.virtru.com/data-security-platform/trusted-data-format) - [Secure Reader](https://www.virtru.com/data-security-platform/secure-collaboration) - [Audit and Control](https://www.virtru.com/data-security-platform/audit-and-control) - [Encryption Key Management](https://www.virtru.com/data-security-platform/virtru-private-keystore) - Resources - [About Virtru](https://www.virtru.com/about-us) - [Blog](https://www.virtru.com/blog) - [Careers](https://www.virtru.com/careers) - [Leadership & Investors](https://www.virtru.com/leadership/) - [News & Press](https://www.virtru.com/press) - [Partners](https://www.virtru.com/partners/) - [Intellectual Property](https://www.virtru.com/intellectual-property/) - [Security Certifications](https://www.virtru.com/data-security-platform/compliance) - Resource Library - Contact Us - [Contact Us](https://www.virtru.com/contact-us) - [Support](https://support.virtru.com/) - [Sales](https://www.virtru.com/contact-us) - [Become a Partner](https://www.virtru.com/blog/compliance/hipaa/employers#footer) - [Report a Vulnerability](https://www.virtru.com/responsible-disclosure/) [![Virtur Logo](https://www.virtru.com/hubfs/assets/images/logos/virtru/white/tagline/virtru_TAGLINE_LOGOMASTER_WHITE-01.svg)](https://www.virtru.com/) Subscribe to Our Newsletter [![X Icon](https://www.virtru.com/hubfs/assets/images/icons/x-white.svg)](https://x.com/virtruprivacy) [![LinkedIn Icon](https://www.virtru.com/hubfs/assets/images/icons/linkedin-white.svg)](https://www.linkedin.com/company/virtru) [![Youtube Icon](https://www.virtru.com/hubfs/assets/images/icons/youtube-white.svg)](https://www.youtube.com/@Virtru) © 2026 Virtru · 1801 Pennsylvania Ave NW, 5th Floor, Washington, DC 20006 [Terms](https://www.virtru.com/terms-of-service) & [Privacy](https://www.virtru.com/privacy-policy) | [Cookie Policy](https://www.virtru.com/cookie-policy) & [Preferences ![Pivacy Options logo](https://oag.ca.gov/sites/all/files/agweb/images/privacy/privacyoptions.svg)](https://www.virtru.com/blog/compliance/hipaa/employers#footer) | [Do Not Sell My Personal Information](https://www.virtru.com/blog/compliance/hipaa/employers#footer) | [Virtru Trust Center](https://trust.virtru.com/?_ga=2.215796503.1200908638.1747067694-1753239414.1744322796&_gac=1.175361302.1744660048.EAIaIQobChMIppzvranJjAMVN0pHAR3F7gNdEAAYAiAAEgL4qfD_BwE) ```json { "@context" : "https://schema.org", "@id" : "https://www.virtru.com/#organization", "@type" : "Organization", "description" : "Virtru is a data security platform delivering end-to-end encryption and access control for email, files and apps. Trusted by enterprise and defense leaders", "logo" : "https://www.virtru.com/hubfs/assets/images/logos/virtru/blue/virtru_LOGOMASTER_BLUE_HighRes.png", "name" : "Virtru", "sameAs" : [ "https://www.facebook.com/virtruprivacy", "https://www.x.com/virtruprivacy", "https://www.linkedin.com/company/virtru", "https://www.reddit.com/user/virtru_privacy", "https://www.youtube.com/@Virtru" ], "url" : "https://www.virtru.com/" } ``` ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Editorial Team", "url" : "https://www.virtru.com/blog/author/editorial-team" }, "dateModified" : "2026-04-30T20:42:47.883Z", "datePublished" : "2026-04-30T20:42:47.000Z", "headline" : "HIPAA Compliance for HR Departments: What's Changed, What's Coming, and What to Do Now", "image" : [ "https://www.virtru.com/hubfs/assets/images/blog/HIPAA-for-HR-teams.webp" ], "mainEntityOfPage" : { "@id" : "https://www.virtru.com/blog/compliance/hipaa/employers", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.virtru.com/hubfs/virtru2022/images/Virtru%20Logo%20Blue%20(2).svg" }, "name" : "Virtru" } } ``` ```json { "@context" : "https://schema.org", "@type" : "ItemList", "itemListElement" : [ { "@type" : "SiteNavigationElement", "name" : "Products", "position" : 1 }, { "@type" : "SiteNavigationElement", "name" : "Solutions", "position" : 2 }, { "@type" : "SiteNavigationElement", "name" : "Developers", "position" : 3 }, { "@type" : "SiteNavigationElement", "name" : "Company", "position" : 4 }, { "@type" : "SiteNavigationElement", "name" : "Resources", "position" : 5 }, { "@type" : "SiteNavigationElement", "name" : "Support", "position" : 6, "url" : "https://support.virtru.com" }, { "@type" : "SiteNavigationElement", "name" : "Pricing", "position" : 7 } ], "name" : "Main Navigation" } ```