Share article
Every audiometric record your HCP vendor stores contains protected health information. Under HIPAA, that makes your vendor a Business Associate — and if they haven’t signed a Business Associate Agreement (BAA) with you, you are already out of compliance. Most occupational health vendors, audiometric testing platforms, and legacy HCP software providers operate without SOC 2 certification, without signed BAAs, and without the security controls required for a 30-year medical record retention obligation. This guide explains the regulatory requirements, the specific risks most employers are currently carrying unknowingly, and what a genuinely secure audiometric records platform looks like.
Protected Health Information (PHI) under HIPAA is individually identifiable health information that is created, received, maintained, or transmitted by a covered entity or business associate. Audiometric records meet this definition:
However, there is an important nuance. OSHA audiometric records maintained solely for OSHA compliance purposes are subject to OSHA’s 1910.1020 access-to-employee-exposure-records standard, not HIPAA, when the employer is the sole custodian. The HIPAA obligation arises when a covered entity (typically an employer with a self-funded health plan) or a Business Associate stores, processes, or transmits these records electronically.
For most employers using a cloud-based audiometric testing platform, the vendor is a Business Associate under HIPAA, and all records stored by the vendor are ePHI (electronic PHI) subject to the full Security Rule requirements.
The HIPAA Security Rule (45 CFR Part 164, Subpart C) establishes required safeguards for ePHI. These requirements apply to Business Associates (including HCP software vendors) as well as covered entities:
Many HCP software platforms store audiometric records in databases that are not encrypted at rest — meaning that if the database is accessed by an unauthorized party, records are readable without decryption. Encryption at rest is required under 45 CFR 164.312(a)(2)(iv) for systems handling ePHI. Vendors should be required to confirm AES-256 encryption at rest as a contractual term.
A Business Associate Agreement (BAA) is a contract required by HIPAA (45 CFR 164.308(b)) between a covered entity and any vendor (Business Associate) that creates, receives, maintains, or transmits ePHI on the covered entity’s behalf. For audiometric records, the HCP software vendor is almost always a Business Associate.
HHS Office for Civil Rights investigations consistently find that covered entities and business associates fail to execute BAAs before sharing ePHI. If your audiometric testing platform or HCP software has never provided you with a BAA to sign, you are operating without HIPAA-required contractual protections. This is a per-violation category penalty exposure of up to $50,000 per year.
What a valid BAA must contain:
Before signing or renewing an HCP software agreement, confirm: (1) a BAA has been provided and executed, (2) the BAA covers all PHI processed including audiometric data and personal health notes, (3) breach notification timelines meet the 60-day HIPAA requirement, (4) the BAA addresses data return or certified destruction upon contract termination. If the vendor has not offered a BAA, request one immediately in writing.
OSHA 1910.95(m) requires audiometric records to be retained for the duration of employment plus 30 years after the employee’s departure. This creates an extraordinary long-term obligation that most employers have not modeled for risk:
This creates three critical risk areas:
SOC 2 (System and Organization Controls 2) is an auditing standard developed by the American Institute of Certified Public Accountants (AICPA) that evaluates a service organization’s controls relevant to security, availability, processing integrity, confidentiality, and privacy. For software vendors handling health data, SOC 2 Type II is the relevant certification:
| SOC 2 Trust Service Criteria | What It Evaluates | Relevance to Audiometric Records |
|---|---|---|
| Security | Protection against unauthorized access (logical and physical) | Access controls to prevent unauthorized viewing of audiometric records |
| Availability | System availability per SLA commitments | Records accessible for OSHA and employee requests without delay |
| Processing Integrity | Processing is complete, accurate, and authorized | Audiograms recorded accurately; STS calculations reliable |
| Confidentiality | Confidential information protected per commitments | Audiometric data not disclosed to unauthorized parties |
| Privacy | Personal information handled per privacy notice | PHI used only for stated purposes; no unauthorized secondary use |
SOC 2 Type I evaluates whether controls are properly designed at a point in time. SOC 2 Type II evaluates whether controls are operating effectively over a period of time (typically 6–12 months). Type II is the meaningful certification for ongoing data security assurance.
When evaluating HCP software vendors, the relevant questions are: (1) Do you have SOC 2 Type II certification? (2) Is the SOC 2 report current (issued within the past 12 months)? (3) Can you provide the SOC 2 report for review? Vendors who cannot answer these questions affirmatively are not operating at the security standard appropriate for 30-year medical record custody.
The occupational hearing conservation industry has historically been a low-technology sector. Most legacy HCP vendors — CAOHC-certified audiometric testing companies, mobile testing van operators, and traditional occupational health clinics — were built before cloud security certifications existed as a concept. The result:
| Common Vendor Gap | Risk to Employer | HIPAA/Security Implication |
|---|---|---|
| No SOC 2 certification | No independent verification that security controls work as described | Vendor claims of security cannot be verified by audit |
| No BAA offered or executed | Employer is out of HIPAA compliance for every audiogram stored | Per-violation penalty exposure; no breach notification obligation on vendor |
| Records in proprietary format | Vendor lock-in; records inaccessible if vendor closes or is acquired | 30-year retention obligation may not be satisfiable |
| Paper-based records scanning | Physical storage creates physical breach risk; no audit trail for access | HIPAA requires audit logs for ePHI access; paper cannot produce these |
| Shared database environments | Employer records co-mingled with other employers without logical separation | Confidentiality controls may be insufficient for PHI |
| No encryption at rest | Database breach exposes all audiometric records in readable form | Required under 45 CFR 164.312(a)(2)(iv) |
Many HCP software companies are acquired by larger occupational health conglomerates. When acquisition occurs, your BAA may no longer be valid (the acquiring entity is a new legal entity), your data may be migrated to a different platform with different security characteristics, and your contractual protections may not transfer. Employers should review BAA and data ownership terms whenever an HCP vendor is acquired.
A breach of unsecured PHI triggers HIPAA notification requirements under 45 CFR Part 164, Subpart D. When audiometric records are compromised through your HCP vendor:
HIPAA civil penalties for a breach caused by a vendor without a BAA fall into the “did not know” category at minimum — $100 to $50,000 per violation, with annual maximums. Criminal penalties under HIPAA can reach $250,000 and 10 years imprisonment for intentional misuse. HHS OCR has actively enforced against employers who failed to execute BAAs before sharing PHI with vendors.
Beyond security and HIPAA, audiometric record storage creates a practical operational risk that employers rarely model before signing multi-year HCP contracts: what happens when you want to change vendors?
Any HCP software agreement should include: (1) data export in a standard, non-proprietary format (CSV, HL7 FHIR, or equivalent) upon request or termination, (2) certified destruction or return of PHI upon termination (per HIPAA BAA requirements), (3) format compatibility documentation, and (4) no data deletion within 30 days of termination notice.
Soundtrace was built from the ground up as a cloud-native, security-first platform for audiometric records management. Key differentiators:
Yes, when they are created, received, maintained, or transmitted by a covered entity or Business Associate (including an HCP software vendor). Audiometric records are individually identifiable health information, satisfying the PHI definition under 45 CFR 160.103. When stored by a cloud-based HCP platform, they are ePHI subject to the full HIPAA Security Rule requirements.
A Business Associate Agreement (BAA) is a HIPAA-required contract between a covered entity and any vendor that creates, receives, maintains, or transmits PHI on the covered entity’s behalf. Without a BAA, an employer operating without one is out of HIPAA compliance for every audiometric record stored by their vendor. If a breach occurs without a BAA in place, the employer bears full notification and penalty exposure with no contractual recourse against the vendor.
SOC 2 Type II means an independent audit firm has tested the vendor’s security controls (access management, encryption, availability, incident response, etc.) over a sustained period — typically 6–12 months — and confirmed they operate effectively. Type II is meaningfully different from Type I (which only evaluates design, not operation). SOC 2 Type II provides the highest level of independent assurance that a vendor’s security controls actually work.
OSHA 1910.95(m) requires audiometric records to be retained for the duration of employment plus 30 years after the employee leaves. This means records for a worker who starts at 22 and retires at 62 must be kept until they are 92 — a potential 70-year retention period. This is the most demanding retention requirement in OSHA’s general industry standards.
Without a BAA, the vendor has no contractual obligation to notify you of a breach. You may not discover the breach at all. If discovered, HIPAA penalties apply to the employer as the covered entity, with no contractual path to recover costs from the vendor. Civil penalties range from $100 to $50,000 per violation category per year, with OCR actively pursuing enforcement actions against employers who failed to execute BAAs.
Soundtrace is SOC 2 certified, HIPAA compliant, and provides a Business Associate Agreement to every client. 30-year record retention, AES-256 encryption at rest, full audit logging — built for the long haul.
Get a Free Quote