HIPAA Compliant VPN: How to Self-Host Secure Remote Access for a Clinic

A physician who reviews charts from home, a billing contractor who logs into the practice management system, a front-desk manager checking the schedule on a Sunday night: every one of them is remote access to electronic protected health information (ePHI). For a clinic, a HIPAA compliant VPN is the most common way to make that access encrypted, authenticated, and logged. This guide explains what HIPAA actually requires of remote access, how a self-hosted VPN maps to those requirements, and how a small or mid-sized clinic can set one up with OpenVPN Access Server.

Does HIPAA require a VPN?

No. The HIPAA Security Rule is technology-neutral. It never names a VPN, a vendor, or a protocol. What it requires is a set of outcomes for any system that creates, receives, maintains, or transmits ePHI, including remote access to it. HHS and its guidance documents have long pointed to VPNs as a reasonable way to protect remote sessions, which is why "HIPAA compliant VPN" is the shorthand most IT teams use.

The phrase deserves one caveat up front: no product is HIPAA compliant on its own. HIPAA compliance belongs to the covered entity, meaning your clinic, and is the sum of your risk analysis, policies, workforce training, and technical controls. A VPN is a tool that helps you meet specific technical safeguards. How you configure and operate it decides whether it actually does.

The Security Rule safeguards a VPN helps you meet

Four technical safeguards in 45 CFR 164.312 are directly relevant to remote access:

• Access control, 164.312(a). Only authorized people get to ePHI, each with a unique user ID, with automatic logoff and an emergency access procedure.
• Audit controls, 164.312(b). You record and can examine activity in systems that contain or use ePHI.
• Person or entity authentication, 164.312(d). You verify that the person seeking access is who they claim to be.
• Transmission security, 164.312(e). ePHI is protected from unauthorized access while it travels over a network, with encryption as an implementation specification.

Under the current rule, encryption in transit is "addressable." That does not mean optional. It means you must implement it or document why an equivalent alternative is reasonable. For remote access over the internet, it is hard to write that justification, so in practice encryption is expected.

What the proposed 2025 Security Rule update would change

In January 2025, HHS published a proposed overhaul of the Security Rule. It would remove the required/addressable distinction, make encryption of ePHI in transit and at rest mandatory with limited exceptions, require multi-factor authentication (MFA) for access to ePHI, and require a written technology asset inventory and network map. As of this writing, the proposal has not been finalized and the current rule remains in effect. Still, a remote access setup built today should already enforce encryption and MFA for everyone. If the rule is finalized, you will be ready. If it isn't, you have closed two of the most common gaps auditors and attackers find.

Why a clinic would choose a self-hosted HIPAA compliant VPN

Clinics have more remote access options than ever, from consumer VPNs to cloud-delivered zero trust services. Self-hosting has a few specific advantages for healthcare.

ePHI never passes through a vendor's infrastructure

With a self-hosted VPN, the server runs on hardware or a cloud instance you control. Encrypted tunnels terminate inside your environment, so the traffic carrying ePHI does not route through a third party's network. That keeps your data flow simple to document in your risk analysis.

A simpler business associate picture

Under HIPAA, a vendor that creates, receives, maintains, or transmits ePHI on your behalf is a business associate and needs a business associate agreement (BAA). When you license software and run it yourself, the software vendor generally does not handle your ePHI, which can reduce the number of BAAs you need to manage. Confirm the specifics of your arrangement with your compliance officer or counsel. Consumer VPN services, by contrast, are almost never appropriate for ePHI and typically will not sign a BAA.

Control over logs and retention

HIPAA requires you to keep documentation for six years. When you host the VPN, connection logs live where you decide, so you can feed them to the same syslog server or SIEM that holds your EHR audit trail.

Predictable cost for a small team

Access Server is licensed by concurrent connections, so a clinic with a handful of remote users does not pay for a large enterprise platform. It runs on a modest Linux VM on-premises or in your own AWS, Azure, or Google Cloud account.

Mapping HIPAA safeguards to Access Server

OpenVPN, Inc. also completed its own HIPAA compliance assessment and holds a SOC 2 Type 2 attestation and ISO/IEC 27001:2022 certification covering Access Server. You can review the details on the OpenVPN compliance page. That helps with vendor due diligence, though it doesn't replace your own controls.

A reference setup for a small clinic

Here is a practical layout for a practice with one location, 10 to 50 staff, an on-premises or hosted EHR, and a few remote users.

1. Deploy Access Server on its own VM. Put it in a DMZ or a dedicated subnet, not on the same host as the EHR database. Expose only the VPN port to the internet.
2. Connect it to your identity provider. If the clinic uses Microsoft Entra ID, Google Workspace, or Okta, use SAML so that disabling a departing employee in one place cuts off VPN access too. Otherwise, use LDAP against Active Directory.
3. Turn on MFA for every user. No exceptions for physicians or owners. They are the accounts attackers most want.
4. Create groups by role. For example: clinicians reach the EHR application server, billing reaches the practice management system, and IT reaches management interfaces. Nobody gets the whole network by default.
5. Use full-tunnel routing for ePHI access. Sending all traffic through the VPN while connected means a remote laptop on hotel Wi-Fi isn't splitting sessions between protected and unprotected paths.
6. Set idle and session timeouts. Short idle timeouts support the automatic logoff specification.
7. Forward logs. Send VPN logs to your syslog server or SIEM and keep them in line with your retention policy.
8. Patch and back up. Keep the OS and Access Server current, and back up the configuration so you can restore the VPN quickly after an incident.

Remote vendors and EHR support

Many clinics give their EHR vendor or managed service provider standing remote access. Put each vendor in its own group, restrict it to the systems in its contract, and disable the account when it isn't needed. Make sure every vendor with access to ePHI is covered by a BAA.

HIPAA compliant remote access checklist

• Remote access is included in your current HIPAA risk analysis and asset inventory.
• Every remote user has a unique account tied to your identity provider.
• MFA is enforced for all remote access to systems containing ePHI.
• Access rules limit each role to the systems it needs.
• All remote traffic is encrypted with modern ciphers, with FIPS mode enabled if your policies call for it.
• Idle sessions time out automatically.
• VPN logs are centralized, reviewed, and retained.
• Vendor accounts are separate, limited, and covered by BAAs.
• Policies, procedures, and configuration decisions are documented and kept for six years.

Common mistakes that undermine a HIPAA VPN

• Shared accounts. One "frontdesk" login used by four people defeats unique user identification and makes audit logs meaningless.
• Flat network access. A VPN that drops every user onto the whole clinic LAN turns one stolen credential into access to everything.
• Exposed RDP instead of a VPN. Publishing remote desktop directly to the internet remains one of the most common ways ransomware gets into healthcare organizations.
• Unpatched VPN appliances. Edge devices are frequent targets. Whatever you run, have a plan to patch it quickly.
• No log review. Collecting logs satisfies part of 164.312(b). Reviewing them is what actually catches misuse.

Frequently asked questions

What is a HIPAA compliant VPN?

It's a VPN configured to support the HIPAA Security Rule's technical safeguards: strong encryption in transit, unique user identification, strong authentication (ideally MFA), least-privilege access, and audit logging. The VPN supports your compliance. Your clinic's policies and operation of it complete the picture.

Do I need a BAA with my VPN vendor?

If the vendor creates, receives, maintains, or transmits ePHI for you, as a hosted service routing your traffic may, you need a BAA. If you run self-hosted VPN software on your own infrastructure, the software vendor generally does not handle ePHI. Confirm with your compliance advisor.

Is OpenVPN HIPAA compliant?

OpenVPN completed a HIPAA compliance assessment of its policies and platforms, and Access Server provides the encryption, authentication, access control, and logging controls a clinic needs. Your clinic is still responsible for configuring and operating it as part of your HIPAA program.

Is a free or consumer VPN acceptable for accessing patient data?

Generally, no. Consumer VPNs are built for privacy on public Wi-Fi, not for controlled access to your clinic's systems. They don't give you per-user access control or audit logs, and they don't connect users to your private network.