CMMC vs HIPAA

Organisations working across military health, TRICARE-adjacent programmes or defense medical research often arrive at CMMC assuming their HIPAA programme has done most of the work. It has done less than they expect, and the reason is structural rather than a matter of coverage.

The structural difference

HIPAA’s Security Rule is risk-based. It separates implementation specifications into required and addressable. An addressable specification is not optional, but you may implement an equivalent alternative, or document why it is not reasonable and appropriate for your environment. The obligation is to conduct a risk analysis and justify your decisions.

NIST SP 800-171 is prescriptive. There are 110 requirements assessed against 320 objectives, and a requirement is either implemented or it is not. There is no addressable category and no mechanism for documenting that a control is unreasonable for you. The only latitude is the narrow POA&M eligibility in 32 CFR 170.21, which generally covers one-point requirements only.

That difference is why a mature HIPAA programme transfers less than it should. The habits it builds — risk analysis, documented justification, reasonable alternatives — are precisely the habits that produce a failing 800-171 assessment.

Where they do overlap

Genuine and worth using. Both regimes want access control, audit logging, encryption, workforce training, incident response and media handling. An organisation running a competent HIPAA programme will have artefacts and processes that map across.

The efficient approach is a crosswalk: map your existing HIPAA controls to the 110 requirements, identify where an existing control satisfies the objectives, and treat the remainder as new work. Expect the remainder to be substantial — particularly in Configuration Management, Audit and Accountability, and Security Assessment, where HIPAA sets a lower floor.

Where the gap is biggest

Three areas consistently:

FIPS-validated cryptography. HIPAA expects encryption and is relatively agnostic about implementation. Requirement 3.13.11 asks for validated modules with CMVP certificates, configured in FIPS mode. It is the most-failed requirement in published DIBCAC data, and HIPAA programmes almost never satisfy it by accident.

Audit and Accountability. HIPAA requires audit controls; 800-171 requires defining which events are logged, alerting when logging fails, correlating and reviewing records, and protecting the records themselves. Three of the ten most-failed requirements sit in this family.

The System Security Plan. HIPAA has no direct equivalent to requirement 3.12.4. A HIPAA risk analysis is not an SSP, and submitting one in its place means an assessment cannot be completed. See the SSP template.

When PHI and CUI share a system

This is the situation that actually brings people to this page, and it is more common than the frameworks anticipate. A system supporting a military health programme can hold protected health information and controlled unclassified information simultaneously.

Both regimes apply to it, and where they conflict the stricter control governs. In practice that means 800-171 sets the technical baseline, because it is prescriptive, and HIPAA’s administrative and organisational requirements sit on top.

One planning consequence worth noting: the scoping instincts differ. HIPAA scoping tends to follow PHI by system and business associate relationship. CUI scoping follows the information wherever it travels, including into mailboxes and local copies. Applied to the same environment they produce different boundaries, and the CUI boundary is usually wider. See finding CUI in your environment.

Enforcement works differently too

A HIPAA covered entity answers to the Office for Civil Rights, and enforcement is predominantly complaint- and breach-driven: something happens, it is reported, and an investigation follows. The posture question is asked after an event.

Under DFARS the question is asked before the work. A score posted to SPRS is a representation made to the government in connection with an award, and 252.204-7019 makes a current assessment a condition of eligibility. That changes what inaccuracy means: an overstated HIPAA risk analysis is a weakness in your programme, while an overstated SPRS score is a statement relied on in awarding a contract, which is the theory on which False Claims Act matters in this area have proceeded. A contractor settled for roughly $500,000 in June 2026 over scores DoD audits contradicted.

For a HIPAA-fluent team the practical adjustment is to treat the score with the care normally reserved for a certification statement rather than for an internal assessment. See how SPRS scoring works.

Where to start

With the clauses, not with the existing programme. DFARS 252.204-7012 is what creates the CUI obligation, and it does not care what your HIPAA posture is. Establish whether it appears in your contracts, then scope, then crosswalk what you already have against the 110 requirements.

Doing it in the other order — starting from the HIPAA programme and asking what else is needed — produces a plan anchored to the wrong framework. Start at the clause test.