What Makes a DAM HIPAA Compliant? A Guide for Healthcare Teams

What is a HIPAA-compliant DAM?

A digital asset management system, or DAM, gives organizations one place to store, organize, find, control, and share photos, videos, graphics, documents, and other digital content.

The Health Insurance Portability and Accountability Act, better known as HIPAA, establishes national requirements for protecting sensitive patient information. Its Security Rule requires covered entities and their business associates to protect electronic protected health information (ePHI) through administrative, physical, and technical safeguards.

A HIPAA-compliant DAM provides the security capabilities needed to protect ePHI stored or shared through the platform. However, HIPAA does not certify software products as compliant. Compliance depends on the vendor’s safeguards, the organization’s policies, and how the DAM is configured and used.

Does your DAM actually need to be HIPAA compliant?

Not every image or video created by a healthcare organization falls under HIPAA. Brand graphics, stock photography, facility photos without patients, and other content that cannot identify an individual fall outside its requirements.

HIPAA becomes relevant when an asset identifies someone and connects that person to healthcare, payment, or a medical condition. In a marketing or communications library, that could include:

• Patient photos, videos, or audio recordings
• Before-and-after treatment images
• Patient testimonials or personal stories
• Clinical or research imagery tied to an individual
• Consent and authorization forms
• Captions or metadata containing names, medical record numbers, treatment dates, diagnoses, or other identifying details

A face can also identify a patient. HHS includes full-face photographs and comparable images among the identifiers that must be addressed when de-identifying health information. An image that appears harmless could still reveal sensitive information through its caption, metadata, folder name, or surrounding context.

If your DAM creates, receives, maintains, or transmits ePHI, include it in your organization’s HIPAA risk analysis. You also need valid patient authorization before using identifiable patient content for marketing. That authorization permits an approved use, but the asset still needs protection while it’s stored, reviewed, and shared.

A general file-storage platform should not be considered suitable simply because it can hold and share files. Healthcare organizations should confirm that any system containing ePHI meets their legal, privacy, and security requirements.

Safeguards that make a DAM HIPAA compliant

Security features only matter when they protect content from the people, devices, and decisions that could expose it. The HIPAA Security Rule addresses those risks through administrative, physical, and technical safeguards.

Safeguard type	What it addresses	What it looks like for a DAM	Responsibility
Administrative	The people, policies, and procedures used to protect ePHI	Risk assessments, security training, access reviews, incident response, backup planning, and assigned security roles	The healthcare organization leads these practices, while the vendor provides documentation and supporting controls
Physical	The facilities, devices, and media that store or access ePHI	Restricted hosting facilities, secured workstations, protected mobile devices, and procedures for reusing or disposing of equipment	The vendor protects its infrastructure; the healthcare organization secures its devices and physical environment
Technical	The technology controlling access to and activity within the system	Unique accounts, detailed permissions, authentication, activity records, encryption, integrity protections, and secure sharing	The vendor builds and maintains the controls; the healthcare organization configures and monitors them

Administrative safeguards

Administrative safeguards establish who is responsible for protecting ePHI and what that responsibility requires. They turn security from a general expectation into documented practices.

For a DAM, those practices should cover:

• Regular risk assessments
• Defined security roles
• Employee training
• Access approval and removal
• Incident response and reporting
• Data backup and recovery planning
• Periodic policy evaluations

Healthcare organizations should document who will upload patient content, who will approve its use, and who will make it available to others. They should also review access when employees change roles or leave the organization.

Physical safeguards

Digital content depends on physical infrastructure. Servers, office computers, mobile devices, and removable media can all provide a path to sensitive information.

A DAM vendor should restrict and monitor access to the facilities and equipment used to store customer data. Healthcare organizations must also secure the devices their employees use to reach that data.

That includes protecting workstations, requiring authentication on mobile devices, and preventing sensitive assets from being saved to unmanaged equipment. Organizations also need procedures to remove ePHI before reusing or discarding a device or storage medium.

Technical safeguards

Technical safeguards control what users can do once they enter the DAM. They help prevent unauthorized access, detect unusual activity, and protect files as they move through the system.

Important controls include:

• Unique user accounts
• Role-based permissions
• Single sign-on or multifactor authentication
• Records of user and asset activity
• Protection against improper changes or deletion
• Encryption for stored and transmitted data
• Secure sharing and session controls

These protections should extend beyond the library level. An employee needs access to an approved campaign gallery without being able to view the patient imagery stored elsewhere in the DAM.

The Business Associate Agreement (BAA)

If a DAM vendor stores ePHI for you, HIPAA requires a business associate agreement. The BAA spells out how the vendor will protect patient information and report a breach.

PhotoShelter, for example, reviews and signs your organization’s BAA on request. Your legal team keeps the terms it already trusts, and your patient content stays covered.

What to look for when choosing a HIPAA-compliant DAM

Once you know which safeguards matter, the next question is whether a vendor can prove that its protections work. A polished demonstration and a “HIPAA-ready” claim are not enough.

Use the evaluation process to test the platform under conditions that resemble your organization’s actual work.

Bring a realistic use case to the demonstration. Ask the vendor to show how a patient story would move from upload through legal review, restricted storage, approval, and publication. This reveals where access could be granted too broadly or sensitive content could be shared too early.

Request a clear division of responsibility. The vendor should explain which protections it manages and which settings, policies, and employee actions remain your organization’s responsibility. Unclear ownership creates gaps that neither side will recognize until something goes wrong.

Ask for evidence behind security claims. Review current security documentation, independent assessments, and incident-response commitments. SOC 2 reports and standards such as ISO 27001 can provide useful evidence, but neither serves as a HIPAA certification.

Investigate a simulated mistake. Ask the vendor to show how an administrator would identify who shared an asset, where it went, and how access could be removed. This tests whether the system provides useful answers rather than simply logging activity.

Follow your data beyond the main platform. Find out where customer data is stored, which subcontractors handle it, how backups are managed, and what happens when your contract ends. The vendor should be able to explain how it returns assets and when it deletes remaining copies.

Speak with healthcare customers. References can explain what the vendor’s security review required, how it handled implementation decisions, and how the platform performs after launch. Ask to speak with organizations that manage content similar to yours.

Privacy, security, legal, IT, and communications teams should evaluate the DAM together. Each group sees a different part of the risk, and a platform must stand up to all of their questions.

The cost of getting it wrong

A HIPAA violation does not always begin with a cyberattack. It can begin with a patient photo that reaches a website before anyone confirms how it will be used.

In 2016, the HHS Office for Civil Rights reached a $25,000 settlement with Complete P.T. after the physical therapy provider published patient testimonials containing full names and full-face photographs without valid HIPAA authorizations. The organization also had to complete a corrective action plan and report on its compliance efforts for one year.

The consequences can be much larger. New York-Presbyterian Hospital agreed to a $2.2 million settlement after allowing a television crew to film patients without prior authorization. The agreement included two years of monitoring.

These cases were not caused by a DAM, but they show what can happen when patient content moves from creation to publication without adequate oversight. The cost can include settlement payments, legal review, corrective action, ongoing government monitoring, and damaged patient trust.

Healthcare marketing often rewards speed. A system holding patient content must provide enough control to stop an unapproved asset before that speed turns one mistake into a public disclosure.

How PhotoShelter helps healthcare teams protect patient content

PhotoShelter lets administrators control who can view, upload, download, manage, and share assets. Private viewing and team-specific spaces keep restricted materials separate from approved brand content, while single sign-on and centralized user management make it easier to grant or remove access.

Stored data is protected with AES-256×2 or stronger encryption, while data in transit uses TLS 1.2 or 1.3. PhotoShelter also holds a SOC 2 Type II attestation, and its European data centers comply with ISO 27001.

The University of Maryland Medical System manages more than 173,000 assets for over 120 invited users in PhotoShelter. Its creative team works with legal and media relations to secure the necessary patient rights and permissions, while detailed access settings restrict who can view or edit specific files. PhotoShelter also helps the organization fulfill roughly 350 visual asset requests each month.

Frequently asked questions about HIPAA-compliant DAMs

Can I store patient photos or authorization forms in a DAM?

A healthcare organization may store patient photos or authorization records in a DAM that it has approved for that purpose. However, the official authorization belongs in a legal, compliance, or records system. The DAM can display an asset’s approval status, permitted uses, and restrictions without serving as the primary record for every patient document.

Does a signed patient authorization mean an asset can be used anywhere?

No. An authorization should identify how the patient’s information will be used or disclosed, along with any applicable limits or expiration terms. Teams must check those conditions before republishing the asset in a new campaign, channel, or context.

Is a HIPAA-compliant DAM different from HIPAA-compliant cloud storage?

Cloud storage is built primarily to save, access, and share files. A DAM is designed to manage visual content throughout its usable life, including its metadata, approval status, usage restrictions, versions, and distribution. Review either platform based on how the organization intends to use it.

Who should evaluate a DAM that may contain ePHI?

Privacy, security, legal, IT, records management, and communications teams should take part in the evaluation. Each group should review the platform based on its area of responsibility, from technical protections and contract terms to patient authorizations and publishing practices.

How often should a healthcare organization review its DAM controls?

Review DAM access, policies, and security settings regularly, and whenever the organization changes its technology, staffing, vendors, or use of patient content. A major platform update, new integration, or change in risk will also require another assessment.