What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
No. Buying or using a password manager does not, by itself, make an organization compliant with GDPR or HIPAA, and a SOC 2 report is not a blanket compliance certificate. A password manager may help support secure authentication and access practices, but the organization remains responsible for assessing risk, choosing and configuring safeguards, documenting responsibilities, and reviewing whether those safeguards work.
What each framework does—and what a password manager can do
GDPR, HIPAA, and SOC 2 address different things. GDPR and HIPAA impose obligations on organizations within their scope; SOC 2 is an assurance-report framework for service organizations. A password manager is a possible security control, not a substitute for those obligations or an assurance report.
| Framework | What it addresses | What it means for a password manager |
|---|---|---|
| GDPR Article 32 | Risk-appropriate security measures for processing personal data. | It does not name password managers as a required technology. A manager may support credential and access practices if it fits the organization’s assessed risks. |
| HIPAA Security Rule | Safeguards for electronic protected health information (ePHI) handled by covered entities and business associates. | It does not require a particular password manager. The organization must assess its own risks and safeguards; a vendor’s role and contractual obligations depend on the actual service and data flows. |
| SOC 2 | An assurance report concerning a service organization. | A report may be one input to vendor due diligence. It does not, by itself, establish GDPR or HIPAA compliance or transfer the customer’s responsibilities. |
Does GDPR require a password manager?
No. GDPR Article 32 requires controllers and processors to implement technical and organizational measures that provide a level of security appropriate to risk. In deciding what is appropriate, it calls for consideration of the state of the art, implementation costs, the nature, scope, context, and purposes of processing, and the likelihood and severity of risks to people.
Free tools Windows power users keep installed
One-click scans. No signup required.
What Article 32 names
The article gives examples of measures, including pseudonymisation and encryption; the ability to maintain ongoing confidentiality, integrity, availability, and resilience; the ability to restore access to personal data after an incident; and regular testing and evaluation of security measures. It does not prescribe a password-manager brand or require a password manager as a specific technology.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Where a manager may fit
A password manager may help an organization use unique credentials and manage access. Whether it is suitable depends on the organization’s risks, configuration, authentication choices, access governance, recovery arrangements, and ability to evaluate the control over time. Using one is not proof that the overall processing is secure or that Article 32 has been met.
Does a password manager make an organization HIPAA compliant?
No. HIPAA Security Rule compliance is specific to the organization and its handling of ePHI, and it is an ongoing responsibility—not a product feature. HHS Office for Civil Rights (OCR) puts it plainly: “Compliance is different for each organization and no single strategy will serve all covered entities.”
Build safeguards around the organization’s risk
HHS describes a practical foundation of risk analysis, reasonable and appropriate safeguards, written policies and documentation, and periodic evaluation of technical and non-technical safeguards. A password manager can be considered as one part of that work, but cannot replace the broader program.
Rank #2
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Use risk to choose authentication
NIST Special Publication 800-66 Rev. 2, published February 14, 2024, provides implementation guidance for HIPAA-regulated entities. Its authentication guidance recommends selecting methods based on risk analysis and risk management, and asks organizations to consider multifactor authentication (MFA) for high-risk ePHI access, such as remote access or privileged functions. It also prompts consideration of whether passwordless methods can address the relevant risk.
This is risk-based guidance, not a universal statutory command to buy a password manager or enable one prescribed factor for every user. A hardware security key can be an optional second factor where the manager and connected services support that method; it is not a requirement established for every user by this guidance.
Decide whether a cloud vendor needs a BAA
HHS says a cloud service provider that creates, receives, maintains, or transmits ePHI for a covered entity or business associate generally must enter into a business associate agreement (BAA). Whether a particular password-manager provider is a business associate depends on the service, information, and relationship—not simply on the product category. Determine what the service actually handles and whether the agreement covers that service.
Rank #3
- ✅ PROTECT ONLINE ACCOUNTS – A password manager, two-factor security key, and secure communication token in one, OnlyKey can keep your accounts safe even if your computer or a website is compromised. OnlyKey is open source, verified, and trustworthy.
- ✅ UNIVERSALLY SUPPORTED – Works with all websites including Twitter, Facebook, GitHub, and Google. Onlykey supports multiple methods of two-factor authentication including FIDO2 / U2F, Yubico OTP, TOTP, Challenge-response.
- ✅ PORTABLE PROTECTION – Extremely durable, waterproof, and tamper resistant design allows you to take your OnlyKey with you everywhere.
- ✅ PIN PROTECTION – Locking your device means that if this device is stolen, data remains secure, after 10 failed attempts to unlock all data is securely erased.
- ✅ EASY LOG IN – No need to remember multiple passwords because by plugging OnlyKey to your computer, it automatically inputs your username and password. It works with Windows, Mac OS, Linux, or Chromebook, just press a button to login securely!
Encryption does not remove the need to assess the arrangement. HHS OCR explains: “While encryption protects ePHI by significantly reducing the risk of the information being viewed by unauthorized persons, such protections alone cannot adequately safeguard the confidentiality, integrity, and availability of ePHI as required by the Security Rule.” Encryption alone does not address every requirement, including integrity, availability, contingency planning, administrative safeguards, and physical safeguards. HHS also says that encrypted “no-view” storage does not, by itself, exempt a cloud provider from applicable business associate duties. Responsibilities such as customer authentication and provider encryption should be understood and documented between the parties.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →What does SOC 2 tell you about a password-manager vendor?
A SOC 2 report can be considered as part of vendor due diligence, but do not treat the label as a government compliance certificate or as proof that your organization meets GDPR or HIPAA obligations. A report concerns a service organization; it does not assume the customer’s responsibility for its own systems, configuration, and use.
Ask the vendor and your auditor to review the actual report rather than relying on a marketing statement. As practical due diligence, check the report type, examination period, system boundaries, criteria included, exceptions, subservice organizations, complementary user-entity controls, and report date. These are questions for understanding a particular report; they should not be mistaken for a verified list of current AICPA requirements.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
How to evaluate a password manager for a regulated use case
Start with your data flow and risk, then evaluate the service in the context of your organization’s safeguards. These questions are due-diligence prompts, not a claim that every item is a separately mandated feature of every password manager.
- Define the use case. Identify which users will use the manager, what accounts they will access, and whether personal data or ePHI is involved.
- Map vendor data handling. Ask what information the provider receives, maintains, or transmits on your behalf, including whether the service handles credentials or any ePHI.
- Resolve contractual scope. If ePHI is involved, determine whether a BAA is required for the actual relationship and whether it covers the selected service.
- Clarify control ownership. Establish who configures authentication, MFA, account recovery, access controls, backups, incident handling, and administrator access.
- Inspect independent assurance. Review any available report’s scope, period, exceptions, and customer responsibilities with the vendor and your auditor; do not rely on a badge or broad claim alone.
- Document and revisit. Record why the chosen controls fit the assessed risk, retain evidence, and periodically evaluate whether they remain effective.
What “certified compliant” does—and does not—mean
HHS OCR states: “No, there is no standard or implementation specification that requires a covered entity to ‘certify’ compliance.” HHS does not endorse private HIPAA certifications, and obtaining one does not absolve a covered entity of its legal obligations. Treat claims of certification or compliance as a prompt to examine what was assessed, by whom, against which scope, and when—not as a substitute for your own compliance work.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
