Are you covered by HIPAA?
HIPAA applies to covered entities, such as healthcare providers and health plans, and to their business associates. If your company creates, receives, maintains or transmits protected health information (PHI) on behalf of a covered entity, you are a business associate and carry direct HIPAA obligations. This can apply to companies based outside the US as well, if they handle PHI for US customers.
The business associate agreement
Before sharing PHI, a covered entity will ask you to sign a business associate agreement (BAA). It sets out how you may use and protect the data and what happens in a breach. Expect to sign BAAs with customers and to put matching terms in place with your own subcontractors, such as cloud providers.
What the Security Rule expects
The Security Rule requires administrative, physical and technical safeguards for electronic PHI. In practice that means a documented risk analysis, access controls, audit logging, encryption where appropriate, workforce training, incident response and contingency plans. The rule is flexible and scales with your size, but the risk analysis is not optional.
Breach notification
If unsecured PHI is breached, notification duties apply to affected individuals and to the covered entity, without unreasonable delay and within the outer limits the rule sets. Have an incident response process and know who to notify before anything happens.
There is no official HIPAA certificate
No government body certifies HIPAA compliance. You show it through documentation, implemented safeguards, training, BAAs and often an independent assessment. Many health-tech vendors also hold SOC 2 or ISO 27001 to give partners stronger third-party proof. See our SOC 2 page and ISO 27001 page.
Where a startup should start
- Confirm whether you handle PHI and in what role.
- Run a Security Rule risk analysis and record the results.
- Fix the high risks first: access, logging, encryption and vendor controls.
- Put policies, training and BAAs in place.
- Keep evidence as you go, so an assessment is straightforward.
What a health system will ask before it signs
A hospital or health plan usually sends a security questionnaire alongside the contract. Expect questions about where protected health information is stored, how it is encrypted in transit and at rest, who can access it and how that access is logged, how staff are trained, and how you would handle an incident. They may also ask for proof of a recent risk analysis and a list of subcontractors that touch the data. Having these answers written down before the request arrives shortens the deal.
Mistakes that cause trouble
- Letting protected health information leak into logs, analytics tools, support tickets and test data.
- Forgetting the vendors that handle the data for you, such as cloud and tooling providers, when you map where it goes.
- Running the risk analysis once and never updating it when the product or infrastructure changes.
- Holding training only on paper, with no record that people completed it.
A gap diagnostic is a practical way to find these before a customer does. Many health-tech buyers also ask for a SOC 2 report, which is covered in our guide to SOC 2 Type I versus Type II.
Next step
We can run the risk analysis, implement safeguards and prepare you for an independent assessment. See our HIPAA page, or book a free advisory session. This article is general information, not legal advice.
