Summary

Even for cloud-based SaaS companies, physical safeguards matter. HIPAA requires you to control physical access to systems that store PHI. HIPAA requires audit controls that record and examine activity in systems containing PHI: HIPAA’s Breach Notification Rule requires specific actions when a breach of unsecured PHI occurs.

HIPAA Checklist for SaaS: Everything You Need to Achieve Compliance in 2024

If your SaaS product touches protected health information (PHI) in any way, HIPAA compliance isn’t optional — it’s a legal requirement. Whether you’re building an EHR integration, a telehealth platform, or a healthcare analytics tool, failing to meet HIPAA standards can result in fines ranging from $100 to $50,000 per violation.

This HIPAA checklist for SaaS companies breaks down exactly what you need to do, organized by category, so you can move from confusion to confident compliance.

Who Needs to Follow This HIPAA Checklist?

Before diving in, it’s important to understand whether HIPAA applies to your SaaS business.

You are likely a Business Associate (BA) under HIPAA if your software:

Stores, processes, or transmits PHI on behalf of a covered entity
Provides cloud storage, data analytics, or communication tools used by healthcare providers
Integrates with EHR/EMR systems that contain patient data

Covered entities include hospitals, clinics, health insurers, and healthcare clearinghouses. If you serve them and handle their PHI, HIPAA applies to you — and this checklist is your starting point.

Section 1: Administrative Safeguards

Administrative safeguards are the policies and procedures that govern how your organization manages PHI. These are often overlooked by technical founders, but they form the backbone of any HIPAA compliance program.

Designate a HIPAA Privacy and Security Officer

Every HIPAA-covered organization must appoint:

A Privacy Officer responsible for PHI policies
A Security Officer responsible for technical and physical security

In small SaaS companies, one person can hold both roles, but the responsibilities must be formally documented.

Conduct a Risk Analysis

A formal, documented risk analysis is arguably the single most important HIPAA requirement. You must:

Identify all systems that store or transmit PHI
Assess the likelihood and impact of potential threats
Document your findings and mitigation strategies
Repeat this process annually or after significant system changes

Implement Workforce Training

Every employee who touches PHI — or systems that could expose PHI — must receive HIPAA training. Your training program should cover:

What counts as PHI and why it’s protected
How to recognize and report a breach
Acceptable use policies for company devices and software
Consequences of non-compliance

Establish Access Management Policies

Define who can access PHI and under what circumstances. Your policies should include:

Role-based access controls (RBAC)
Onboarding and offboarding procedures
Minimum necessary access standards
Regular access reviews (at least annually)

Section 2: Physical Safeguards

Even for cloud-based SaaS companies, physical safeguards matter. HIPAA requires you to control physical access to systems that store PHI.

Data Center and Server Controls

If you use AWS, Google Cloud, or Azure, your cloud provider likely covers physical data center security. However, you still need to:

Use a cloud provider with a signed Business Associate Agreement (BAA)
Document your reliance on the provider’s physical controls
Ensure you understand what’s covered under their shared responsibility model

Workstation and Device Security

Enforce full-disk encryption on all company laptops and workstations
Implement automatic screen lock policies (15 minutes or less)
Establish a mobile device management (MDM) policy
Define procedures for lost or stolen devices

Section 3: Technical Safeguards

This is where most SaaS engineering teams focus their attention — and rightly so. Technical safeguards protect PHI through technology controls.

Encryption Requirements

Data at rest: Encrypt all databases, backups, and file storage containing PHI (AES-256 is the standard)
Data in transit: Use TLS 1.2 or higher for all data transmission
Key management: Implement a formal encryption key management process

Access Controls and Authentication

Enforce multi-factor authentication (MFA) for all users accessing PHI
Implement unique user IDs — no shared logins
Use role-based access controls tied to job functions
Set automatic session timeouts for inactive users

Audit Logging and Monitoring

HIPAA requires audit controls that record and examine activity in systems containing PHI:

Log all access to PHI (who accessed what, when, and from where)
Store logs securely and retain them for a minimum of six years
Set up alerts for anomalous activity (failed logins, bulk data exports, etc.)
Conduct regular log reviews

Integrity Controls

You must ensure PHI is not improperly altered or destroyed:

Implement checksums or hash verification for PHI data
Use version control for critical records
Set up database integrity monitoring

Section 4: Business Associate Agreements (BAAs)

A BAA is a legally required contract between a covered entity and a business associate. As a SaaS company, you’ll need BAAs in two directions.

BAAs You Need to Sign

With your customers: Every healthcare customer using your SaaS product must sign a BAA with you before accessing PHI
With your vendors: Any third-party vendor you use that may access PHI must sign a BAA with you (this includes cloud providers, email services, analytics tools, and support platforms)

Your BAA template must include:

Permitted uses and disclosures of PHI
Safeguard requirements
Breach notification obligations
Terms for termination and return/destruction of PHI

Section 5: Breach Notification Procedures

HIPAA’s Breach Notification Rule requires specific actions when a breach of unsecured PHI occurs.

Build a Breach Response Plan

Your incident response plan should cover:

How to detect and contain a breach
Internal escalation procedures
How to assess whether the incident qualifies as a reportable breach
Documentation requirements for every incident

Notification Timelines

Affected individuals: Must be notified within 60 days of discovering a breach
HHS (Department of Health & Human Services): Must be notified within 60 days; breaches affecting 500+ individuals in a state must also notify prominent local media
Your covered entity customers: You must notify them without unreasonable delay and within 60 days

Section 6: Ongoing Compliance Activities

HIPAA compliance isn’t a one-time project — it requires continuous maintenance.

Annual and Ongoing Requirements

Annual risk analysis: Reassess threats and vulnerabilities every year
Policy reviews: Review and update all HIPAA policies annually
Workforce training: Conduct refresher training at least once per year
BAA audits: Verify all required BAAs are in place and up to date
Penetration testing: Conduct regular security testing of your application
Vendor reviews: Periodically reassess third-party vendors for compliance

HIPAA Compliance Checklist: Quick Reference

Here’s a condensed version you can use for internal reviews:

Administrative

[ ] Privacy Officer and Security Officer designated
[ ] Risk analysis completed and documented
[ ] Workforce HIPAA training conducted
[ ] Access management policies in place

Physical

[ ] Cloud provider BAA signed and physical controls documented
[ ] Workstation encryption and MDM policies enforced

Technical

[ ] PHI encrypted at rest and in transit
[ ] MFA enforced for all PHI access
[ ] Audit logging enabled and monitored
[ ] Session timeouts configured

Legal/Contractual

[ ] BAAs signed with all customers and vendors
[ ] Breach notification procedures documented

Ongoing

[ ] Annual risk analysis scheduled
[ ] Policies reviewed and updated
[ ] Penetration testing completed

Frequently Asked Questions

Is HIPAA compliance required for SaaS companies that only store de-identified data?

No — if data has been properly de-identified according to HIPAA’s Safe Harbor or Expert Determination method, it is no longer considered PHI and HIPAA requirements don’t apply. However, de-identification must be done correctly and thoroughly documented. Improperly de-identified data still carries risk.

Does using AWS or Azure automatically make my SaaS HIPAA compliant?

No. Cloud providers like AWS, Azure, and Google Cloud offer HIPAA-eligible services and will sign a BAA, but compliance is a shared responsibility. You are still responsible for configuring services securely, managing access, encrypting data, and maintaining all required policies and procedures.

How long does it take for a SaaS company to become HIPAA compliant?

For a small to mid-sized SaaS company starting from scratch, expect the process to take 3 to 6 months to implement properly. This includes completing a risk analysis, developing policies, implementing technical controls, training staff, and executing BAAs. Using pre-built compliance templates can significantly reduce this timeline.

What’s the difference between HIPAA compliance and HIPAA certification?

There is no official HIPAA certification issued by the government. Some third-party organizations offer HIPAA compliance assessments or attestations, which can be valuable for demonstrating your compliance posture to enterprise customers. However, these do not replace the actual compliance obligations under the law.

What happens if we have a breach before we’re fully HIPAA compliant?

Non-compliance combined with a breach is a serious situation. HHS can impose civil monetary penalties, and in cases of willful neglect, criminal charges are possible. Acting quickly to contain the breach, notify affected parties, and demonstrate good-faith remediation efforts can influence how regulators respond.

Start Your HIPAA Compliance Journey Today

Working through HIPAA compliance from scratch is time-consuming and easy to get wrong. Missing a single required policy or leaving a BAA unsigned can expose your company to significant legal and financial risk.

Save weeks of work with our ready-to-use HIPAA compliance template bundle. Our professionally drafted templates include:

Complete HIPAA Security and Privacy Policies
Risk Analysis Worksheet
Business Associate Agreement (BAA) Template
Workforce Training Acknowledgment Forms
Breach Notification Procedures and Incident Response Plan
Vendor Assessment Checklist

These templates are written by compliance experts, formatted for immediate use, and trusted by SaaS companies at every stage of growth.

👉 Browse our HIPAA compliance templates and get compliant faster →