Summary

If you’re building or operating a B2B SaaS company that handles health information, HIPAA compliance isn’t optional—it’s a legal obligation. Whether your platform serves hospitals, clinics, insurance companies, or wellness apps, understanding exactly what HIPAA requires of you can mean the difference between a thriving business and a six-figure penalty. This is where most B2B SaaS companies need to focus the most attention. The Security Rule requires Business Associates to implement administrative, physical, and technical safeguards to protect electronic PHI (ePHI). - Willful neglect violations carry mandatory penalties

HIPAA Requirements for B2B SaaS: What You Need to Know to Stay Compliant

This guide breaks down the core HIPAA requirements for B2B SaaS companies, explains who qualifies as a Business Associate, and outlines the specific safeguards your organization needs to implement.

Who Does HIPAA Apply to in the SaaS World?

HIPAA (the Health Insurance Portability and Accountability Act) was originally designed for healthcare providers, health plans, and clearinghouses—known as Covered Entities. But the law also extends to any vendor or technology partner that creates, receives, maintains, or transmits Protected Health Information (PHI) on behalf of those entities.

These vendors are called Business Associates (BAs), and most B2B SaaS companies serving the healthcare space fall squarely into this category.

Are You a Business Associate?

You’re likely a Business Associate if your SaaS platform:

Stores, processes, or transmits PHI for a healthcare client
Provides data analytics, billing, or EHR integration services
Offers cloud storage, hosting, or infrastructure used to handle PHI
Sends communications (email, SMS, chat) containing patient information
Provides HR or benefits administration tools that touch health records

If any of these apply, HIPAA requirements are not just your client’s problem—they’re yours too.

The Core HIPAA Rules That Apply to B2B SaaS

1. The Privacy Rule

The HIPAA Privacy Rule governs how PHI can be used and disclosed. As a Business Associate, you must:

Only use or disclose PHI as permitted by your Business Associate Agreement (BAA)
Avoid using PHI for purposes beyond what your client has authorized
Support individuals’ rights to access their own health information
Report any unauthorized use or disclosure of PHI to the Covered Entity

The Privacy Rule doesn’t require you to give patients direct access to their records (that’s the Covered Entity’s job), but it does require you to cooperate when access requests come through.

2. The Security Rule

This is where most B2B SaaS companies need to focus the most attention. The Security Rule requires Business Associates to implement administrative, physical, and technical safeguards to protect electronic PHI (ePHI).

Administrative Safeguards include:

Conducting a formal, documented Risk Analysis
Implementing a Risk Management Plan to address identified vulnerabilities
Designating a HIPAA Security Officer
Training employees on security policies and procedures
Establishing access management and workforce clearance procedures

Physical Safeguards include:

Controlling physical access to systems that store ePHI
Implementing workstation use policies
Managing device and media controls (including secure disposal)

Technical Safeguards include:

Unique user identification and authentication
Automatic logoff and encryption of ePHI at rest and in transit
Audit controls to track access and activity
Transmission security (TLS, VPNs, etc.)

3. The Breach Notification Rule

If a breach of unsecured PHI occurs, you have specific obligations under the Breach Notification Rule:

Notify the Covered Entity without unreasonable delay, and no later than 60 days after discovering the breach
Document all breach investigations, even if you determine no notification is required
Cooperate with the Covered Entity’s notification obligations to affected individuals and HHS

Your BAA should clearly define each party’s responsibilities in a breach scenario before one ever happens.

4. The HITECH Act

The Health Information Technology for Economic and Clinical Health (HITECH) Act strengthened HIPAA enforcement and extended many requirements directly to Business Associates. Under HITECH:

Business Associates are directly liable for HIPAA violations, not just contractually responsible
Civil penalties can range from $100 to $50,000 per violation, with annual caps up to $1.9 million per violation category
Willful neglect violations carry mandatory penalties

Business Associate Agreements: The Foundation of B2B HIPAA Compliance

A Business Associate Agreement (BAA) is a legally required contract between a Covered Entity and a Business Associate. You cannot legally receive or process PHI from a healthcare client without one.

What a BAA Must Include

A compliant BAA must address:

Permitted uses and disclosures of PHI by your company
Your obligation to implement appropriate safeguards
Requirements to report breaches and security incidents
Obligations to subcontractors who also handle PHI (downstream BAs)
Terms for returning or destroying PHI at contract termination
Compliance with applicable HIPAA rules

Subcontractor Obligations

If your SaaS platform relies on third-party services—cloud providers, analytics tools, email platforms—and those services touch PHI, those vendors become Subcontractors under HIPAA. You must execute BAAs with each of them.

Common subcontractors requiring BAAs include:

AWS, Google Cloud, Microsoft Azure (when storing ePHI)
Twilio or SendGrid (if transmitting PHI via communications)
Zendesk or Intercom (if support tickets contain PHI)
Datadog, Splunk, or similar monitoring tools with PHI access

Building a HIPAA Compliance Program for Your SaaS Company

Step 1: Conduct a Risk Analysis

A formal Risk Analysis is not optional—it’s explicitly required by the Security Rule. This process involves:

Identifying all systems and locations where ePHI is stored or transmitted
Assessing the likelihood and impact of potential threats
Documenting current controls and gaps
Prioritizing remediation efforts

Step 2: Develop Policies and Procedures

You need written HIPAA policies covering areas like:

Information access management
Incident response and breach notification
Employee training and sanctions
Acceptable use of devices and systems
Vendor management and BAA tracking

Step 3: Train Your Workforce

Every employee who handles PHI or has access to systems containing ePHI must receive HIPAA training. Document who was trained and when—this documentation is critical during an audit.

Step 4: Implement Technical Controls

Work with your engineering and DevOps teams to ensure:

ePHI is encrypted at rest (AES-256 is the standard) and in transit (TLS 1.2 or higher)
Access controls follow the principle of least privilege
Audit logs are maintained and regularly reviewed
Multi-factor authentication (MFA) is enforced

Step 5: Monitor, Audit, and Update

HIPAA compliance is not a one-time project. You need ongoing:

Internal audits and security assessments
Annual reviews of policies and the risk analysis
Monitoring of access logs and security events
Updates to your program as your product and team evolve

Common HIPAA Mistakes B2B SaaS Companies Make

Avoid these frequent compliance pitfalls:

Skipping the BAA before onboarding a healthcare client
Assuming your cloud provider’s BAA covers everything—it doesn’t cover your application-level controls
Not training non-technical staff like sales, support, and customer success teams
Failing to document your risk analysis and policy decisions
Ignoring subcontractor BAAs for third-party tools
Treating compliance as a one-time checkbox rather than an ongoing program

FAQ: HIPAA Requirements for B2B SaaS

Does my SaaS company need to be HIPAA compliant if we only store de-identified data?

If data has been properly de-identified according to HIPAA’s standards (either the Safe Harbor or Expert Determination method), it is no longer considered PHI and HIPAA does not apply to it. However, the de-identification process itself must be rigorous and documented. If there’s any doubt about whether your data qualifies as de-identified, treat it as PHI.

Can we use standard SaaS tools like Slack or Google Workspace if we handle PHI?

Yes, but only if you have a signed BAA with those vendors and configure them according to HIPAA-compliant settings. Not all vendors offer BAAs—if a vendor refuses to sign one, you cannot use their service to process PHI.

How long do we need to retain HIPAA documentation?

HIPAA requires that policies, procedures, and related documentation be retained for a minimum of 6 years from the date of creation or the date it was last in effect, whichever is later.

What happens if we have a security incident but no PHI was accessed?

You still need to investigate and document the incident. HIPAA requires a formal breach risk assessment to determine whether notification is required. Even if you conclude no breach occurred, that determination must be documented in writing.

Do startups and small SaaS companies have to follow the same HIPAA rules as large enterprises?

Yes. HIPAA does not have a size exemption for Business Associates. However, HHS does acknowledge that smaller organizations may have more limited resources, and this can be a factor in penalty determinations. That said, willful neglect is penalized regardless of company size.

Get HIPAA Compliant Faster with Ready-to-Use Templates

Building a HIPAA compliance program from scratch is time-consuming, expensive, and easy to get wrong. Our professionally drafted HIPAA compliance template bundle gives your B2B SaaS company everything you need to get compliant quickly and confidently.

Our templates include:

Business Associate Agreement (BAA) template
HIPAA Security Risk Analysis workbook
Complete Policy & Procedure library (20+ policies)
Employee Training Acknowledgment forms
Breach Notification Response Plan
Subcontractor BAA tracking log

Stop spending thousands on legal fees for documents you can have today. Our templates are written by compliance experts, regularly updated to reflect current HHS guidance, and ready to customize for your business.

👉 Download the HIPAA Compliance Template Bundle Now and start protecting your business—and your clients—today.