Summary

This guide breaks down exactly what HIPAA requires from healthtech companies, who it applies to, and how to build a compliant foundation from day one. The Security Rule is where most healthtech companies spend the bulk of their compliance effort. It requires administrative, physical, and technical safeguards to protect electronic PHI (ePHI). If a security breach involving unsecured PHI occurs, HIPAA requires specific notification timelines:

HIPAA Requirements for HealthTech: A Complete Compliance Guide

The healthcare technology sector is one of the fastest-growing industries in the world, but it comes with a significant compliance burden. If you’re building a health app, telehealth platform, EHR system, or any software that touches protected health information (PHI), understanding HIPAA requirements is non-negotiable. Non-compliance can result in fines ranging from $100 to $50,000 per violation — and that’s before considering the reputational damage.

This guide breaks down exactly what HIPAA requires from healthtech companies, who it applies to, and how to build a compliant foundation from day one.

Who Does HIPAA Apply To in HealthTech?

HIPAA applies to two primary categories of organizations:

Covered Entities (CEs): Hospitals, clinics, health plans, and healthcare clearinghouses that directly handle patient data
Business Associates (BAs): Third-party vendors — including most healthtech companies — that create, receive, maintain, or transmit PHI on behalf of a covered entity

If your SaaS platform stores patient records, processes insurance claims, enables telehealth consultations, or handles any identifiable health data, you almost certainly qualify as a Business Associate. This means HIPAA’s full regulatory framework applies to you.

What Counts as Protected Health Information (PHI)?

PHI is any individually identifiable health information that relates to:

A person’s past, present, or future physical or mental health condition
The provision of healthcare services
Payment for healthcare services

PHI includes obvious identifiers like names and Social Security numbers, but also IP addresses, device identifiers, and geographic data smaller than a state. If your app collects any of this data, it’s in scope.

The Four Core HIPAA Rules HealthTech Companies Must Follow

1. The Privacy Rule

The HIPAA Privacy Rule establishes standards for how PHI can be used and disclosed. For healthtech companies, this means:

PHI can only be used or disclosed for treatment, payment, or healthcare operations — or with explicit patient authorization
Patients have the right to access, amend, and receive an accounting of disclosures of their own health information
You must implement a minimum necessary standard, meaning you only access or share the minimum PHI needed to accomplish a task

Practically speaking, your platform should have clearly defined data access controls, documented data flows, and a compliant Privacy Notice if you interact directly with patients.

2. The Security Rule

The Security Rule is where most healthtech companies spend the bulk of their compliance effort. It requires administrative, physical, and technical safeguards to protect electronic PHI (ePHI).

Administrative Safeguards include:

Conducting a formal Risk Analysis and Risk Management process
Implementing workforce training programs
Designating a HIPAA Security Officer
Developing and maintaining written security policies and procedures

Physical Safeguards include:

Controlling physical access to servers and workstations
Implementing workstation use policies
Establishing device and media disposal procedures

Technical Safeguards include:

Access controls (unique user IDs, automatic logoff, encryption)
Audit controls to track access to ePHI
Transmission security, including TLS encryption for data in transit
Integrity controls to prevent unauthorized alteration of ePHI

3. The Breach Notification Rule

If a security breach involving unsecured PHI occurs, HIPAA requires specific notification timelines:

Affected individuals must be notified within 60 days of discovery
HHS (Department of Health & Human Services) must be notified — immediately for breaches affecting 500+ individuals, or within 60 days after year-end for smaller breaches
Media outlets in the affected state must be notified for breaches affecting 500+ individuals in that state

Your incident response plan must account for these requirements and assign clear ownership for breach investigation and notification.

4. The Omnibus Rule

The 2013 Omnibus Rule significantly expanded HIPAA’s reach. Key impacts for healthtech:

Business Associates are now directly liable for HIPAA compliance — not just covered entities
Subcontractors of Business Associates (sometimes called “downstream BAs”) must also sign Business Associate Agreements and comply with HIPAA
Stricter rules around marketing uses of PHI

Business Associate Agreements (BAAs): What You Need to Know

A Business Associate Agreement is a legally required contract between a covered entity and any business associate that handles PHI. If you’re a healthtech vendor, you will need to sign BAAs with your healthcare customers — and you’ll need to obtain BAAs from your own subcontractors (cloud providers, analytics tools, etc.).

A compliant BAA must include:

A description of permitted uses and disclosures of PHI
Requirements to implement appropriate safeguards
Obligations to report breaches and security incidents
Provisions for returning or destroying PHI at contract termination
Assurances that subcontractors will also comply with HIPAA

Major cloud providers like AWS, Google Cloud, and Microsoft Azure offer HIPAA BAAs, but signing a BAA doesn’t make you compliant — it’s just one piece of the puzzle.

HIPAA Risk Analysis: The Most Overlooked Requirement

One of the most commonly cited HIPAA violations is the failure to conduct a thorough and accurate Risk Analysis. This isn’t optional — it’s the foundation of your entire security program.

A proper Risk Analysis must:

Identify the scope of all ePHI your organization creates, receives, maintains, or transmits
Identify threats and vulnerabilities to that ePHI
Assess the likelihood and impact of each threat
Implement risk management measures to reduce risks to a reasonable and appropriate level
Document everything — the process, findings, and mitigation steps

Your Risk Analysis should be reviewed and updated regularly, especially after significant changes to your technology environment or operations.

Building a HIPAA-Compliant Tech Stack

Choosing the right tools matters. When evaluating vendors and infrastructure:

Only use vendors who will sign a BAA — if a vendor refuses, they’re off-limits for PHI processing
Encrypt ePHI at rest and in transit using industry-standard encryption (AES-256, TLS 1.2+)
Implement role-based access controls (RBAC) to enforce the minimum necessary standard
Enable comprehensive audit logging so you can track who accessed what and when
Use multi-factor authentication (MFA) for all systems that access ePHI

HIPAA Training Requirements for HealthTech Teams

Every member of your workforce who handles PHI — including developers, customer success managers, and executives — must receive HIPAA training. Requirements include:

Initial training for new employees before they access PHI
Ongoing training when policies change or new threats emerge
Documentation of all training activities and completion records

Training doesn’t need to be elaborate, but it must be meaningful. Generic online modules that employees click through in five minutes rarely satisfy the intent of the rule.

Frequently Asked Questions About HIPAA for HealthTech

Do wellness apps need to comply with HIPAA?

Not automatically. A wellness app that operates independently — without a contract with a covered entity and without receiving PHI from one — may not be subject to HIPAA. However, if your app integrates with an EHR, partners with a health system, or handles data on behalf of a covered entity, HIPAA likely applies. When in doubt, consult a compliance attorney.

What’s the difference between HIPAA compliance and HIPAA certification?

There is no official HIPAA certification. Organizations that claim to offer “HIPAA certification” are providing third-party assessments or audits, which can be valuable for demonstrating due diligence but are not legally recognized by HHS. True compliance is an ongoing internal process, not a one-time certificate.

How much can HIPAA violations cost?

The HHS Office for Civil Rights (OCR) enforces HIPAA with a tiered penalty structure:

Tier 1 (unknowing): $100–$50,000 per violation
Tier 2 (reasonable cause): $1,000–$50,000 per violation
Tier 3 (willful neglect, corrected): $10,000–$50,000 per violation
Tier 4 (willful neglect, not corrected): $50,000 per violation, up to $1.9 million annually per violation category

Criminal penalties and state attorney general actions can add further exposure.

Does HIPAA apply to mobile health apps?

It depends on the relationship to a covered entity. Apps developed by or for covered entities, or apps that receive PHI from covered entities, fall under HIPAA. Consumer-facing apps that collect health data directly from users — without a covered entity relationship — are generally regulated by the FTC rather than HHS.

What documentation does HIPAA require?

HIPAA requires written policies and procedures covering the Privacy Rule, Security Rule, and Breach Notification Rule. You must also maintain documentation of your Risk Analysis, workforce training, BAAs, and any sanctions applied for policy violations. Most documentation must be retained for a minimum of six years.

Start Your HIPAA Compliance Journey the Right Way

HIPAA compliance is complex, but it doesn’t have to be built from scratch. The most time-consuming part of achieving compliance is creating the underlying documentation — policies, procedures, risk analysis templates, BAA templates, training materials, and incident response plans.

Save weeks of work with our ready-to-use HIPAA compliance template library. Our professionally drafted templates are written by compliance experts, regularly updated to reflect current OCR guidance, and designed specifically for healthtech companies and SaaS vendors.

Whether you’re preparing for your first BAA negotiation, responding to a customer security questionnaire, or building out your security program ahead of a Series A, our templates give you a compliant, customizable foundation — without the five-figure consulting bill.

[Browse HIPAA Compliance Templates →]

Get everything you need: Privacy Policy, Security Policies, Risk Analysis Framework, BAA Template, Incident Response Plan, and more — ready to customize and deploy today.