Summary

This is where most SaaS companies spend the bulk of their compliance effort. The Security Rule requires administrative, physical, and technical safeguards to protect electronic PHI (ePHI). HIPAA requires you to maintain written documentation of nearly everything. The required documents include: HIPAA requires you to review and update policies “periodically” — most compliance experts recommend at least annually and whenever there are significant changes to your operations, technology stack, or regulatory guidance.

HIPAA Requirements List for B2B SaaS: What You Need to Know Before You Sign That BAA

If your SaaS platform touches protected health information (PHI) in any way — even indirectly — HIPAA applies to you. Many B2B SaaS founders and compliance teams are surprised to discover just how broad the law’s reach is. Whether you’re building EHR integrations, processing insurance claims, or simply storing patient data on behalf of a healthcare client, understanding the full HIPAA requirements list is non-negotiable.

This guide breaks down every major HIPAA requirement relevant to B2B SaaS companies, so you can build compliant systems, close enterprise healthcare deals, and avoid costly violations.

Who Does HIPAA Apply to in the SaaS World?

HIPAA applies to two categories of entities:

Covered Entities (CEs): Healthcare providers, health plans, and healthcare clearinghouses
Business Associates (BAs): Any vendor or service provider that creates, receives, maintains, or transmits PHI on behalf of a covered entity

As a B2B SaaS company, you almost certainly fall into the Business Associate category. This means HIPAA’s requirements apply to your platform, your team, and your infrastructure — not just your healthcare clients.

The Core HIPAA Rules Every SaaS Company Must Follow

1. The HIPAA Privacy Rule

The Privacy Rule establishes national standards for protecting individuals’ medical records and personal health information. For SaaS companies, this translates into:

Using PHI only for authorized purposes as defined in your Business Associate Agreement (BAA)
Implementing minimum necessary access policies — employees should only see PHI required for their specific job function
Supporting patients’ rights to access, amend, and restrict their own data
Reporting unauthorized disclosures of PHI to your covered entity clients

The Privacy Rule is less about technology and more about policies, procedures, and culture. Your team needs documented guidelines on how PHI is handled at every touchpoint.

2. The HIPAA Security Rule

This is where most SaaS companies spend the bulk of their compliance effort. The Security Rule requires administrative, physical, and technical safeguards to protect electronic PHI (ePHI).

Administrative Safeguards

Conduct and document a formal Risk Analysis — this is the single most important HIPAA requirement
Implement a Risk Management Plan to address identified vulnerabilities
Designate a HIPAA Security Officer (can be an existing employee in smaller companies)
Establish workforce training programs on security policies
Create access management procedures including onboarding and offboarding protocols
Develop a contingency plan for data backup and disaster recovery

Physical Safeguards

Control physical access to facilities and workstations where ePHI is processed
Implement workstation use policies (screen locks, clean desk rules)
Establish device and media controls for laptops, USB drives, and mobile devices
Ensure your cloud infrastructure providers (AWS, Azure, GCP) have signed BAAs with you

Technical Safeguards

Encryption: ePHI must be encrypted in transit (TLS 1.2+) and at rest (AES-256)
Access Controls: Unique user IDs, automatic logoff, emergency access procedures
Audit Controls: Log and monitor all access to systems containing ePHI
Integrity Controls: Mechanisms to ensure ePHI is not improperly altered or destroyed
Transmission Security: Protect ePHI transmitted over open networks

3. The HIPAA Breach Notification Rule

If a breach of unsecured PHI occurs, you have specific notification obligations:

Notify your covered entity client within 60 days of discovering the breach
Your client then notifies affected individuals and, for breaches affecting 500+ individuals, the Department of Health and Human Services (HHS)
Maintain breach documentation for 6 years

Your incident response plan must be documented and tested before a breach happens — not written in a panic afterward.

4. The HIPAA Omnibus Rule

The 2013 Omnibus Rule expanded BA liability significantly. Key takeaways for SaaS:

Business Associates are directly liable for HIPAA violations — you can be fined even if your client is never penalized
Subcontractors who handle PHI on your behalf (your own vendors) must also sign BAAs with you
Your BAA must meet specific content requirements or it won’t hold up legally

Business Associate Agreements: The Contract Foundation

A BAA is required before you can legally receive PHI from a covered entity. No BAA means any data exchange is automatically a HIPAA violation.

Your BAA must include:

Permitted uses and disclosures of PHI
Obligations to implement appropriate safeguards
Requirements to report breaches and security incidents
Subcontractor requirements
Provisions for returning or destroying PHI upon contract termination
Compliance with the Privacy and Security Rules

Many SaaS companies use poorly drafted BAA templates that create legal exposure. Your BAA should be reviewed by a healthcare attorney and tailored to your specific service model.

HIPAA Documentation Requirements

HIPAA requires you to maintain written documentation of nearly everything. The required documents include:

Risk Analysis and Risk Management Plan
Information Security Policies and Procedures
HIPAA Security Officer designation
Workforce Training records
Access Control Policy
Audit Log Policy
Incident Response and Breach Notification Procedures
Business Continuity and Disaster Recovery Plan
Business Associate Agreements (with clients and subcontractors)
Sanction Policy for workforce members who violate policies
Device and Media Disposal Policy

All documentation must be retained for a minimum of 6 years from creation or last effective date.

Common HIPAA Pitfalls for B2B SaaS Companies

Even well-intentioned teams make these mistakes:

Skipping the formal Risk Analysis and assuming good security equals HIPAA compliance
Using free or generic BAA templates that don’t reflect your actual services
Forgetting subcontractor BAAs — your analytics tools, support platforms, and cloud vendors may all need BAAs
No audit logging on systems that store or process ePHI
Inadequate employee training — phishing attacks remain the #1 cause of healthcare breaches
No documented incident response plan tested before an actual incident

Building a HIPAA Compliance Program: The Practical Path

Here’s a simplified roadmap for B2B SaaS companies starting their HIPAA journey:

Determine your BA status — map all PHI flows into and out of your platform
Conduct a Risk Analysis — identify threats, vulnerabilities, and likelihood of harm
Develop and implement policies — written, approved, and distributed to staff
Train your workforce — document all training sessions
Execute BAAs — with clients and all relevant subcontractors
Implement technical controls — encryption, access controls, audit logs
Test your incident response plan — tabletop exercises at minimum annually
Review and update annually — HIPAA compliance is ongoing, not one-time

FAQ: HIPAA Requirements for B2B SaaS

Do I need HIPAA compliance if I only store de-identified data?

If data has been properly de-identified according to HIPAA’s Safe Harbor or Expert Determination methods, it is no longer considered PHI and HIPAA does not apply. However, de-identification must be done correctly — partial de-identification still carries risk and liability.

Can I use AWS, Google Cloud, or Azure for HIPAA-compliant hosting?

Yes — all three major cloud providers offer HIPAA-eligible services and will sign BAAs. However, signing a BAA with AWS doesn’t make you compliant. You are still responsible for configuring services correctly, enabling encryption, and implementing access controls.

What are the penalties for HIPAA violations?

Penalties range from $100 to $50,000 per violation, with annual maximums up to $1.9 million per violation category. The Office for Civil Rights (OCR) at HHS enforces HIPAA and has levied multi-million dollar fines against business associates. Criminal penalties can also apply in cases of willful neglect.

How often do I need to update my HIPAA policies?

HIPAA requires you to review and update policies “periodically” — most compliance experts recommend at least annually and whenever there are significant changes to your operations, technology stack, or regulatory guidance.

Do I need HIPAA certification to sell to healthcare companies?

There is no official government-issued HIPAA certification. However, many enterprise healthcare buyers require SOC 2 Type II reports, third-party HIPAA assessments, or completed security questionnaires as part of their vendor evaluation process.

Stop Starting From Scratch

HIPAA compliance documentation is time-consuming, technical, and easy to get wrong. Missing a single required policy or using an incomplete BAA template can expose your company to regulatory action and cost you enterprise deals.

Our ready-to-use HIPAA compliance template library gives you everything you need:

✅ Complete Risk Analysis template with built-in threat/vulnerability library
✅ Attorney-reviewed Business Associate Agreement template
✅ All required Security Rule policies and procedures
✅ Workforce training acknowledgment forms
✅ Incident response and breach notification procedures
✅ Subcontractor BAA template
✅ Audit log and access control policy templates

Built specifically for B2B SaaS companies, our templates are written in plain language, immediately editable, and designed to satisfy both your legal team and your healthcare clients’ security reviews.

[Download the Complete HIPAA Compliance Template Bundle →]

Close more healthcare deals, pass security reviews faster, and build PHI-handling systems your clients can trust — starting today.