Summary

HIPAA requires that every covered entity and business associate designate a Privacy Officer and a Security Officer. In smaller HealthTech companies, this is often the same person. The Security Risk Assessment (SRA) is the cornerstone of HIPAA compliance and one of the most commonly cited areas of failure during audits. The Office for Civil Rights (OCR) requires it under the Security Rule. - Documentation retention — HIPAA requires records be kept for at least 6 years

HIPAA Step by Step for HealthTech: A Practical Compliance Guide

Building a health technology product means navigating one of the most rigorous regulatory frameworks in the United States. HIPAA — the Health Insurance Portability and Accountability Act — isn’t optional, and getting it wrong can mean fines ranging from $100 to $50,000 per violation. This guide walks you through HIPAA compliance step by step, specifically tailored for HealthTech founders, product managers, and engineering teams.

What Is HIPAA and Who Does It Apply To?

HIPAA was enacted in 1996 and has been updated significantly since, particularly with the HITECH Act in 2009. It governs how Protected Health Information (PHI) is stored, transmitted, and accessed.

If your HealthTech product touches any of the following, HIPAA almost certainly applies to you:

Electronic health records (EHR) or patient data
Appointment scheduling or telehealth platforms
Medical billing or insurance claims processing
Wearables or apps that collect health data on behalf of a covered entity
APIs that connect to hospital systems or health plans

Covered Entities vs. Business Associates

Covered Entities include hospitals, clinics, health plans, and healthcare clearinghouses. Business Associates are vendors and technology providers (like your SaaS company) that handle PHI on behalf of a covered entity. Most HealthTech startups fall into the Business Associate category, which means you’re directly bound by HIPAA rules.

Step 1: Determine If You Handle PHI

Before doing anything else, confirm whether your product actually processes Protected Health Information. PHI includes any health information that can be linked to an individual, such as:

Names, addresses, birthdates, Social Security numbers
Medical record numbers or account numbers
Health conditions, diagnoses, treatment records
Payment information related to healthcare

De-identified data — information stripped of all 18 HIPAA identifiers — is not considered PHI and falls outside HIPAA’s scope. If you’re working exclusively with de-identified datasets, your compliance burden is significantly reduced.

Step 2: Appoint a HIPAA Privacy and Security Officer

HIPAA requires that every covered entity and business associate designate a Privacy Officer and a Security Officer. In smaller HealthTech companies, this is often the same person.

These roles are responsible for:

Developing and enforcing HIPAA policies
Conducting and documenting risk assessments
Managing employee training programs
Responding to breaches and complaints
Keeping documentation audit-ready

Even if you outsource compliance consulting, you still need an internal owner. Regulators want to see a named, accountable individual.

Step 3: Conduct a Risk Assessment

The Security Risk Assessment (SRA) is the cornerstone of HIPAA compliance and one of the most commonly cited areas of failure during audits. The Office for Civil Rights (OCR) requires it under the Security Rule.

Your risk assessment should:

Identify all systems, applications, and workflows that create, receive, maintain, or transmit ePHI
Assess threats and vulnerabilities — both technical (e.g., unencrypted databases) and physical (e.g., unsecured server rooms)
Evaluate existing controls and whether they adequately mitigate identified risks
Assign risk levels (high, medium, low) to each identified gap
Document everything — the process, findings, and remediation plan

This isn’t a one-time exercise. You must repeat the risk assessment whenever significant operational or technical changes occur.

Step 4: Implement Required Safeguards

HIPAA’s Security Rule outlines three categories of safeguards that HealthTech companies must implement.

Administrative Safeguards

These are your policies, procedures, and training programs:

Written HIPAA policies and procedures
Workforce training (documented and recurring)
Access management procedures
Incident response and breach notification policies
Contingency and disaster recovery planning

Physical Safeguards

These govern physical access to systems that store ePHI:

Facility access controls (key cards, locks, visitor logs)
Workstation use policies (screen locks, clean desk rules)
Device and media controls (encryption, secure disposal)

Technical Safeguards

These are the engineering controls your development team owns:

Access controls: Unique user IDs, automatic logoff, encryption keys
Audit controls: Logging and monitoring of ePHI access
Integrity controls: Mechanisms to ensure ePHI isn’t improperly altered
Transmission security: TLS encryption for data in transit, AES-256 for data at rest

Step 5: Execute Business Associate Agreements (BAAs)

A Business Associate Agreement is a legally required contract between a covered entity and any vendor that handles PHI on their behalf. If you’re a HealthTech SaaS company, you will sign BAAs from two directions:

As a Business Associate: Your healthcare clients will require you to sign their BAA before you can access their patient data
As a Covered Entity or BA: You must get BAAs signed with your own subcontractors (cloud providers, analytics tools, support platforms) if those vendors touch ePHI

Common subcontractors that require BAAs include AWS, Google Cloud, Microsoft Azure, Twilio, and Zendesk — most major vendors offer HIPAA-eligible service tiers with BAAs available.

Never handle PHI without a signed BAA in place. This is a bright-line rule with no exceptions.

Step 6: Train Your Workforce

HIPAA mandates that all members of your workforce who handle PHI receive regular, documented training. This includes full-time employees, contractors, and anyone with system access.

Effective HIPAA training covers:

What PHI is and how to identify it
How to handle, store, and transmit PHI securely
Phishing awareness and social engineering threats
How to report a suspected breach
Consequences of non-compliance

Training should be completed at onboarding and repeated at least annually. Keep attendance records and completion certificates — auditors will ask for them.

Step 7: Build a Breach Notification Process

Despite best efforts, breaches happen. HIPAA’s Breach Notification Rule sets strict timelines for how you must respond:

Notify affected individuals within 60 days of discovering a breach
Notify the covered entity (your client) without unreasonable delay
Notify the HHS Secretary — breaches affecting 500+ individuals in a state require media notification and immediate HHS reporting; smaller breaches can be logged and reported annually
Document the breach thoroughly, including the scope, cause, and remediation steps

Having a documented incident response plan before a breach occurs dramatically reduces your risk and demonstrates good faith to regulators.

Step 8: Maintain and Audit Your Compliance Program

HIPAA compliance is not a one-time certification — it’s an ongoing program. Build these habits into your operations:

Annual risk assessments and policy reviews
Quarterly access reviews to ensure least-privilege access
Penetration testing at least annually
Vendor audits to verify subcontractor compliance
Documentation retention — HIPAA requires records be kept for at least 6 years

Frequently Asked Questions About HIPAA for HealthTech

Does HIPAA apply to wellness apps and consumer health apps?

Not automatically. If your app is marketed directly to consumers and doesn’t operate on behalf of a covered entity, HIPAA may not apply. However, if your app integrates with a hospital system or health plan, or if consumers use it to share data with their providers, HIPAA compliance becomes relevant. The FTC’s Health Breach Notification Rule may also apply to consumer health apps regardless of HIPAA status.

What’s the difference between HIPAA compliance and HIPAA certification?

There is no official HIPAA certification issued by the government. Any vendor claiming to be “HIPAA certified” is using marketing language, not a regulatory designation. Compliance is demonstrated through documented policies, risk assessments, training records, and audit trails — not a certificate.

How much does HIPAA non-compliance actually cost?

HIPAA fines are tiered by culpability. Unknowing violations start at $100 per violation; willful neglect with no corrective action can reach $50,000 per violation, with an annual cap of $1.9 million per violation category. Beyond fines, breaches trigger reputational damage, customer churn, and potential civil lawsuits.

Do I need a BAA with AWS or Google Cloud?

Yes, if you store or process ePHI on their infrastructure. Both AWS and Google Cloud offer HIPAA-eligible services and will sign a BAA. However, signing the BAA alone isn’t enough — you must configure your environment according to their shared responsibility model and your own security requirements.

When should a HealthTech startup start thinking about HIPAA?

From day one. Retrofitting HIPAA controls into an existing product architecture is significantly more expensive and disruptive than building with compliance in mind. Even pre-revenue startups pitching to hospital systems will be asked about HIPAA posture in early conversations.

Build Your HIPAA Program Faster With Ready-to-Use Templates

Working through HIPAA compliance from scratch is time-consuming and easy to get wrong. Missing a single required policy or leaving a gap in your documentation can mean the difference between a clean audit and a costly enforcement action.

Our professionally written HIPAA compliance template library gives you everything you need to get compliant quickly, including:

Security Risk Assessment templates
HIPAA Privacy and Security Policy packages
Business Associate Agreement templates
Workforce training acknowledgment forms
Breach notification response playbooks
Vendor management checklists

These templates are written by compliance professionals, formatted for immediate use, and regularly updated to reflect OCR guidance. Whether you’re a solo founder or a growing HealthTech team, our templates help you build a defensible compliance program in days — not months.

[Browse our HIPAA template packages and start building your compliance program today →]