HIPAA Compliance for Healthcare Startups

What Is HIPAA and Who Does It Apply To?

The Health Insurance Portability and Accountability Act (HIPAA) is the foundational US federal law governing the privacy and security of health information. Covered entities are healthcare providers, health plans, and clearinghouses. Business associates are vendors that handle Protected Health Information (PHI) on behalf of covered entities. As a SaaS founder, you are most likely a business associate.

What Counts as Protected Health Information?

PHI is any individually identifiable health information — diagnoses, treatment records, billing data, appointment schedules — when linked to one of 18 specific identifiers. Assume data is PHI unless you have formally applied an approved de-identification method.

The Privacy Rule and the Security Rule

The Privacy Rule governs how PHI can be used and disclosed. The Security Rule applies to electronic PHI (ePHI) and requires three categories of safeguards:

• Administrative: Risk analyses, workforce training, access management policies, designated security officers
• Physical: Controls over physical access to servers and workstations storing ePHI
• Technical: Encryption, audit controls, automatic logoff, unique user authentication

Business Associate Agreements (BAAs)

Before exchanging any PHI, you must execute a BAA specifying permitted uses, breach reporting requirements, and PHI return/destruction obligations. Vendors like AWS and Google Cloud offer BAAs — you must opt into them explicitly.

Breach Notification Requirements

Business associates must notify the covered entity within 60 days of discovering a breach. A breach is presumed reportable unless you can demonstrate a low probability that PHI was compromised.

Penalties and Enforcement

Penalties range from $100 to $50,000 per violation, with annual caps of $1.9 million per category. Criminal charges are possible for intentional misuse of PHI.

Practical Steps for Healthcare Startups

• Conduct a formal risk analysis before launching
• Encrypt all ePHI at rest and in transit (AES-256, TLS 1.2+)
• Implement role-based access controls
• Execute BAAs with every vendor touching ePHI
• Create and test an incident response plan
• Train all employees on HIPAA basics annually
• Appoint a Privacy Officer and a Security Officer