HIPAA compliance for health-tech startups: what actually matters
HIPAA has no certification body and no certificate. Compliance means implementing administrative, physical and technical safeguards, documenting a current risk analysis, and signing Business Associate Agreements with anyone touching protected health information. Most startups are business associates rather than covered entities.
Covered entity or business associate?
This determines your obligations, so establish it first.
- Covered entities are providers, health plans and clearinghouses that deliver care or process claims directly
- Business associates handle PHI on behalf of a covered entity, which describes most health-tech software vendors
- Business associates carry direct liability under HIPAA, not merely contractual obligations
The three safeguard categories
| Category | Representative requirements |
|---|---|
| Administrative | Risk analysis, workforce training, access management procedures, incident response, sanction policy |
| Physical | Facility access controls, workstation security, device and media disposal |
| Technical | Access controls, audit logging, integrity controls, encryption in transit and at rest, automatic logoff |
The risk analysis is the anchor
If a regulator or enterprise buyer examines one artefact, it is the risk analysis. It must be current, dated, and cover everywhere PHI actually lives.
A risk analysis performed once at incorporation and never revisited is treated as no risk analysis at all.
Business Associate Agreements
A BAA must be in place before a vendor touches PHI, not after. Retroactive BAAs do not cure the exposure window.
Frequently missed BAAs
- Cloud hosting and storage providers
- Email and productivity suites where PHI ends up in attachments
- Analytics or session-replay tools deployed on authenticated pages
- Support desk software where users paste clinical details
- Subcontractors used by your own vendors
How buyers actually assess you
Because HIPAA offers nothing to certify, sophisticated buyers ask for proxies: a SOC 2 report scoped to include relevant criteria, your risk analysis, your BAA, and evidence of training and access reviews. Building toward SOC 2 alongside HIPAA is usually the efficient path.
Key takeaways
- No HIPAA certificate exists; compliance is demonstrated, not awarded.
- Most health-tech vendors are business associates with direct liability.
- A current, dated risk analysis is the central artefact.
- BAAs must be signed before PHI access begins.
Frequently asked questions
Can we be HIPAA certified?
No. Any vendor selling HIPAA certification is selling an assessment against their own criteria, not a recognised certification.
Does encryption alone make us compliant?
No. Encryption is one technical safeguard among many, and the administrative safeguards carry most of the documentation burden.
How often should the risk analysis be updated?
At least annually and whenever there is a material change to systems, vendors or how PHI flows.
Do we need SOC 2 as well?
Not legally, but it is the practical way to give buyers something verifiable, since HIPAA itself produces no report.
Get audit-ready in 8 to 12 weeks
Certifyi pairs the platform with a named compliance lead, at published pricing from $8,000/year.
Book a 20-min deal readiness call