HIPAA for health tech and SaaS
HIPAA compliance: what it requires, and how to show it
HIPAA has no certificate. Customers want evidence that you meet the Security Rule and handle protected health information properly. This page explains what that evidence is and how to build it.
In short
HIPAA is a US law. Its rules apply to covered entities, such as healthcare providers and health plans, and to business associates that create, receive, maintain or transmit protected health information (PHI) on their behalf. There is no official HIPAA certification: compliance is shown through a documented risk analysis, policies, safeguards, signed business associate agreements and records that they are followed.
Who HIPAA applies to
Covered entities are healthcare providers that transmit health information electronically, health plans and healthcare clearinghouses. A business associate is any company that handles PHI on a covered entity’s behalf. If you sign a contract to process patient data for a hospital, clinic or insurer, you are almost certainly a business associate, and the Security Rule applies to you directly.
- Health-tech SaaS that stores or processes patient data for providers
- Billing, analytics or communication vendors to health plans
- Subcontractors of business associates, such as hosting or support providers that handle PHI
- AI products that process clinical notes, images or claims for covered entities
The three rules that matter most
Most of what a customer’s security team asks about comes from three rules issued under HIPAA.
| Rule | What it requires |
|---|---|
| Privacy Rule | Limits on how PHI is used and disclosed, and individuals’ rights over their information |
| Security Rule | Administrative, physical and technical safeguards for electronic PHI |
| Breach Notification Rule | Notice to affected individuals, to HHS and in some cases the media after a breach of unsecured PHI |
Security Rule safeguards
The Security Rule groups its requirements into three kinds of safeguard. Some implementation specifications are “required” and some are “addressable”. Addressable does not mean optional: you implement it, implement a reasonable alternative, or document why neither is reasonable for you.
- Administrative
- Risk analysis and risk management, workforce training, access management, contingency planning and business associate contracts.
- Physical
- Facility access, workstation use and security, and control of devices and media.
- Technical
- Access control, audit controls, integrity, authentication and transmission security.
- Policies and documentation
- Written policies and procedures, kept and reviewed, with records that they are followed.
The risk analysis comes first
The Security Rule requires an accurate and thorough assessment of the risks to electronic PHI. It is the first document an investigator or a customer’s security team asks for, and everything else in the programme should follow from it.
- Where electronic PHI is created, received, kept and transmitted
- The threats and vulnerabilities that could affect it
- The safeguards already in place
- The likelihood and impact of each risk
- The resulting risk level and what you will do about it
| Risk to ePHI | Treatment | Residual |
|---|---|---|
| Unauthorised access to patient records | Role-based access and quarterly reviews | Low |
| PHI in application logs | Log redaction and retention limits | Medium |
| Lost or stolen laptop | Disk encryption and device management | Low |
| Subcontractor breach | BAA and annual security review | Medium |
Each risk has an owner, a treatment and a residual rating. Example data, not a customer record.
Business associate agreements
A business associate agreement (BAA) is the contract a covered entity must have with each business associate, and a business associate must have with any subcontractor that handles PHI. It sets out how PHI may be used, the safeguards required, and how breaches are reported.
Keep a list of every supplier that touches PHI and whether a signed BAA is in place. A customer’s security review will usually ask for it. Read what a business associate agreement is for the detail.
HIPAA alongside SOC 2
There is no HIPAA certificate to hand a customer, so many health-tech companies also get a SOC 2 report. An independent auditor’s report gives hospital and payer security teams something to read, and the controls overlap: access control, logging, encryption, incident response and supplier management serve both.
Building a HIPAA programme
Start from where PHI lives. How long it takes depends on how much PHI you handle, where, and what is already documented.
-
01
Map PHI
Find where PHI is created, received, kept and sent, and which suppliers touch it.
Your engineering and operations teams
-
02
Risk analysis
Assess threats, vulnerabilities, likelihood and impact for each place PHI lives.
Your security official and the owners of each system that holds PHI
-
03
Safeguards and policies
Put administrative, physical and technical safeguards in place, and write the policies.
Your team, in Certifyi
-
04
Evidence and review
Keep evidence that safeguards operate, sign BAAs, train staff, and review the risk analysis.
Your team; an outside assessor if you engage one
Who does what
HIPAA has no certifying body. Your team runs the programme and makes the decisions, with implementation support if you want it. Certifyi holds the record, and an outside assessor looks at it only if you engage one.
| Task | Your team | Certifyi | Outside assessor (optional) |
|---|---|---|---|
| Business associate status | Decide, with counsel | Not involved | Not involved |
| Risk analysis | Run it and own the decisions | Holds the register, owners and treatments | May review it |
| Policies and safeguards | Write and operate them | Policies with review cycles; evidence linked to controls | Tests them if engaged |
| BAAs | Sign them with customers and subcontractors | Not involved | May sample them |
| Breach response | Investigate, decide and notify | Incident records and response tasks | Not involved |
How Certifyi helps
Document HIPAA on the same record as your other frameworks
No software makes you HIPAA compliant. The risk analysis, policies and safeguard evidence a hospital’s security team asks for can sit in Certifyi, on the same controls as your SOC 2 or ISO 27001 work.
-
HIPAA in the catalogue
Adopt HIPAA and track the Security Rule requirements against your controls.
-
Risk register
Record risks to ePHI with likelihood, impact, treatment and owner.
-
Policies with review cycles
Write, review and track acknowledgement of your HIPAA policies.
-
Tamper-evident activity log
Evidence for each Security Rule safeguard stays with that safeguard, and every change to it goes into the tamper-evident activity log, so you can show when it was last updated and by whom.
-
Incident records
Log incidents and assign response tasks. Notification deadlines are yours to confirm.
From the blog
HIPAA articles
Longer answers to the questions teams ask while they work on HIPAA.
Questions
HIPAA, answered
Is there a HIPAA certification?
No. HHS does not certify HIPAA compliance. Some firms offer assessments or attestations, but compliance is shown through a risk analysis, policies, safeguards, BAAs and records that they are followed.
Who needs to comply with HIPAA?
Covered entities, such as healthcare providers, health plans and clearinghouses, and business associates that create, receive, maintain or transmit PHI on their behalf, including subcontractors.
Do health-tech start-ups need a BAA?
If you create, receive, maintain or transmit PHI for a covered entity, yes. You also need BAAs with your own subcontractors that handle PHI.
What does a HIPAA risk analysis include?
Where electronic PHI lives, the threats and vulnerabilities to it, existing safeguards, likelihood and impact, and the resulting risk level and treatment. It is usually the first document requested.
Should we pair HIPAA with SOC 2?
Many health-tech companies do, so hospital and payer customers have an independent report to read. The controls overlap substantially.
How long does HIPAA readiness take?
It depends on how much PHI you handle, where it lives and what is already documented. We would look at your setup with you before anyone puts a date on it.
Does Certifyi make us HIPAA compliant?
No. HIPAA compliance comes from how you handle PHI day to day. Certifyi helps you document the risk analysis, policies and evidence, and keep them current.
Map your PHI footprint in a 30-minute call.
Bring a list of where patient data lives and who touches it. We can go through how that list becomes your risk analysis, and where the policies and safeguard evidence a customer’s security review asks for would sit.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them