HIPAA: The Complete Compliance Guide for Health Tech and IT Vendors

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is the US federal law that protects patients’ health information. For IT and SaaS companies, the key point is that HIPAA applies not only to hospitals and insurers but also to their business associates: vendors that handle protected health information on their behalf. If your product stores, processes or transmits patient data for US healthcare organisations, you are almost certainly a business associate with direct legal obligations.

This guide is general information, not legal advice.

What is HIPAA?

HIPAA’s data protection requirements come from rules issued by the US Department of Health and Human Services (HHS):

Key definitions:

History and why it was introduced

HIPAA’s privacy and security rules were introduced because electronic health transactions were becoming standard, and patients needed protection for their data as it moved between organisations.

Main objectives:

1. Protect the privacy of health information.
2. Secure electronic health information.
3. Give patients rights over their records.
4. Hold organisations accountable for breaches.

Who needs HIPAA compliance?

Is HIPAA mandatory?

Yes, for covered entities and business associates.

Civil penalties are set in four tiers based on culpability, adjusted annually for inflation:

Penalties are per violation, with annual caps per type of violation that reach about USD 2.1 million at the top tier (inflation-adjusted). OCR more often settles with resolution agreements and corrective action plans.

Criminal penalties, enforced by the Department of Justice, reach USD 250,000 and 10 years in prison for offences committed with intent to sell or use PHI for gain or harm.

State attorneys general can also bring HIPAA actions.

Key requirements

Business associate agreements

Before handling PHI, a business associate must sign a BAA with the covered entity, and must sign BAAs with its own subcontractors. A BAA must, among other things, limit uses and disclosures, require safeguards, require breach reporting, flow terms down to subcontractors, and require return or destruction of PHI at the end of the contract.

Security Rule safeguards

Under the current rule, some specifications are required and others addressable: you must implement an addressable specification if reasonable and appropriate, or document why not and what you do instead. Encryption is addressable today, but in practice expected.

Privacy Rule (for business associates)

• Use and disclose PHI only as the BAA permits or the law requires.
• Apply the minimum necessary standard.
• Help the covered entity meet individuals’ rights to access and amend their PHI and get an accounting of disclosures.

Breach Notification Rule

A breach is an impermissible use or disclosure that compromises PHI, presumed unless a risk assessment shows a low probability of compromise. Encrypted data meeting HHS guidance is “secured” and its loss is not a reportable breach.

The proposed Security Rule update

HHS’s January 2025 proposal would, among other things, remove the distinction between required and addressable specifications, require encryption of ePHI at rest and in transit and MFA (with limited exceptions), require a technology asset inventory and network map, set restoration of critical systems within 72 hours, require vulnerability scanning and penetration testing, and require business associates to verify their safeguards. The final rule is now targeted for July 2027 and may change. Building towards these controls now is sensible.

How to implement HIPAA as a business associate

1. Confirm your role for each customer and data flow.
2. Sign BAAs with customers and with every subcontractor that touches PHI, such as your cloud host, email and support tools.
3. Map PHI: where it enters, where it is stored, who can access it, where it goes.
4. Carry out a security risk analysis covering all ePHI. This is the most common gap OCR finds.
5. Implement safeguards: MFA, encryption at rest and in transit, logging, least privilege, backups, device management, vulnerability management.
6. Write policies and procedures for each Security Rule standard.
7. Train staff on HIPAA and security, with records.
8. Set up breach response, including risk assessments and notification timelines.
9. Review and update the risk analysis regularly and after major changes.
10. Keep documentation for six years.

Documentation and policies

• Business associate agreements (with customers and subcontractors)
• Security risk analysis and risk management plan
• Security and privacy policies and procedures
• Designation of a security official (and privacy official where relevant)
• Workforce training records
• Access management and audit log review records
• Contingency plan, backup and disaster recovery tests
• Incident response and breach risk assessment records
• Device and media disposal records
• Evaluation records (periodic technical and non-technical evaluations)

All required documentation must be kept for six years from creation or last effective date.

Audits, assessments and enforcement

• No official HIPAA certification. HHS doesn’t certify organisations or products. “HIPAA certified” claims are marketing.
• OCR investigations follow complaints and breach reports; OCR has run an initiative focused on risk analysis failures.
• Customer assessments through security questionnaires and audits.
• Third-party attestations used as evidence: SOC 2 with HIPAA mapping, or HITRUST certification.

Cost

Benefits

• Access to the US healthcare market.
• Lower breach risk and impact (encrypted data loss isn’t a reportable breach).
• Trust from providers, payers and patients.
• A strong base for HITRUST, SOC 2 and ISO 27001.

Risks of non-compliance

• OCR penalties and multi-year corrective action plans.
• State attorney general actions and class actions after breaches.
• Contract termination by covered entity customers.
• Public listing on HHS’s breach portal for breaches of 500 or more.

Common mistakes

• No documented risk analysis, or one that is years old.
• Using services without a BAA, such as email, analytics or AI APIs, for PHI.
• PHI in logs, error trackers and support tickets.
• Assuming encryption alone equals compliance.
• Calling a product “HIPAA certified”.
• Missing breach notification deadlines because the BAA sets shorter timelines than the rule.

Challenges for IT companies

• Keeping PHI out of observability, analytics and AI tooling.
• Getting BAAs from every vendor in the data path.
• Multi-tenant SaaS with differing customer BAA terms.
• Offshore development teams accessing production PHI.
• Preparing for the stricter Security Rule while it is still being finalised.

Best practices

• Use only HIPAA-eligible cloud services covered by your provider’s BAA.
• Design for data minimisation: de-identify where you can.
• Encrypt everything and enforce MFA now, ahead of the final rule.
• Redact PHI in logs automatically.
• Test restores and aim for recovery of critical systems within 72 hours.
• Keep a BAA register and review subcontractors yearly.

Tools that help

How HIPAA relates to other frameworks

Real-world examples

• Change Healthcare (2024). A ransomware attack on a major healthcare clearinghouse disrupted claims processing across the US and became the largest healthcare data breach reported to HHS.
• Anthem (2018). Settled with OCR for USD 16 million after a cyber attack exposed the data of about 79 million people.
• Illustrative scenario, not a real company: an Indian development company builds a telehealth platform for a US clinic group. It signs a BAA, hosts only on HIPAA-eligible cloud services under its provider’s BAA, removes PHI from error logs, completes a risk analysis, and limits offshore access to de-identified data.

Frequently asked questions

Does HIPAA apply to SaaS companies? Yes, if they handle PHI on behalf of covered entities. They are business associates.

Is there a HIPAA certification? No. HHS doesn’t certify. SOC 2 or HITRUST reports are used as evidence.

What is a BAA? A business associate agreement: a required contract setting out how a vendor may use and must protect PHI.

Does HIPAA apply to companies outside the US? HIPAA’s direct reach is US-focused, but offshore vendors are bound through BAAs, and US customers remain liable for their vendors.

Is encryption required? It is “addressable” under the current rule but expected in practice. The proposed update would make it required.

How quickly must breaches be reported? Without unreasonable delay and no later than 60 days after discovery; BAAs often set shorter deadlines.

When will the new Security Rule be final? HHS has listed July 2027 as its target. Check HHS for updates.

Do consumer health apps fall under HIPAA? Usually not, unless they act for a covered entity. The FTC Health Breach Notification Rule and state laws may apply instead.

Next steps

• Confirm whether you are a business associate for each customer.
• List every vendor that touches PHI and get BAAs in place.
• Complete or refresh your security risk analysis.
• Enforce MFA and encryption across all ePHI systems.
• Strip PHI from logs and monitoring tools.