HIPAA Compliance Guide: Rules, Safeguards, and Checklist

HIPAA is different from most frameworks founders encounter. SOC 2 and ISO 27001 are voluntary — you pursue them because customers ask. HIPAA is federal law. If your product touches US health data in the wrong way without compliance, you are not losing a deal; you are exposed to regulatory penalties, mandatory breach reporting, and in egregious cases criminal liability.

The upside: HIPAA is more approachable than its reputation suggests. It is risk-based and flexible by design, and a startup can build a defensible compliance program in a few months. This guide covers who must comply, what the rules actually require, and a practical checklist to get there. For deeper material, see our HIPAA learning hub and the HIPAA framework overview.

What Is HIPAA?

The Health Insurance Portability and Accountability Act of 1996 is a US federal law that, among other things, sets national standards for protecting health information. The parts that matter for compliance programs are its administrative simplification rules, primarily:

• The Privacy Rule — governs how protected health information (PHI) may be used and disclosed.
• The Security Rule — requires safeguards for electronic PHI (ePHI).
• The Breach Notification Rule — mandates notification when unsecured PHI is compromised.
• The Enforcement Rule — defines investigations and civil money penalties.

The HITECH Act (2009) extended HIPAA obligations directly to vendors (business associates) and gave enforcement real teeth. The regulator is the Office for Civil Rights (OCR) within the Department of Health and Human Services (HHS). Note also: there is no HIPAA certification. No government body certifies compliance — you comply, document it, and can be audited or investigated. Vendors selling "HIPAA certified" seals are selling assessments, not official status.

Who Must Comply: Covered Entities vs Business Associates

HIPAA applies to two categories:

Covered entities (CEs):

• Healthcare providers who transmit health information electronically for standard transactions — hospitals, clinics, physicians, dentists, pharmacies, telehealth providers.
• Health plans — insurers, HMOs, employer-sponsored group health plans, Medicare/Medicaid.
• Healthcare clearinghouses — entities that translate health data between formats (e.g., billing intermediaries).

Business associates (BAs): any person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity. This is where most software companies land: EHR platforms, medical billing SaaS, telehealth infrastructure, analytics vendors, cloud hosts, transcription services, even a CRM holding patient records. Since HITECH, business associates are directly liable under the Security Rule and much of the Privacy Rule — "we're just the vendor" is not a defense. Subcontractors of business associates ("downstream BAs") are pulled in too, each link requiring its own agreement.

Who is not covered: consumer wellness apps with no covered-entity relationship (a fitness tracker selling directly to consumers), employers acting as employers, most life insurers. But beware the pivot: the moment your consumer health app signs a deal with a hospital or health plan and handles their patient data, you become a business associate. (Also note the FTC's Health Breach Notification Rule increasingly covers non-HIPAA health apps — HIPAA-exempt does not mean regulation-exempt.)

PHI and ePHI: What You're Protecting

Protected Health Information (PHI) is individually identifiable health information held or transmitted by a covered entity or business associate — information about health status, care, or payment that identifies (or could identify) an individual. ePHI is simply PHI in electronic form, which is what the Security Rule governs.

HHS's de-identification guidance lists 18 identifier types — names, geographic subdivisions smaller than a state, dates related to an individual, phone numbers, email addresses, SSNs, medical record numbers, IP addresses, biometric identifiers, full-face photos, and more. Health information stripped of all 18 (Safe Harbor method) or de-identified via documented expert determination is no longer PHI, and HIPAA no longer applies — which is why de-identification is a core strategy for analytics products.

Two scoping insights save startups a lot of pain:

1. PHI is contextual. An email address alone is not PHI; an email address in a patient list at a covered entity is. The combination of identifier + health context + covered relationship is what triggers HIPAA.
2. Shrink where PHI lives. Every system that touches ePHI is in scope. Keeping PHI out of logs, analytics tools, and support ticketing systems dramatically reduces your compliance surface.

The Privacy Rule

The Privacy Rule governs uses and disclosures of PHI in any form (paper, oral, electronic). Core requirements:

• Permitted uses: PHI may be used or disclosed without authorization for treatment, payment, and healthcare operations (TPO), plus specific public-interest exceptions. Most other uses — notably marketing and sale of PHI — require written patient authorization.
• Minimum necessary standard: use or disclose only the minimum PHI needed for the purpose (treatment disclosures between providers are exempt).
• Individual rights: patients can access their records (within 30 days), request amendments, receive an accounting of disclosures, and request restrictions. Right-of-access violations are one of OCR's most active enforcement areas.
• Notice of Privacy Practices: covered entities must publish how they use PHI.

Business associates encounter the Privacy Rule mostly through their BAA: they may use PHI only as the agreement permits.

The Security Rule

The Security Rule is where engineering teams live. It requires administrative, physical, and technical safeguards for ePHI, and it is deliberately flexible: safeguards are "addressable" or "required," and implementation should be reasonable for your size and risk. ("Addressable" does not mean optional — it means implement it, or document why an alternative is reasonable.)

Everything starts with the risk analysis — a documented assessment of threats and vulnerabilities to ePHI across your environment. A missing or stale risk analysis is the single most common finding in OCR enforcement actions.

Administrative safeguards

Physical safeguards

Technical safeguards

Encryption deserves emphasis: it is technically "addressable," but encrypted-and-key-secure PHI that is lost or stolen qualifies for the breach safe harbor — no notification required. Encrypt everything, everywhere, always.

Business Associate Agreements (BAAs)

A BAA is a written contract required before a business associate touches PHI. It must specify permitted uses, require safeguards, obligate breach reporting to the covered entity, flow obligations down to subcontractors, and require return or destruction of PHI at termination.

Practical rules of thumb:

• No BAA, no PHI. Ever. Sharing PHI with a vendor without a BAA is itself a violation, independent of whether anything goes wrong.
• Map your vendor chain. Cloud provider (AWS, GCP, and Azure all sign BAAs), email, analytics, support desk, monitoring, LLM APIs — anything that could see PHI needs a BAA or needs PHI kept out of it. Many popular SaaS tools will not sign BAAs on lower tiers; this drives real architecture and procurement decisions.
• As a startup BA, expect to sign customers' paper. Health systems send their own BAA templates; read the breach notification timelines (often stricter than the law) and indemnification clauses carefully.

The Breach Notification Rule

A breach is an impermissible acquisition, access, use, or disclosure of unsecured PHI, presumed reportable unless a documented risk assessment shows a low probability of compromise (considering the nature of the data, who accessed it, whether it was actually viewed, and mitigation).

Notification obligations:

• Individuals: without unreasonable delay, and no later than 60 days after discovery.
• HHS/OCR: within 60 days for breaches affecting 500+ individuals (these also hit the public "wall of shame" and trigger media notification in the affected region); smaller breaches are reported annually within 60 days of year-end.
• Business associates → covered entities: notify the CE without unreasonable delay, within 60 days — but BAAs almost always contract this down to something like 24–72 hours.

Encrypted data (with keys uncompromised) is not "unsecured," which again is why encryption is your best breach insurance.

Penalties for Non-Compliance

OCR civil money penalties are tiered by culpability, adjusted annually for inflation. Approximate current figures:

Beyond fines: multi-year corrective action plans with OCR monitoring, state attorney general actions, class-action lawsuits, and — for knowing misuse of PHI — criminal penalties up to 10 years' imprisonment. The pattern in enforcement is consistent: OCR punishes the absence of a risk analysis and willful neglect far more harshly than good-faith programs that suffered an incident.

HIPAA Compliance Checklist

A practical sequence for a startup becoming a compliant business associate:

• Determine your status — covered entity, business associate, or out of scope (document the analysis either way)
• Appoint a Security Officer and Privacy Officer (can be one person at a small company)
• Map your PHI data flows — where ePHI enters, is stored, is processed, and exits; minimize systems in scope
• Conduct and document a risk analysis — the foundational, most-audited requirement
• Write a risk management plan with prioritized remediation
• Adopt HIPAA policies and procedures — privacy, security, incident response, sanctions, contingency
• Implement technical safeguards — unique IDs, MFA, RBAC/least privilege, encryption at rest and in transit, session timeouts, audit logging
• Implement physical/endpoint safeguards — full-disk encryption, MDM, media disposal
• Sign BAAs — with your cloud provider and every vendor touching PHI; with your covered-entity customers
• Train your workforce — at onboarding and annually; keep completion records
• Build the incident response and breach notification process — including your contractual notification clocks
• Establish backup and disaster recovery — and test restores
• Schedule ongoing operations — annual risk analysis refresh, periodic access reviews, log reviews, policy updates
• Consider third-party validation — a SOC 2 + HIPAA mapped examination or HITRUST if enterprise health customers demand it

For budget strategies, see our cheapest HIPAA guide.

Common HIPAA Violations to Avoid

• No risk analysis — the headline finding in a majority of OCR settlements.
• Missing BAAs — especially with cloud and analytics subprocessors.
• Unencrypted laptops and drives — a lost encrypted laptop is a non-event; an unencrypted one is a reportable breach.
• Impermissible disclosures — PHI in misdirected emails, marketing lists, or (a recent enforcement focus) tracking pixels on patient-facing pages sending data to ad platforms.
• Right-of-access failures — not giving patients their records within 30 days; OCR runs a dedicated enforcement initiative on this.
• Snooping and over-access — employees viewing records without need; absent access reviews and audit-log monitoring.
• Slow or absent breach response — missing the 60-day clock, or discovering you had no process mid-incident.

Frequently Asked Questions

Is there an official HIPAA certification?

No. Neither HHS nor OCR certifies anyone. Third-party attestations (a HIPAA examination alongside SOC 2, or HITRUST certification) are credible evidence of your program, and customers often ask for them — but legally, compliance is demonstrated by your documentation: risk analysis, policies, training records, and BAAs.

Does HIPAA apply to my health-tech startup?

If you create, receive, maintain, or transmit PHI on behalf of a provider, health plan, or clearinghouse — yes, you are a business associate with direct legal obligations. If you sell a health app directly to consumers with no covered-entity relationship, HIPAA likely does not apply, though FTC rules may. The analysis depends on data flows and contracts, so document it and revisit when your business model changes.

How long does HIPAA compliance take, and what does it cost?

A focused startup can stand up a defensible program in 2–4 months. Costs typically run $5,000–$30,000: compliance automation tooling (~$4k–$15k/year, often bundled with SOC 2), training, endpoint management, and optionally an external assessment. The largest cost is usually engineering time for encryption, logging, and access-control work you arguably should do anyway.

What is the difference between the Privacy Rule and the Security Rule?

The Privacy Rule governs when PHI in any form may be used or disclosed and what rights patients have. The Security Rule governs how electronic PHI must be protected — administrative, physical, and technical safeguards. Privacy is about permission; Security is about protection.

Do I need a BAA with AWS or Google Cloud?

Yes, if ePHI touches their infrastructure. AWS, Google Cloud, and Azure all offer BAAs (AWS via its Artifact console, GCP and Azure through their terms). Signing it is necessary but not sufficient — you must also configure services within the BAA-eligible list and per their shared-responsibility guidance.

Is HIPAA compliance the same as SOC 2?

No, but they overlap heavily. SOC 2 is a voluntary attestation of security controls; HIPAA is law with specific requirements (BAAs, breach notification, patient rights) SOC 2 does not cover. Many companies do a SOC 2 examination with HIPAA criteria mapped in — one audit, two reports — which is often the most efficient path when customers want both.

What should I do the moment I suspect a breach?

Contain it, preserve evidence, and start the clock: document discovery date, run the four-factor risk assessment, and check your BAA notification deadlines (often 24–72 hours to your covered-entity customers, well before HIPAA's own 60 days). Having this play written down before you need it is itself a Security Rule requirement.

How AuditXYZ Helps

Most companies pursuing HIPAA are simultaneously juggling SOC 2 and customer security reviews — and the right tooling handles all of it from one control set. AuditXYZ lets you compare compliance automation platforms on HIPAA support, BAA availability, and multi-framework pricing, and browse vetted auditors who can bundle a HIPAA examination with your SOC 2. Compare before you buy; the difference between a good and mediocre pairing is measured in months and five figures.