What Is HIPAA and Who Does It Apply To?
The Health Insurance Portability and Accountability Act (HIPAA) is the US federal law that sets the standard for protecting sensitive patient health information. If your health tech startup handles Protected Health Information (PHI) — whether you are a healthcare provider, a health plan, a clearinghouse, or a business associate of any of these — HIPAA compliance is mandatory.
As a health tech startup, you almost certainly qualify as a business associate if your product or service involves creating, receiving, maintaining, or transmitting PHI on behalf of a covered entity (hospital, clinic, insurer). This means HIPAA applies to you directly, and you must sign Business Associate Agreements (BAAs) with every covered entity you work with.
HIPAA violations are expensive. The Office for Civil Rights (OCR) can impose penalties ranging from $100 to $50,000 per violation, up to $1.5 million per year per violation category. Criminal penalties can apply in cases of willful neglect.
The Three HIPAA Rules You Need to Know
The Privacy Rule
The Privacy Rule establishes standards for how PHI can be used and disclosed. Key requirements include:
- Minimum Necessary Standard — Only access, use, or disclose the minimum amount of PHI needed for a specific purpose
- Patient rights — Patients have the right to access their records, request corrections, and receive an accounting of disclosures
- Notice of Privacy Practices — Covered entities must provide patients with a clear notice of how their PHI is used
- Permitted uses and disclosures — PHI can be used for treatment, payment, and healthcare operations without explicit authorization; other uses generally require patient authorization
The Security Rule
The Security Rule specifically addresses electronic PHI (ePHI) and requires three categories of safeguards:
Administrative safeguards:
- Designate a Security Officer responsible for HIPAA security
- Conduct a thorough risk assessment
- Implement workforce training and access management
- Develop contingency plans for data loss or system failure
- Maintain policies and procedures documentation
Physical safeguards:
- Control physical access to facilities and equipment containing ePHI
- Implement workstation security policies
- Manage device and media controls (disposal, re-use, movement)
Technical safeguards:
- Implement access controls (unique user IDs, emergency access, automatic logoff, encryption)
- Maintain audit controls and logging
- Ensure integrity controls to prevent unauthorized ePHI alteration
- Implement transmission security (encryption for data in transit)
The Breach Notification Rule
If a breach of unsecured PHI occurs, you must:
- Notify affected individuals without unreasonable delay (within 60 days)
- Notify the HHS Secretary (immediately for breaches affecting 500+ individuals, or annually for smaller breaches)
- Notify prominent media outlets if the breach affects more than 500 residents of a state or jurisdiction
Step-by-Step: Building HIPAA Compliance
Step 1: Determine Your HIPAA Status
Clarify whether you are a covered entity, a business associate, or both. This determines your specific obligations and the agreements you need to have in place.
Step 2: Conduct a Risk Assessment
The risk assessment is the cornerstone of HIPAA compliance. HIPAA does not prescribe specific technologies — it requires you to assess risks and implement measures that are reasonable and appropriate for your organization.
Your risk assessment should:
- Identify all systems and locations where ePHI is created, stored, processed, or transmitted
- Identify potential threats and vulnerabilities
- Assess the likelihood and impact of each threat
- Document existing security measures
- Determine residual risk levels
- Create a risk management plan with prioritized remediation actions
Step 3: Implement Policies and Procedures
Based on your risk assessment, develop comprehensive policies covering:
- Access management and authentication
- Data encryption standards
- Backup and disaster recovery
- Incident response and breach notification
- Device and media management
- Workforce training requirements
- Vendor and business associate management
- Data retention and disposal
Step 4: Sign Business Associate Agreements
If you share ePHI with any subcontractors, cloud providers, or service providers, you need a BAA with each of them. Common examples include your cloud hosting provider (ensure they offer a BAA — AWS, Azure, and GCP all do), email service provider, and any analytics or monitoring tools that may access ePHI.
Step 5: Implement Technical Controls
- Encryption — Encrypt ePHI at rest (AES-256) and in transit (TLS 1.2+)
- Access controls — Implement role-based access, multi-factor authentication, and unique user identifiers
- Audit logging — Log all access to ePHI and review logs regularly
- Automatic session management — Implement automatic logoff after periods of inactivity
- Backup and recovery — Maintain retrievable, encrypted backups with tested recovery procedures
Step 6: Train Your Workforce
All workforce members with access to PHI must receive HIPAA training. Training should cover the Privacy Rule basics, security best practices, breach identification and reporting, and your organization’s specific policies and procedures. Document all training with dates, attendees, and content covered.
Step 7: Test and Audit Regularly
HIPAA compliance is not a one-time achievement. Conduct regular internal audits, penetration tests, and vulnerability assessments. Update your risk assessment at least annually or whenever significant changes occur in your environment.
Health Tech Specific Considerations
- Cloud architecture — Ensure your cloud deployment is HIPAA-eligible. Use dedicated or isolated environments, enable encryption by default, and maintain comprehensive logging.
- Mobile applications — If your product includes a mobile app that accesses PHI, apply the same security standards. Consider mobile device management (MDM) requirements.
- APIs and integrations — Secure all API endpoints that transmit ePHI. Use OAuth 2.0 or equivalent authentication, TLS encryption, and input validation.
- Development practices — Never use real PHI in development or testing environments. Use synthetic or de-identified data sets instead.
How SeedGovernance Helps
SeedGovernance offers a complete HIPAA compliance toolkit tailored for health tech startups. Our platform includes risk assessment templates, pre-built policies covering all HIPAA safeguards, BAA templates, training tracking, and incident response workflows. The guided assessment identifies your specific gaps and creates a prioritized remediation roadmap.
Start your free assessment to understand your HIPAA readiness today.