The healthtech sector is booming, but it carries a fatal trapdoor. Unlike general B2B SaaS where a data breach results in lost trust and a bad PR cycle, a breach in the healthcare space triggers federal investigations and ruinous government fines under the Health Insurance Portability and Accountability Act (HIPAA).
HIPAA is not an optional "nice-to-have" certification like ISO 9001. It is absolute US Federal Law. Furthermore, no major hospital network, clinic, or health insurance provider will ever buy your software if you cannot definitively prove your architecture is HIPAA compliant.
Part 1: Covered Entities vs. Business Associates
The first step in understanding HIPAA is figuring out where your company sits in the healthcare supply chain.
Covered Entities (CEs)
These are the organizations that directly provide treatment, payment, or operations in healthcare. This includes doctors, clinics, psychologists, dentists, chiropractors, nursing homes, and health insurance companies.
Business Associates (BAs)
This is where 99% of healthtech startups fall. A Business Associate is any vendor or subcontractor that creates, receives, maintains, or transmits Protected Health Information (PHI) on behalf of a Covered Entity. If a hospital uses your cloud software to store patient charts, process payments, or schedule appointments. You are a Business Associate, and you are entirely subject to HIPAA regulations.
Part 2: What Exactly is PHI?
Protected Health Information (PHI) is any health information that can be tied back to an individual patient. HIPAA explicitly outlines 18 identifiers that elevate generic medical data into highly regulated PHI. These include:
- Names and Social Security Numbers.
- Geographic data smaller than a state (like a zip code or street address).
- All dates directly related to a patient (birth dates, admission/discharge dates).
- Phone numbers, email addresses, and IP addresses.
- Medical record numbers, health plan numbers, and biometric identifiers (like fingerprints or full-face photos).
Crucial Note: If you fully strip all 18 identifiers from the data, it is considered "de-identified" and is no longer subject to HIPAA restrictions. Many AI startups survive by ensuring they only process strictly de-identified aggregate data.
Short of full de-identification, the Privacy Rule's minimum necessary standard still applies: every system, integration, and employee should only be able to access the PHI their specific job requires, not the whole record. In a security review, this is usually the fastest, cheapest fix available, most access-control gaps are scoping problems, not encryption problems.
Part 3: The Three Core HIPAA Rules
To achieve compliance, your organization must satisfy the requirements of three primary federal rules.
1. The Privacy Rule
This rule establishes national standards to protect individuals' medical records and other personal health information. It applies to health plans, healthcare clearinghouses, and those health care providers that conduct certain health care transactions electronically. It dictates what rights patients have over their health information (like the right to examine and obtain a copy of their health records).
2. The Security Rule
For healthtech companies, this is the heavy lift. The Security Rule dictates exactly how you must protect electronic PHI (ePHI). It requires you to implement three types of safeguards:
- Administrative Safeguards: Policies and procedures governing conduct (e.g., assigning a dedicated Security Officer, implementing an incident response plan).
- Physical Safeguards: Controlling physical access to the servers or devices that store ePHI (e.g., using specialized keycards for server rooms).
- Technical Safeguards: The engineering controls. This mandates that ePHI must be encrypted both in transit and at rest. It also requires strict access controls, so an employee can only access the specific ePHI necessary for their job role.
Not every specification here carries the same weight. Some are required, you implement them exactly as written. Others are addressable, meaning you assess whether they're reasonable for your environment and, if you skip one, document an equivalent alternative. Addressable is not a synonym for optional, and "we didn't get to it" is not a valid alternative. Most teams satisfy the encryption specification with industry-standard approaches such as AES-256 for data at rest and TLS 1.2 or higher for data in transit.
Note: Because the Security Rule requires heavy technical controls, many companies implement ISO 27001 or SOC 2 alongside HIPAA to prove their engineering maturity.
3. The Breach Notification Rule
If your systems are hacked and unsecured PHI is exposed, you must legally notify the affected individuals, the Secretary of Health and Human Services (HHS), and, in some cases, the media.
Separately, civil penalties for the underlying Privacy and Security Rule violations scale across four culpability tiers, from unknowing violations at the low end to uncorrected wilful neglect at the high end, with the top tier reaching well into six or seven figures per year for repeated violations of the same requirement. HHS adjusts the exact dollar thresholds for inflation most years, so treat any specific figure you see quoted online as a snapshot, not a permanent number.
Part 4: The BAA (The Key to B2B Healthcare Sales)
If you want to sell software to a hospital (a Covered Entity), they will demand that you sign a Business Associate Agreement (BAA).
A BAA is a legally binding contract that states you (the vendor) will handle their PHI safely and that you assume legal liability if you suffer a breach. You cannot just "sign it and hope." If you sign a BAA without having actual technical encryption and privacy policies in place, you are committing gross negligence, exposing your executives to potential criminal penalties.
Does AWS, Azure, or Google Cloud Make You HIPAA Compliant?
No, and this is the most common misunderstanding we see from first-time healthtech founders. AWS, Azure, and Google Cloud will all sign a BAA and offer HIPAA-eligible services, but that only covers their side of the shared-responsibility model, physical security, hypervisor isolation, and the like. Whether your specific application is compliant still depends on how you configure it: which services you use, how you encrypt data, how you manage access keys, and whether you've actually signed a BAA with the provider in the first place. A HIPAA-eligible service used incorrectly is still a HIPAA violation waiting to happen.
Is Your Software Ready for a BAA?
Before you sign enterprise healthcare contracts, let our experts audit your cloud architecture against the HIPAA Security Rule.
Get a Compliance EstimateConclusion: Don't Build Healthcare Tech Without a Roadmap
Re-engineering a SaaS product to be HIPAA compliant after it has already been built is an agonizingly expensive process. The smartest healthtech founders engineer "Privacy by Design" from day one, tracking data flows and ensuring cloud databases are siloed and encrypted.
Secure Your Space in the Healthcare Supply Chain
At Avantcert Management Solutions, we help SaaS startups architect HIPAA-compliant cloud environments and draft airtight BAAs so they can close six-figure hospital contracts without fear of regulatory fines.
Speak to a HIPAA ExpertRelated service: Explore Avantcert's HIPAA compliance, expert gap analysis, implementation, and accredited audit support.
Frequently asked questions about HIPAA compliance
What is HIPAA?
The US Health Insurance Portability and Accountability Act sets national standards for protecting Protected Health Information (PHI).
Is there an official HIPAA certification?
No - HHS does not certify or endorse any HIPAA certification; organisations demonstrate compliance through risk assessments, controls and independent attestation.
Who must comply with HIPAA?
Covered entities (health plans, providers, clearinghouses) and their business associates that create, receive or store PHI.
What are the main HIPAA rules?
The Privacy Rule, the Security Rule (administrative, physical and technical safeguards), and the Breach Notification Rule.
How do you prove HIPAA compliance without a certificate?
Through a documented Security Risk Assessment, policies, workforce training, Business Associate Agreements, and often a third-party HIPAA attestation or HITRUST certification.
What are the penalties for HIPAA violations?
Civil penalties scale by culpability tier and can reach millions of dollars per year, with criminal penalties for wilful misuse of PHI.
How long does HIPAA readiness take?
A structured risk assessment and remediation typically takes a few months depending on size and systems.
Does hosting on AWS, Azure, or Google Cloud make my app HIPAA compliant?
No. Cloud providers will sign a BAA and offer HIPAA-eligible infrastructure, but compliance depends on how you configure and use those services, encryption, access controls, logging, not just where you host.
What happens if I don't sign a Business Associate Agreement?
Operating without a required BAA is itself a HIPAA violation, separate from any breach. It also leaves the covered entity and the vendor without a contractual mechanism for liability if PHI is mishandled.
What's the difference between "required" and "addressable" Security Rule safeguards?
Required specifications must be implemented as written. Addressable specifications must still be assessed and, if not implemented as written, replaced with a documented equivalent alternative; addressable does not mean optional.
Is de-identified health data still subject to HIPAA?
No. Once all 18 HIPAA identifiers are removed from a dataset, it is considered de-identified and falls outside HIPAA's restrictions, which is why some companies limit themselves to aggregate, de-identified data.
About Avantcert. Avantcert is an ISO and compliance certification consultancy that has guided 3,000+ organisations across 40+ markets to certification, with gap analysis, implementation and accredited audit readiness, request a free quote.