A practical guide to HIPAA compliance for software companies, covering the Security Rule, Privacy Rule, and Business Associate Agreements.
HIPAA is the US federal law governing the privacy and security of protected health information (PHI). If your SaaS product handles, stores, or transmits PHI on behalf of US healthcare organisations, HIPAA compliance is not optional. This guide explains what HIPAA requires, what a Business Associate Agreement means for your business, and how to build a compliant programme.
HIPAA applies to Covered Entities, healthcare providers, health plans, and healthcare clearinghouses, and their Business Associates. A Business Associate is any organisation that creates, receives, maintains, or transmits PHI on behalf of a Covered Entity.
As a SaaS company, if your product processes PHI for healthcare customers, you are a Business Associate. This means you must comply with the HIPAA Security Rule, sign a Business Associate Agreement (BAA) with each Covered Entity customer, and ensure your sub-processors also meet HIPAA requirements.
PHI includes any individually identifiable health information, not just medical records, but also appointment data, billing information, and any data that could be used to identify a patient in connection with their health.
The Privacy Rule establishes standards for the use and disclosure of PHI. It gives patients rights over their health information and sets limits on who can access it and under what circumstances.
The Security Rule applies specifically to electronic PHI (ePHI) and requires Covered Entities and Business Associates to implement administrative, physical, and technical safeguards to protect it. This is the rule most relevant to SaaS companies.
The Breach Notification Rule requires notification to affected individuals, the Department of Health and Human Services (HHS), and in some cases the media, following a breach of unsecured PHI.
A BAA is a legally binding contract between a Covered Entity and a Business Associate. It specifies the permitted uses and disclosures of PHI, requires the Business Associate to implement appropriate safeguards, and establishes breach notification obligations.
You cannot process PHI for a healthcare customer without a signed BAA. Many healthcare organisations will not sign a BAA with a vendor that cannot demonstrate HIPAA compliance, so having your compliance programme in place before approaching healthcare customers is essential.
Your BAA must also flow down to your sub-processors, cloud providers, analytics platforms, and any other service that processes PHI on your behalf. Major cloud providers such as AWS, Azure, and Google Cloud offer BAAs for their services.
Security management process, workforce training, access management, contingency planning, and evaluation procedures.
Facility access controls, workstation use policies, and device and media controls for systems handling ePHI.
Access controls, audit controls, integrity controls, and transmission security for ePHI.
Written agreements with all Covered Entity customers and sub-processors that handle PHI.
Notification to affected individuals within 60 days, to HHS annually (or immediately for large breaches), and to media for breaches affecting 500+ individuals in a state.
Regular risk analysis to identify threats and vulnerabilities to ePHI, and a risk management plan to address identified risks.
Identify all ePHI your system creates, receives, maintains, or transmits, including data at rest, in transit, and in backups.
Conduct a formal risk analysis identifying threats and vulnerabilities to ePHI and assessing the likelihood and impact of each.
Implement administrative, physical, and technical safeguards to address identified risks.
Develop HIPAA-required policies and procedures, including workforce training, incident response, and breach notification.
Establish a BAA programme, template agreements for customers, sub-processor BAAs, and a process for managing the BAA lifecycle.
Annual risk analysis updates, workforce training, and monitoring of sub-processor compliance.
Netru methodology