HIPAA readiness for health-tech and software companies

The moment your software creates, receives, maintains, or transmits protected health information on behalf of a covered entity, you are a business associate, and most of HIPAA's Security Rule applies to you directly, with direct enforcement exposure to match. Since the HITECH Act, OCR does not need to go through your customer to reach you. Health-tech companies frequently misjudge this boundary in both directions: some assume a signed BAA is the compliance program, while others burn effort on HIPAA when their data flows never actually trigger it. Getting the applicability analysis right is step one, because everything else is scoped by it.

For a software company, the practical work of HIPAA readiness looks different from a hospital's. Your risk analysis centers on the product architecture: where PHI flows, which services and stores touch it, how tenants are isolated, what your subprocessors see. Your safeguards live in infrastructure-as-code, IAM policy, and encryption defaults rather than facility badges. And your BAA obligations run in two directions: upstream commitments to customers that your sales team wants signed quickly, and downstream agreements with every cloud and SaaS vendor in the PHI path. Readiness means making all three layers consistent.

Key considerations for technology teams

• Applicability analysis comes first. Map every data flow and determine what is actually PHI in your hands; de-identified data meeting the Safe Harbor or expert determination standard is out of scope, and knowing that boundary precisely saves both compliance effort and sales friction.

• Your BAA stack must be coherent. The commitments you sign upstream to covered entities cannot exceed what your downstream subprocessor BAAs and your architecture actually support; mismatches here are discovered during customer diligence or, worse, during a breach.

• Minimum necessary applies to your systems and staff. Support engineers with standing production access to PHI is the classic health-tech finding; access should be role-scoped, time-boxed where possible, and logged in a way you can produce.

• Breach obligations flow through contracts and regulation simultaneously. As a business associate you must notify affected covered entities without unreasonable delay (no later than 60 days, and your BAAs often promise faster); your incident response runbook needs those clocks built in.

• Customers will audit you. Covered entities increasingly verify rather than trust: expect security questionnaires, SOC 2 requests, and BAA-granted audit rights. A HIPAA program that produces reusable evidence pays for itself in shortened sales cycles.

Frequently asked questions

Related readiness guides