Stay HIPAA compliant while shipping product weekly

What is HIPAA?

HIPAA (Health Insurance Portability and Accountability Act) is a US federal law that sets standards for protecting sensitive patient health information. Any organization that creates, receives, maintains, or transmits protected health information (PHI) must comply.

The three HIPAA rules

• Privacy Rule — governs who can access PHI and under what conditions.
• Security Rule — requires administrative, physical, and technical safeguards to protect electronic PHI (ePHI).
• Breach Notification Rule — mandates timely reporting of PHI breaches to affected individuals, HHS, and in some cases the media.

Who must comply?

HIPAA applies to covered entities (health plans, healthcare providers, clearinghouses) and business associates — any vendor or subcontractor that handles PHI on their behalf. SaaS companies serving healthcare customers almost always fall under the business associate category.

Common compliance gaps

• Missing BAAs — business associate agreements must be in place before PHI is shared with any vendor.
• Access control drift — employee role changes and offboarding create orphaned access to ePHI systems.
• Incident response delays — the breach notification rule requires reporting within 60 days, which demands a practiced, documented response process.