A lot of SaaS companies discover they're subject to HIPAA the moment a healthcare customer sends over a Business Associate Agreement to sign. If your product stores, processes, or transmits Protected Health Information (PHI) on behalf of a healthcare provider, insurer, or clearinghouse, you're a Business Associate under HIPAA — and that comes with real, specific obligations, not just a contract to sign and file away.
Covered Entities vs Business Associates
HIPAA draws a line between two roles. Covered Entities are healthcare providers, health plans, and healthcare clearinghouses — the organisations that directly treat patients or handle claims. Business Associates are any vendor that creates, receives, maintains, or transmits PHI on a Covered Entity's behalf — this is where most healthcare SaaS products sit: EHR platforms, billing software, patient communication tools, and cloud infrastructure providers hosting any of the above.
The Business Associate Agreement (BAA) is not optional
Before a Covered Entity can legally share PHI with you, HIPAA requires a signed Business Associate Agreement — a contract that obligates you to safeguard the PHI, use it only for permitted purposes, report breaches, and flow the same obligations down to any subcontractor you use that also touches that data. Operating without a BAA in place isn't a paperwork gap — it's a direct HIPAA violation for both parties.
HIPAA is actually three rules, not one
- The Privacy Rule — governs how PHI may be used and disclosed, and gives patients rights over their own health information.
- The Security Rule — sets specific requirements for protecting electronic PHI (ePHI), which is the rule most relevant to a SaaS vendor's day-to-day engineering and operations.
- The Breach Notification Rule — sets out what you must do if PHI is compromised.
The Security Rule's three categories of safeguards
For a SaaS vendor, the Security Rule is where most of the actual implementation work lives. It groups requirements into three categories:
- Administrative safeguards — risk analysis, workforce training, access management policies, a designated security official, and contingency planning.
- Physical safeguards — controlling physical access to systems and facilities where ePHI is stored, and controls over workstations and media containing it.
- Technical safeguards — access controls (unique user IDs, automatic logoff), audit controls (logging), integrity controls, and transmission security (encryption in transit, and in most practical implementations, at rest too).
There is no such thing as being "HIPAA certified"
This is one of the most common misconceptions in the market. HHS does not endorse or recognise any official HIPAA certification program — you'll see vendors selling "HIPAA certification," but there is no government-backed certificate to earn the way there is with ISO 27001. What you can genuinely demonstrate is a documented compliance program: completed risk assessments, signed BAAs, implemented safeguards, and evidence they're actually operating — which is exactly what a healthcare customer's security review will actually ask to see.
Breach notification obligations
If a breach of unsecured PHI occurs, the Breach Notification Rule requires notifying affected individuals without unreasonable delay, and generally no later than 60 days after discovery. As a Business Associate, your BAA will typically require you to notify the Covered Entity even faster than that, since they carry their own downstream notification obligations to patients, HHS, and — for breaches affecting 500 or more individuals — the media.
The minimum necessary standard
A recurring theme across HIPAA is the "minimum necessary" principle: when using or disclosing PHI, limit it to the minimum necessary to accomplish the intended purpose. For a SaaS product, this shapes real engineering decisions — role-based access control that actually restricts which staff can view PHI, and data minimization in what you collect and retain in the first place, not just in your marketing copy.
This guide is general information, not legal advice — whether you qualify as a Business Associate, and what your specific obligations are, depends on your exact product and data flows. Consult a qualified professional for advice specific to your organisation.
Turning safeguards into evidence a customer will actually accept
Healthcare customers' security reviews almost always ask for proof, not just policy statements. ComplianceDesk's HIPAA framework maps the Security Rule's administrative, physical, and technical safeguards to pre-built controls, with an evidence vault to attach proof directly and reminders before a recurring safeguard — like an annual risk assessment or access review — falls overdue.