HIPAA Compliance for Digital Health Startups: What You Actually Need to Know

Last updated: March 2026

HIPAA compliance means your organization has implemented documented controls to protect protected health information (PHI), can demonstrate those controls to an auditor, and has agreements in place with every vendor who touches that data on your behalf. It is not a certification, not a one-time event, and not something a vendor can fully handle for you. It is an ongoing organizational practice that spans your infrastructure, your policies, and your workforce.

Who HIPAA applies to

HIPAA divides regulated organizations into two categories.

Covered entities

Covered entities are health insurers, health plans, self-insured employers, claims clearinghouses, and healthcare providers that conduct certain electronic transactions. In practice, almost any healthcare provider that bills insurance is a covered entity, even if only some patients use insurance.

Business associates

A business associate is any organization that handles PHI on behalf of a covered entity or another business associate. This is the category most digital health startups fall into. If you are building a platform for hospitals, clinics, or health plans, and your platform processes, stores, or transmits patient data, you are a business associate.

HIPAA requires that every business associate relationship be formalized in a contract: the Business Associate Agreement, or BAA. Missing a BAA with a vendor that touches PHI is a HIPAA violation regardless of how strong your other controls are.

The business associate chain

BA relationships can form a chain. An example: a digital health platform runs on Aptible, which runs on AWS. The platform is a business associate of its hospital clients. Aptible is a business associate of the platform. AWS is Aptible's business associate. The platform doesn't need a direct BAA with AWS unless it uses AWS services on its own.

What this means practically: you need a BAA with every vendor that could touch PHI. Your hosting provider, managed database, log management service, storage layer, analytics platform, email provider. Not having one is a compliance gap regardless of how good your other controls are.

→ For what to look for before signing a BAA, see Business Associate Agreements .

To determine whether your specific organization is regulated, consult an attorney.

What counts as PHI

Protected health information (PHI) is any individually identifiable health information. To be PHI, data must:

1. Relate to an individual's past, present, or future physical or mental health condition, healthcare provision, or payment for healthcare
2. Identify (or could reasonably be used to identify) the individual

The 18 identifiers

Under HIPAA's Safe Harbor de-identification standard, the following identifiers must be removed before data is considered de-identified:

• Names
• Geographic subdivisions smaller than a state
• Dates more specific than year (except for patients over 89)
• Phone numbers
• Fax numbers
• Email addresses
• Social security numbers
• Medical record numbers
• Health plan beneficiary numbers
• Account numbers
• Certificate or license numbers
• Vehicle identifiers
• Device identifiers
• Web URLs
• IP addresses
• Biometric identifiers
• Full-face photographs
• Any other unique identifier.

What tends to surprise startups

PHI is broader than medical records. A patient's name plus an appointment date plus the name of a healthcare provider is PHI, even without any clinical data attached.

Encryption doesn't change PHI status. Encrypted PHI is still PHI. Any vendor handling it (even without the ability to decrypt it) requires a BAA.

De-identification is a specific process, not a judgment call. HIPAA defines two standards: Safe Harbor (remove all 18 identifiers) and Expert Determination (a qualified expert performs a statistical analysis showing re-identification risk is "very small"). If a business partner says data is "de-identified," verify which standard was applied and how.

Aggregate health data is usually still PHI. Unless properly de-identified per one of those two standards, aggregating records doesn't strip PHI status.

The three HIPAA rules

HIPAA's regulatory framework has three main rules. All three apply to business associates.

The Privacy Rule

The Privacy Rule covers PHI in all forms: oral, written, and electronic. It governs how PHI can be used and disclosed, grants patients specific rights over their data (access, amendment, accounting of disclosures), and requires workforce training and BAAs with all business associates.

The Security Rule

The Security Rule covers electronic PHI only. It requires administrative, physical, and technical safeguards, and mandates documented policies and procedures showing how those safeguards were selected and maintained.

The Breach Notification Rule

The Breach Notification Rule defines what constitutes a reportable breach, who must be notified, and how fast. For covered entities, the deadline is 60 days from discovery; for large breaches (500+ individuals), HHS and local media are also notified.

For business associates, the obligation runs to your covered entity customer: notify them "without unreasonable delay and in no case later than 60 days" after discovering a breach. Your BAA may specify a shorter timeline, and it should.

The safeguard framework

The Security Rule organizes its requirements into three categories. All three are required.

Administrative safeguards

Administrative safeguards are the management controls: how your organization selects, implements, and maintains its security program. This is the category most startups underestimate.

Security Management Process

This is the foundation of the entire Security Rule. It has four required elements:

• Risk analysis: A formal assessment of the risks to ePHI confidentiality, integrity, and availability in your environment.
• Risk management: A documented plan for addressing identified risks, with prioritization and timelines.
• Sanction policy: What happens to employees who violate your HIPAA policies, and how you track sanctions.
• Information system activity review: How you audit system and application activity on an ongoing basis.

Security officer

You must designate a person responsible for HIPAA security. At an early startup this is usually the CTO or a senior engineer. It doesn't need to be a dedicated full-time role, but it must be a named individual.

Workforce training

All workforce members with access to PHI must receive HIPAA training. You must retain records demonstrating that training occurred. "We told everyone verbally" isn't evidence of training.

Access management

Documented procedures for establishing, modifying, and terminating access to systems containing PHI.

Incident response procedures

A documented process for identifying, responding to, and reporting security incidents.

Contingency planning

Documented data backup, disaster recovery, and emergency mode operation plans.

BAA management

Documented processes for ensuring your vendor BAAs contain appropriate security obligations.

Physical safeguards

Physical safeguards cover the facilities, hardware, and devices that house ePHI.

Key requirements:

• Workstation use policy: Documented rules for how employees use computers to access PHI.
• Workstation security: How you secure work computers, including disk encryption, screen lock policies, and remote wipe capability.
• Device and media controls: Documented procedures for disposing of or reusing devices that handled PHI.

Technical safeguards

Technical safeguards are the engineering controls.

Access controls

• Unique user identification (required): Each user must have a unique identifier for accessing systems containing PHI.
• Emergency access procedure (required): A defined process for accessing PHI in an emergency.
• Automatic logoff (addressable): Sessions on systems containing PHI should terminate after a period of inactivity.
• Encryption and decryption (addressable): Encryption of ePHI at rest and a defined key management procedure.

Audit controls (required)

Hardware, software, and procedural mechanisms to record and examine access and activity in systems that contain PHI.

Integrity controls

Mechanisms to ensure that ePHI has not been altered or destroyed in an unauthorized manner.

Person or entity authentication (required)

Your systems must verify that a person or entity seeking access to ePHI is who they claim to be.

Transmission security

ePHI transmitted over a network must be protected against unauthorized interception.

What "HIPAA compliant" actually means

There is no HIPAA certification. The Office for Civil Rights does not issue certificates. No government body audits you and tells you that you pass.

What HIPAA requires is that you implement reasonable and appropriate safeguards, document them, and be able to demonstrate you did so if OCR investigates or a customer auditor asks. The standard is evidence-based, not attestation-based.

Penalties

HHS can impose penalties for violations of any HIPAA provision, not just ones that result in a breach. Penalty tiers range from $100–$50,000 per violation depending on culpability, with annual maximums by violation category.

HIPAA vs. HITECH vs. HITRUST

What does HIPAA compliance cost?

Costs vary significantly based on your stage, how much you can inherit from your infrastructure provider, and how manual vs. automated your compliance operations are.

A note on total cost at early stage: Most pre-Series A startups spend $1,000–$5,000/month on HIPAA-related infrastructure and tooling, with a larger one-time spend ($10,000–$30,000) to establish initial policies, documentation, and legal review.

Compliance by stage

When to start, what to prioritize, and how requirements evolve as your company grows depends heavily on where you are.

FAQs

What's the difference between a covered entity and a business associate?

A covered entity is a healthcare provider, health plan, or clearinghouse that is regulated by HIPAA directly. A business associate is any organization that handles PHI on behalf of a covered entity or another business associate.

Does my hosting provider need to sign a BAA?

Yes. If your application handles PHI and runs on a provider's infrastructure, that provider must sign a BAA.

Can I be fined for HIPAA violations without a breach?

Yes. HHS can impose penalties for violations of any provision of the HIPAA rules, not just ones that result in a breach.

What does "addressable" mean in the Security Rule?

The Security Rule distinguishes between "required" and "addressable" implementation specifications. Addressable does not mean optional.

How long do I need to retain compliance documentation?

HIPAA requires retention of Security Rule compliance documentation (policies, risk assessments, training records, audit logs) for a minimum of six years from creation or last effective date, whichever is later.

What should I look for in a hosting provider's HIPAA offering?

At minimum: a signed BAA, AES-256 encryption at rest, TLS 1.2+ in transit, audit logging with tamper-evident storage, network isolation, and documented security certifications (SOC 2 Type II report or HITRUST R2).

What's HITRUST and do I need it?

HITRUST R2 is a third-party certification against the HITRUST Common Security Framework, a comprehensive control set that incorporates HIPAA, NIST, ISO 27001, and other frameworks.

What is PHI de-identification and when does it apply?

De-identification is the process of removing or transforming data so that it no longer identifies (or could reasonably identify) an individual.

Do I need a separate BAA for every AWS service I use?

If you use AWS independently, yes: you would execute a BAA with AWS. If you run on Aptible, Aptible's BAA covers the infrastructure layer.

What does HIPAA compliance cost?

Costs vary by stage and approach. Early-stage teams typically spend $1,000–$5,000/month on HIPAA-eligible infrastructure and tooling.

How do I become HIPAA compliant?

There is no official certification or government approval process. Becoming HIPAA compliant means: (1) determining whether HIPAA applies to your organization; (2) mapping where PHI flows through your systems; (3) executing BAAs with all vendors that touch PHI; (4) implementing and documenting the required administrative, physical, and technical safeguards; and (5) maintaining that program on an ongoing basis through training, risk assessments, incident response, and policy reviews.

→ Start with the HIPAA Compliance Checklist for a structured list of every required control.