HIPAA is a U.S. federal law that establishes national standards for protecting the privacy and security of individually identifiable health information. For technology companies, HIPAA's Security Rule and Privacy Rule define how protected health information (PHI) must be handled, requiring specific administrative, physical, and technical safeguards whenever a company creates, receives, maintains, or transmits health data.
HIPAA is the U.S. law governing the protection of health information. Enacted in 1996 and significantly expanded by the HITECH Act in 2009, HIPAA sets the rules for how protected health information (PHI) is stored, transmitted, and accessed.
HIPAA has two primary rules relevant to startups:
Protected health information includes any individually identifiable health information: medical records, lab results, insurance information, and any data that links an individual to a health condition, treatment, or payment for healthcare.
HIPAA applies to two categories of organizations:
If your software processes, stores, or transmits health data for a healthcare provider or health plan, you're likely a business associate. This includes healthtech platforms, EHR integrations, telehealth tools, healthcare analytics products, patient engagement apps, and even general-purpose SaaS tools (project management, communication) if a healthcare client uses them to handle PHI.
Business associates must sign a Business Associate Agreement (BAA) with covered entities, which contractually obligates you to comply with HIPAA's security and privacy requirements.
The Security Rule's technical safeguards that most affect startups include:
Ask this question: does your product or service create, receive, maintain, or transmit protected health information on behalf of a healthcare provider, health plan, or healthcare clearinghouse? If yes, you're a business associate and HIPAA applies. Common triggers include: your app stores patient data, your platform integrates with electronic health records, your analytics tool processes health-related data, or a healthcare customer wants to use your general-purpose SaaS tool with PHI. If a healthcare customer asks you to sign a BAA, that's a definitive signal that HIPAA compliance is required.
HIPAA is a federal law with specific requirements for protecting health information. Non-compliance carries legal penalties including fines and criminal charges. SOC 2 is a voluntary audit framework for demonstrating security controls. There's significant overlap in the security controls they require (access management, logging, encryption, incident response), and many startups pursue both: SOC 2 for broad enterprise sales credibility and HIPAA compliance for healthcare-specific market access. SOC 2 doesn't satisfy HIPAA by itself (they have different scoping and requirements), but the security practices overlap substantially.
HIPAA's Security Rule classifies encryption as an "addressable" safeguard, not a "required" one. However, "addressable" doesn't mean "optional." It means you must either implement encryption or document why an equivalent alternative control provides the same level of protection. In practice, encryption of ePHI at rest and in transit is considered the standard of care, and not encrypting is extremely difficult to justify. Additionally, unencrypted PHI that is breached triggers notification requirements, while properly encrypted PHI that is lost or stolen may qualify for a safe harbor exemption from breach notification.
