HIPAA (the Health Insurance Portability and Accountability Act) is a federal US law that mandates protections for Protected Health Information (PHI). If your SaaS product creates, receives, maintains, or transmits PHI on behalf of a Covered Entity (hospital, health plan, healthcare clearinghouse), you are a Business Associate — and HIPAA applies to you fully.
Are You a Business Associate?
You are a Business Associate (BA) if your service:
- Stores or processes patient records, clinical data, or insurance claims
- Provides data analytics or AI services using identifiable health data
- Offers cloud infrastructure where a healthcare customer stores PHI
- Provides billing, coding, or transcription services involving PHI
If any of the above applies, you must sign a Business Associate Agreement (BAA) with each Covered Entity customer before processing their PHI.
The Three HIPAA Rules
HIPAA Privacy Rule
Establishes what constitutes PHI and restricts how it can be used and disclosed. As a Business Associate, your obligations are defined by your BAA and the minimum-necessary standard — you can only access PHI to the extent necessary to perform your services.
HIPAA Security Rule
Applies specifically to Electronic PHI (ePHI). Requires implementation of:
- Administrative safeguards: Security Officer designation, workforce training, risk analysis, access management procedures
- Physical safeguards: Facility access controls, workstation use policies, device and media controls
- Technical safeguards: Access controls, audit controls, integrity controls, transmission security (TLS)
HIPAA Breach Notification Rule
- Notify the Covered Entity within 60 days of discovering a breach
- The Covered Entity notifies affected individuals and HHS
- Breaches affecting 500+ individuals require HHS notification without unreasonable delay
Key Technical Safeguards for SaaS Products
| Requirement | Implementation Example |
|---|---|
| Unique user identification | No shared accounts; each user has a unique login |
| Automatic log-off | Sessions expire after 15 minutes of inactivity |
| Encryption in transit | TLS 1.2+ on all API endpoints; no HTTP fallback |
| Encryption at rest | AES-256 encryption for all ePHI in databases and object storage |
| Audit controls | Immutable logs of all access to ePHI records |
| Integrity controls | Checksums or digital signatures to detect ePHI tampering |
Building Your HIPAA Compliance Programme
Step 1: Conduct a Risk Analysis
HIPAA requires a thorough, accurate, and organisation-wide risk analysis to identify threats and vulnerabilities to ePHI. This must be documented and reviewed regularly. Many auditors consider the risk analysis to be the single most important HIPAA requirement.
Step 2: Implement Policies and Procedures
- Information Security Policy covering ePHI handling
- Workforce access control policy (who can access what data)
- Breach response procedure with notification timelines
- Device and media disposal procedure
- Remote access and BYOD policy
Step 3: Train Your Workforce
Every employee with access to ePHI must receive HIPAA training at hiring and at least annually thereafter. Training records must be maintained for six years.
Step 4: Manage Your Subcontractors
If you use sub-processors that access ePHI (AWS, SendGrid, a logging provider), you must sign BAAs with each of them. Maintain a register of all sub-Business Associates.
Common HIPAA Pitfalls for SaaS Companies
- Storing PHI in unsecured logging tools (e.g., error messages containing patient IDs)
- Using third-party analytics tools that receive ePHI without a signed BAA
- Failing to conduct a formal risk analysis before going live with a healthcare customer
- No documented off-boarding procedure for employees who accessed ePHI
- No testing or tabletop exercise for the breach response procedure