A SaaS company is subject to HIPAA when it creates, receives, maintains or transmits electronic protected health information (ePHI) for a covered entity, which makes it a business associate. The checklist is: confirm your role, sign business associate agreements, run a risk analysis, then apply administrative, physical and technical safeguards and document everything.
Key takeaways
- Business associates are directly covered by the HIPAA Security Rule.
- Risk analysis and risk management are required, not addressable.
- Addressable does not mean optional. You implement it, or document why an equivalent measure is reasonable.
- Subcontractors that touch ePHI need their own satisfactory assurances, usually a BAA.
- There is no official HIPAA certification. Be careful with the word compliant.
Does HIPAA apply to my SaaS product?
It applies if customers who are covered entities (such as providers, plans and clearinghouses) use your service to handle ePHI. HHS says HITECH extends the Security Rule's safeguards, policies, procedures and documentation requirements to business associates. If you only host non identifiable data, get legal advice on whether you are in scope.
What does the HIPAA checklist for SaaS include?
Work through these items. They follow the structure of the Security Rule in 45 CFR 164.308, 164.310 and 164.312.
Role and contracts
- Decide whether you are a business associate for each customer.
- Sign a BAA with each covered entity customer.
- Get written assurances (a BAA or equivalent) from every subcontractor that handles ePHI, including your cloud host. The rule requires satisfactory assurances documented in a written contract.
Administrative safeguards
- Name a security official responsible for the policies.
- Perform a risk analysis of risks and vulnerabilities to the confidentiality, integrity and availability of ePHI (required).
- Apply a risk management plan that reduces risk to a reasonable and appropriate level (required).
- Set workforce access rules and remove access for people who no longer need it.
- Run a security awareness and training program for all workforce members, including management.
- Write incident procedures.
- Keep a contingency plan: data backup, disaster recovery and emergency mode operation (all required), plus testing and criticality analysis (addressable).
- Evaluate your safeguards periodically.
Physical safeguards
- Control facility access, including shared and home offices where ePHI may be accessed.
- Set workstation use and security rules.
- Control devices and media, including disposal and reuse.
Technical safeguards
- Give every user a unique ID (required) and set an emergency access procedure (required).
- Consider automatic logoff and encryption of stored ePHI (addressable).
- Record and examine activity with audit controls.
- Protect ePHI from improper alteration and authenticate people and entities.
- Protect data in transit, with encryption where reasonable (addressable).
What does "addressable" mean?
Addressable means you assess whether the measure is reasonable and appropriate for your environment. If yes, implement it. If not, document why and use an equivalent alternative. Encryption is a common example, and most SaaS teams implement it and record that decision.
Where do software supply chain risks come in?
The risk analysis has to include the systems and components that process ePHI, which covers third party libraries and services. A current dependency inventory helps you show what you ran and what you fixed. The free scan at gold.safeguard.sh/scan runs in your browser, keeps the file on your machine and accepts up to 100 dependencies.
How do you prove it to a customer?
Keep policies, the dated risk analysis, training records, access reviews, backup tests and incident records. Customers often send a security questionnaire; the questionnaire walkthrough shows how answers and evidence can fit together.
Click through it at your own pace, or open it full screen.
Frequently asked questions
Is there a HIPAA certification for SaaS?
No government body certifies HIPAA compliance. Customers rely on your BAA, your safeguards and any independent assessments you share.
Do I need a BAA with my cloud provider?
If the provider stores or processes ePHI for you, you need satisfactory assurances in a written contract. Check which services in your account your provider covers.
Is risk analysis really required?
Yes. Risk analysis and risk management are required implementation specifications under 45 CFR 164.308(a)(1)(ii).
Is encryption mandatory?
Encryption is addressable. In practice, you should encrypt ePHI or document an equivalent measure and the reasoning.
Sources
- 45 CFR 164.308 administrative safeguards (Cornell LII)
- 45 CFR 164.312 technical safeguards (Cornell LII)
- HHS Summary of the HIPAA Security Rule (summary text read through search results)
This is general information, not legal advice.
Last reviewed: 19 October 2026.
