In the first 90 days, a health startup should confirm whether HIPAA applies to it, name a security official, map where ePHI lives, run a documented risk analysis, sign agreements with vendors, train staff and write an incident plan. Do the scoping first, because it decides everything after. This is a planning aid, not legal advice.
Days 1 to 15: does HIPAA apply, and to what?
HIPAA's Security Rule applies to covered entities and their business associates. A startup that creates, receives, maintains or transmits ePHI on behalf of a clinic or insurer is likely a business associate. One that sells directly to consumers may not be covered at all. Ask counsel in the first two weeks; the answer sets your contracts and duties.
At the same time, name a person responsible. The rule requires identifying a security official responsible for developing and implementing the required policies. At a startup it is often the CTO, which is fine, but write the assignment down.
Then draw the data map: every system, log, backup, analytics tool and support tool where ePHI is created, received, stored or sent.
Days 15 to 45: risk analysis and the first fixes
The rule requires an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI, plus risk management that reduces them to a reasonable and appropriate level. Both are required.
NIST SP 800-66 Revision 2 is a resource guide for the Security Rule, and a reasonable method to follow. For each system, list threats, existing controls, likelihood, impact and a planned action with an owner and date. Keep the document; it is your primary evidence.
Use the analysis to pick quick wins: turn on encryption where missing, enforce multi factor authentication, restrict access to the minimum needed, remove ePHI from places it should not be, and make sure audit logs exist. The rule asks for regular review of system activity records, so decide who reviews and how often.
Days 30 to 60: vendors and agreements
A covered entity may let a business associate handle ePHI only after obtaining satisfactory assurances in writing, and business associates need similar assurances from their subcontractors. List every vendor that could touch ePHI: cloud host, email, support desk, monitoring, error tracking and AI tools. For each, either sign an agreement, confirm the service never sees ePHI, or remove it. This is slow, so start it early.
Days 45 to 75: people and plans
Run a security awareness and training program for all workforce members, including management. Write a sanction policy so there are stated consequences for violations. Create security incident procedures covering how to identify, respond, limit harm and document outcomes. Create a contingency plan with a data backup plan, a disaster recovery plan and an emergency mode operation plan, and test a restore once.
Days 75 to 90: breach readiness and a review
Know the notification clock. Individuals must be told without unreasonable delay and no later than 60 calendar days after discovery. For breaches affecting 500 or more people, the Secretary is notified at the same time; for fewer, you keep a log and report within 60 days after the end of the calendar year. Run a tabletop exercise with an invented scenario and record what you learned.
Finish with a gap review against the rule's list and schedule the next risk analysis.
Where can tools help?
An inventory of your software dependencies and a vulnerability scan feed the risk analysis. Safeguard's compliance automation can help collect and organize evidence, but it does not make a startup compliant by itself, and Safeguard does not certify anyone for HIPAA.
What to do
- Ask counsel whether you are a covered entity or business associate.
- Appoint and document a security official.
- Build the data map of every ePHI location.
- Complete and file a risk analysis, with an action list.
- Sign vendor agreements or remove vendors.
- Train the team and write the sanction, incident and contingency documents.
- Test a backup restore and run a breach tabletop.
Quick check
Are all startups in health covered by HIPAA?
No. It depends on whether you are a covered entity or a business associate handling ePHI for one.
How often do I redo the risk analysis?
Revisit it when systems or vendors change, and on a regular schedule your policy sets.
Sources
- 45 CFR 164.308 (Cornell LII)
- 45 CFR 164.404 (Cornell LII)
- 45 CFR 164.408 (Cornell LII)
- NIST SP 800-66 Rev. 2
Last reviewed: 18 October 2026.
