If your startup handles electronic protected health information for a clinic, hospital or health plan, HIPAA treats you as a business associate. Before the first pilot, settle four things: whether you touch PHI, the agreement you will sign, the safeguards you can prove, and who answers when something goes wrong.
Do we handle PHI at all?
Not every health related product does. A meditation app that a user downloads on their own may sit outside HIPAA. A tool a clinic uses to message patients, store notes or process claims almost certainly does not. The test is whether you create, receive, maintain or transmit health information on behalf of a covered entity.
Get a written view from healthcare counsel early. The answer shapes everything else, and guessing in a sales call is costly.
What is a business associate agreement?
Covered entities need a contract with each business associate that sets out permitted uses of PHI and requires safeguards and breach reporting. Expect your first customer to send theirs. Know in advance what you can accept: breach notice timing, subcontractor flow down, data return or destruction at the end. Keep your own agreements with the vendors that touch PHI, such as hosting.
What safeguards will they ask about?
The Security Rule groups safeguards as administrative, physical and technical. The technical standards at 45 CFR 164.312 cover access control, audit controls, integrity, authentication and transmission security. Customers will also ask about risk analysis, staff training, incident procedures and vendor management.
A founder does not need a large programme on day one, but needs honest answers. A constructed example of a small, defensible baseline: SSO with MFA for every internal tool, encrypted storage, individual accounts, audit logs of PHI access, a documented risk analysis, a yearly training record and an incident plan.
Is there a HIPAA certificate we can buy?
No. HIPAA has no official certification for vendors. Be wary of badges that claim otherwise. Buyers who want outside proof often ask for a SOC 2 report or a HITRUST assessment, which are separate paths with their own cost and time. Choose based on what your first buyers request.
What should we avoid?
- Letting PHI into analytics, error trackers or support chat.
- Using real patient data in staging.
- Signing an agreement you cannot meet, for example a short breach notice with no incident process behind it.
- Saying "HIPAA compliant" in marketing without a basis you can explain.
How should a small team stage the work?
Sequence it by what a buyer sees first. Month one is scoping and the agreement position. Month two is the baseline safeguards and the risk analysis. Month three is the incident drill and vendor agreements. Keep one document that records each decision and date, because that record becomes your answer to the first security review. It also stops the knowledge from living only in the founder's head, which matters when a second customer arrives and asks the same questions with different wording.
What to do
- Decide with counsel whether and how you are a business associate.
- Draft your position on the standard clauses before the first request arrives.
- Run and document a risk analysis of the systems that hold PHI.
- Put the baseline safeguards in place and keep evidence.
- Write the incident plan and name who makes the notification decision.
- Sign agreements with vendors that touch PHI, or keep PHI away from them.
- Pick a third party assurance path only when buyers ask for one.
Quick check
Can a startup say it is HIPAA compliant?
Only if it can explain how it meets the rule's requirements and has the evidence. There is no official certificate, so describe your safeguards rather than claim a badge.
Do we need an agreement with our cloud provider?
If the provider maintains PHI on your behalf, you generally need a business associate agreement with it. Confirm with counsel and check what the provider offers.
Sources
Last reviewed: 18 October 2026.
