Healthcare compliance starts with one question that many digital health teams answer too late: what is your role under HIPAA? A hospital, a health plan, and a SaaS vendor that stores lab results for that hospital all handle protected health information (PHI), but their obligations, contracts, and exposure differ. Settle your role and your data flows first, and the rest of the program, from risk analysis to vendor contracts, follows from it.
The regulatory map
Covered entity or business associate?
Covered entities are health plans, health care clearinghouses, and providers who conduct standard electronic transactions. A business associate creates, receives, maintains, or transmits PHI on a covered entity's behalf, which describes most healthtech vendors, cloud-hosted EHR add-ons, billing firms, and analytics providers. Your own vendors that touch that PHI are subcontractor business associates, and you need agreements with them too. A consumer app collecting health data directly from users, with no covered entity relationship, may sit outside HIPAA entirely and fall under the FTC instead. The HIPAA glossary entry covers the core definitions.
Security Rule safeguards in everyday terms
- Administrative: a documented risk analysis and risk management plan, a named security official, workforce training, sanctions for violations, contingency and disaster recovery planning, periodic evaluation, and business associate agreements.
- Physical: facility access controls, workstation use and security rules, and device and media controls covering disposal and reuse of hardware that held ePHI.
- Technical: unique user identification and access control, audit controls that record activity in systems holding ePHI, integrity protections, person or entity authentication, and transmission security.
Some implementation specifications are labeled addressable rather than required. Addressable does not mean optional: you must assess whether the safeguard is reasonable and appropriate, implement it or an equivalent, and document the reasoning. OCR investigations frequently cite a missing or outdated risk analysis, so treat it as a living document using a consistent risk assessment methodology. HHS also proposed significant Security Rule changes in early 2025; check the rule's current status when planning.
Business associate agreements: what to check
- Permitted uses and disclosures of PHI are defined, and nothing broader
- The business associate commits to Security Rule safeguards for ePHI
- Breach and security incident reporting obligations to the covered entity, with a timeline
- Subcontractors that handle PHI agree to the same restrictions
- PHI is returned or destroyed at termination, or protections continue if that is infeasible
- An inventory tracks which vendors hold PHI and whether a signed BAA is on file for each
When a breach happens
- Assess whether an impermissible use or disclosure is a breach. It is presumed to be unless a documented risk assessment shows a low probability that PHI was compromised.
- Business associates notify the covered entity without unreasonable delay and no later than 60 days after discovery.
- The covered entity notifies affected individuals without unreasonable delay and no later than 60 days after discovery.
- For a breach affecting more than 500 residents of a state or jurisdiction, notify prominent media outlets serving that area.
- Notify HHS: within 60 days for breaches affecting 500 or more individuals, or in an annual log submitted within 60 days of the end of the calendar year for smaller breaches.
Where HITRUST fits in the sequence
HIPAA has no official certification, so healthcare buyers look for outside assurance. Large health systems and payers frequently ask vendors for HITRUST CSF certification, and HITRUST offers assessments at increasing levels of rigor (e1, i1, and r2). A practical order is to build the HIPAA program first, add SOC 2 or ISO 27001 if broader customers ask for it, and pursue HITRUST when your target customers make it a procurement requirement. Controls built for the first programs carry forward.
Pitfalls and how Asurvo helps
- Doing a risk analysis once for a sales cycle and never revisiting it after new systems or vendors are added.
- Missing BAAs with the obvious vendors: the cloud host, email provider, support desk, and transcription or messaging tools.
- Letting PHI leak into logs, analytics, and error-tracking tools that were never in scope.
- Assuming a vendor's marketing claim of HIPAA compliance means the vendor signs BAAs for the service you use.
- Keeping your HIPAA program in Asurvo gives you one place for Security Rule controls, a risk register with inherent and residual scoring, and a vendor inventory with tiering and questionnaires, with HITRUST CSF mapped to the same controls.