HIPAA compliance for health tech startups, run for you

If your product touches patient data for a hospital, clinic, health plan or another health tech company, HIPAA shows up in your first sales conversation. The customer will ask whether you are HIPAA compliant and whether you will sign a BAA. This page explains what that actually means for a startup, what software can automate, and what stays with your team.

What is HIPAA compliance?

HIPAA has several rules. For most startups the important ones are the Privacy Rule, which limits how PHI is used and disclosed; the Security Rule, which sets safeguards for ePHI; and the Breach Notification Rule, which sets what to do when unsecured PHI is compromised. There is no government HIPAA certification. Compliance means running the required safeguards and being able to prove it.

What are the three HIPAA Security Rule safeguards?

Some specifications are required and others are addressable. Addressable does not mean optional: you must assess whether it is reasonable for you, implement it or an equivalent, and document the decision.

Who needs HIPAA compliance?

• Covered entities: health plans, health care clearinghouses, and health care providers that conduct certain transactions electronically.

• Business associates: companies that create, receive, maintain or transmit PHI for a covered entity, such as telehealth platforms, EHR add-ons, billing, scheduling and analytics tools.

• Cloud and infrastructure providers that store ePHI, even when it is encrypted and they do not hold the key.

• Subcontractors of business associates that handle the same PHI.

• AI health startups that process clinical notes, images or records for providers or plans.

Consumer health apps that collect data directly from users, not on behalf of a covered entity, may fall outside HIPAA, though other laws can still apply. Check your situation with counsel.

What does HIPAA compliance take?

• Controls: unique user IDs, MFA, encryption at rest and in transit, audit logging, backups, access reviews, device security and secure offboarding.

• Documents: a security risk analysis, risk management plan, security policies and procedures, incident response and contingency plans, and a register of BAAs.

• Evidence: configuration exports, access logs, training records, risk analysis updates, vendor BAAs, incident records and periodic evaluations.

• Breach readiness: notice to individuals without unreasonable delay and within 60 days of discovery, plus notice to HHS and, above the thresholds, to the media.

The risk analysis is not a one-time document. The Security Rule expects you to review and update your safeguards as your systems and threats change.

What NexusVoid automates vs what you still do

How NexusVoid gets you ready and keeps you ready

NexusVoid runs your security program like an autonomous CISO, and HIPAA readiness is the by-product. If you have no CISO, it acts as one. If you have a CISO or vCISO, it automates most of their work. The loop is Detect, Prove, Resolve, Test, Verify.

• Argus finds and fixes: outside-in like an attacker with no credentials or installs to begin, then inward through code, dependencies, cloud and secrets. Findings are mapped to MITRE ATT&CK, priced in dollars with FAIR, fixed as pull requests, and retested on merge.

• Aegis proves: tailored policies, automatic evidence, a risk register, vendor management, employee security training, a device agent for workstation safeguards, a trust center and auditor-ready exports.

• Striker tests: vulnerability assessment and pentest for web, API, cloud and mobile, pay per scan, with a report in under 60 minutes.

When a hospital’s security team sends a questionnaire, Aegis answers it from your evidence instead of from memory.

Common HIPAA mistakes

• Calling yourself HIPAA certified. HHS does not recognize private certifications of Security Rule compliance.

• Assuming encryption takes you out of scope.

• Sending PHI to vendors without a BAA, such as email, support or analytics tools.

• Treating addressable specifications as optional instead of documenting the decision.

• Doing a risk analysis once, at launch, and never updating it.

• Having no breach process, so the 60-day clock runs out while you work out who decides.

Frequently asked questions

Is there an official HIPAA certification?

No. HHS states that it does not endorse or otherwise recognize private organizations’ certifications regarding the Security Rule, and an outside certification does not stop HHS from later finding a violation. You can hire an outside firm to evaluate your program, which some customers ask for, but be wary of anyone selling a HIPAA certificate as proof of compliance.

Does a health tech startup need a business associate agreement?

If you create, receive, maintain or transmit protected health information on behalf of a covered entity, you are a business associate and you need a BAA with that customer. You also need BAAs with your own vendors that handle that PHI, such as your cloud provider. Your obligations under HIPAA apply even before the paperwork is signed.

Does HIPAA apply if we only store encrypted data?

Yes. HHS guidance on cloud computing says a cloud provider that stores encrypted ePHI is still a business associate, even if it does not hold the encryption key. Encryption is an important safeguard and can affect whether an incident counts as a reportable breach, but it does not take you out of HIPAA.

How quickly must a HIPAA breach be reported?

Covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured PHI. Breaches affecting 500 or more people must also be reported to HHS within the same 60 days, and breaches affecting more than 500 residents of a state or jurisdiction require notice to prominent media there. Smaller breaches can be logged and reported annually.

Is the HIPAA Security Rule changing?

HHS proposed a major update to the Security Rule in January 2025. Among other changes, it would remove the distinction between required and addressable specifications and require annual testing of incident response plans. As of October 2026 it has not been finalized, and the current Security Rule remains in force. Building to the stronger standard now is a sensible hedge.

If a health care customer is asking for a BAA and you want to know whether your safeguards hold up, book a call at /contact and we will go through your setup.