HIPAA for digital health & health-tech companies

You're a business associate with enterprise customers asking for attestations. Here's how health-tech navigates HIPAA plus everything customers pile on top.

Your reality

You're a business associate under HIPAA — directly liable, auditable by OCR. Your customers (providers, payers) demand BAAs, security questionnaires, and increasingly SOC 2 reports and HITRUST certification. HIPAA is the floor; the sales cycle sets the ceiling.

The health-tech playbook

1. Treat HIPAA as table stakes, not the deliverable. Risk analysis, safeguards, BAAs with your own subprocessors — done, documented, current.
2. Map the customer ask. List what your top 10 prospects require: SOC 2? HITRUST? Pen test? Build one control baseline that evidences all of them.
3. Sequence: HIPAA program → SOC 2 → HITRUST. Each layer reuses the last one's evidence. Don't buy them in reverse.
4. Productize the BAA chain. Know every subprocessor touching customer PHI, with BAAs and a public subprocessor list — enterprise security reviews ask immediately.
5. Hire multi-framework assessors. A-LIGN, Coalfire, and Sensiba cover HIPAA alongside the commercial frameworks your customers require.

The BAA chain trap

Your customers sign BAAs with you; you need BAAs with every subprocessor touching their PHI — cloud hosting, analytics, support tooling, email. Map the full chain before your biggest prospect's security review does it for you.