HIPAA Compliance for SaaS Companies: A Plain-English Guide

A SaaS company needs a HIPAA program when it is a covered entity or business associate—not merely because it sells to healthcare. Start by mapping data and customer relationships, then execute required business associate agreements, analyze risk, implement reasonable safeguards, manage subcontractors and incidents, and retain evidence. HIPAA has no government-approved certification.

Does HIPAA apply to your SaaS company?

HIPAA applies to covered entities—health plans, healthcare clearinghouses, and certain healthcare providers that conduct covered transactions electronically—and to business associates. The HHS covered-entity and business-associate guidance is the right starting point.

A SaaS vendor may be a business associate when it creates, receives, maintains, or transmits protected health information, or PHI, on behalf of a covered entity to perform a regulated function or service. A subcontractor that handles PHI on behalf of a business associate can also be a business associate.

Do not decide applicability from a label such as “health tech,” “cloud provider,” or “encrypted storage.” Ask:

1. Who is the customer and what HIPAA role does it have?
2. Whose information enters the service?
3. Is the information individually identifiable health information?
4. Why does the SaaS company receive, maintain, or transmit it?
5. Is the activity performed for a covered entity or business associate?
6. Which affiliates, vendors, and subprocessors can access or maintain it?

HHS explains in its cloud computing guidance that a cloud service provider maintaining ePHI can be a business associate even if it holds only encrypted information and lacks the decryption key. The narrow “conduit” exception focuses on transient transmission, not ongoing storage.

A direct-to-consumer health app may fall outside HIPAA when it is not acting for a covered entity or business associate. Other laws, including the FTC Health Breach Notification Rule, may still apply. Obtain advice for the actual data flows and relationships.

Which HIPAA rules matter to a SaaS business associate?

The HIPAA Administrative Simplification regulations are in 45 CFR Parts 160 and 164. Three rule sets commonly shape a SaaS program:

Business associates are directly liable for specified HIPAA requirements. HHS summarizes those obligations in its business associate guidance. The contract does not replace the regulation, and the regulation does not replace careful contract review.

As of September 2026, teams should check the current regulations and HHS materials before relying on a static checklist. Proposed or final rule changes, enforcement guidance, and state requirements can affect a program. This guide is educational and not legal advice.

What must a business associate agreement cover?

A business associate agreement, or BAA, governs a specific relationship. The Privacy Rule's business associate contract provisions describe required terms.

A compliant BAA generally addresses:

• Permitted and required uses and disclosures of PHI
• Prohibited uses or disclosures and appropriate safeguards
• Reporting of impermissible uses, disclosures, and breaches
• Subcontractors that receive or handle PHI
• Support for access, amendment, and accounting obligations where applicable
• Availability of records to HHS for compliance review
• Return or destruction of PHI at termination when feasible
• Termination rights for material violations

The BAA should match the service. If support engineers, hosting providers, logging tools, or AI vendors can handle PHI, the subcontractor analysis must include them.

A business associate generally must obtain appropriate assurances from subcontractors that handle PHI on its behalf. This creates a chain of obligations; it does not require every downstream vendor to contract directly with the covered entity.

Never sign a BAA as a substitute for scoping. Confirm covered services, accounts, regions, features, support channels, and exclusions in writing.

What does the HIPAA Security Rule require?

The Security Rule requires covered entities and business associates to protect the confidentiality, integrity, and availability of ePHI through administrative, physical, and technical safeguards. HHS provides a Security Rule summary; the binding requirements appear in the regulations.

Start with the required risk analysis under 45 CFR 164.308. It should accurately and thoroughly assess potential risks and vulnerabilities to ePHI. For SaaS, that means mapping ePHI across production, backups, logs, support tools, test environments, endpoints, integrations, and subprocessors.

Then manage identified risks. A practical work plan may include:

• Governance: assign a security official, approve policies, and review risk decisions.
• Identity and access: authorize users, remove access promptly, and manage privileged roles.
• Workforce security: train personnel and apply authorization and sanction procedures.
• System activity: examine relevant activity and investigate anomalies.
• Incident response: contain, document, mitigate, and escalate incidents.
• Contingency planning: maintain backups, recovery procedures, and periodic testing.
• Facility and device controls: address physical access, workstations, media, disposal, and remote work.
• Technical safeguards: implement unique user identification, emergency access procedures, authentication, transmission security, and integrity controls as applicable.
• Vendor management: perform due diligence, execute required BAAs, and monitor material changes.

HIPAA distinguishes “required” and “addressable” implementation specifications. Addressable does not mean optional without analysis. Under 45 CFR 164.306, an organization must assess whether an addressable specification is reasonable and appropriate; if not, it must document why and implement an equivalent alternative when reasonable and appropriate.

Does HIPAA require encryption or a certification?

HIPAA does not create a government-approved certification for SaaS products or organizations. HHS states in its Security Rule frequently asked questions that it does not certify products as “HIPAA compliant.” A third-party assessment can still be useful, but its scope, date, criteria, testing, and exceptions matter.

Encryption specifications are addressable under the current Security Rule framework, not permission to ignore encryption. Teams must evaluate risk and document reasonable decisions. For internet-facing SaaS handling ePHI, strong encryption in transit and at rest is commonly an important safeguard, but encryption alone does not satisfy HIPAA.

HHS also publishes guidance on rendering unsecured PHI unusable, unreadable, or indecipherable. Proper encryption may affect whether compromised information is “unsecured PHI” for breach-notification purposes. That safe-harbor analysis is distinct from whether all Security Rule duties were met.

Avoid these claims:

• “HIPAA certified”
• “Using our product makes you compliant”
• “A BAA transfers all HIPAA responsibility to the vendor”
• “Encrypted data is outside HIPAA”
• “A SOC 2 report proves HIPAA compliance”

A SOC 2 Type I or Type II report may provide useful assurance about scoped controls, but SOC 2 is a separate attestation and is not a HIPAA determination.

How should a SaaS company handle incidents and breaches?

Build one process that can distinguish a security event, a HIPAA security incident, an impermissible use or disclosure, and a reportable breach. Preserve facts before making conclusions.

Under 45 CFR 164.402, an impermissible acquisition, access, use, or disclosure of PHI is generally presumed to be a breach unless an exception applies or a documented risk assessment demonstrates a low probability that PHI was compromised. The assessment considers at least the nature and extent of PHI, the unauthorized person, whether PHI was actually acquired or viewed, and mitigation.

A business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery under 45 CFR 164.410. The BAA may impose a shorter deadline. Covered entities have separate individual, media, and HHS notification duties depending on the event.

An incident record should capture detection, systems and people involved, data elements, affected individuals if known, access evidence, containment, forensic findings, mitigation, legal analysis, customer communications, decisions, approvals, and notification dates. Involve privacy counsel and appropriate forensic professionals early when facts could trigger notification.

What evidence should a SaaS company maintain?

The regulations generally require HIPAA documentation to be retained for six years from creation or when it was last in effect, whichever is later; see 45 CFR 164.316. Other records may have different legal, contractual, or operational retention needs.

VY can organize recurring work for staff and approved AI agents in one queue and preserve actions and supporting evidence in an append-only proof ledger. Those capabilities may help keep owners, corrections, and approvals visible. VioletX can provide onshore regulatory advisory and related compliance support through the VY and VioletX software-and-services model. Neither replaces legal advice, HHS, or an organization's responsibility for HIPAA compliance.

What is a practical HIPAA readiness sequence?

1. Determine legal role. Document covered-entity, business-associate, subcontractor, and non-HIPAA data flows.
2. Define scope. Inventory ePHI, products, infrastructure, integrations, people, locations, and vendors.
3. Align contracts. Execute fit-for-purpose BAAs and reconcile privacy, security, product, and subprocessor terms.
4. Perform risk analysis. Identify threats, vulnerabilities, likelihood, impact, and existing safeguards across the full environment.
5. Treat risk. Assign owners, implement safeguards, and document addressable-specification decisions.
6. Test operation. Sample access, logging, changes, recovery, incidents, training, and vendor oversight.
7. Prepare response. Define reporting, investigation, breach assessment, and notification steps.
8. Maintain evidence. Preserve policies, decisions, work records, reviews, and corrections under a documented retention schedule.
9. Review change. Reassess new features, AI tools, subprocessors, acquisitions, architecture, and customer uses before they alter ePHI risk.

The bottom line is straightforward: HIPAA readiness begins with applicability and real data flows, not a certificate. A defensible SaaS program connects BAAs, risk analysis, safeguards, incident handling, subcontractor oversight, and durable evidence. Confirm current requirements as of September 2026 and obtain legal advice for your specific relationships and obligations.