Which rule applies to your product
HIPAA follows the data's origin, not the data's sensitivity. The same blood pressure reading is regulated differently depending on who collected it and why. Answer the three questions and find out.
Which rule applies to your product
HIPAA applies to you directly as a business associate. Full Security Rule, breach duties, BAAs with every customer and every subprocessor. Start with the risk analysis; it's what both OCR and the hospital will ask for.
What the hospital is actually checking
A security questionnaire looks like 200 unrelated questions. It's really eight topics, and the reviewer is deciding whether you'd be the cause of their next breach report.
| Topic | What they want to see | Where it comes from in HIPAA |
|---|---|---|
| Risk program | A dated risk analysis and a plan for what it found | 164.308(a)(1) |
| Access | MFA everywhere, named accounts, same-day removal, quarterly reviews | 164.308(a)(3), 164.312(a) |
| Encryption | At rest and in transit, with key management described | 164.312(a)(2)(iv), 164.312(e) |
| Monitoring | Logging on, retained, reviewed, alerting in place | 164.312(b), 164.308(a)(1)(ii)(D) |
| Incidents | A plan, a log, and a breach notice window you can meet | 164.308(a)(6), 164.410 |
| Vendors | Subprocessor list with BAAs for each | 164.308(b), 164.314 |
| Resilience | Tested backups and a recovery plan | 164.308(a)(7) |
| Assurance | A SOC 2 report, a pen test, sometimes HITRUST | Not HIPAA, but asked for anyway |
Procurement isn't asking whether you're HIPAA compliant. It's asking whether you can prove it before the pilot ends.Your engineer
HIPAA, SOC 2, HITRUST: which, and when
- HIPAA is not optional for a business associate. Do it first and build it so the evidence is reusable.
- SOC 2 is what most enterprise buyers ask for by name. A SOC 2 plus HIPAA report covers both in one audit and is usually accepted by hospital procurement. See the HIPAA to SOC 2 mapping and our SOC 2 guide.
- HITRUST is a certification some large health systems and payers require of vendors. The entry-level e1 assessment covers roughly 44 foundational controls (HITRUST's own pages say 43 or 44) and is valid for a year; HITRUST's own platform subscription starts at $18,100 and assessor fees are extra, with third-party estimates for a complete e1 in the tens of thousands. Pursue it when a contract names it, not before.
The cloud is fine, if you configure it
AWS, Azure and Google Cloud all sign BAAs and publish lists of HIPAA-eligible services. None of them makes you compliant. Under the shared responsibility model, identity and access, encryption settings, logging, network configuration and what you do with the data are yours. The common findings in vendor reviews are open storage buckets, no MFA on cloud consoles, logging off by default, and PHI in services that aren't on the eligible list.
A 90-day plan for a seed-stage team
- Weeks 1 to 2: map where PHI flows: product, support tooling, analytics, backups, laptops. Sign BAAs with every subprocessor on that map. Turn on MFA and disk encryption everywhere today.
- Weeks 3 to 6: the risk analysis, written to OCR's nine elements. Policies drafted from it, not from a template pack. Name a security officer.
- Weeks 7 to 10: close the gaps the analysis found: logging and retention, access reviews, backup restore test, offboarding checklist, incident plan with the shortest breach window in any BAA you've signed.
- Weeks 11 to 13: train the team, assemble the documentation pack, answer a sample questionnaire against it, and decide whether a SOC 2 Type 1 is worth starting now.
With AccuSights: the program is built once and mapped to HIPAA and SOC 2 together. The endpoint agent covers the engineers' laptops without an MDM project, integrations pull cloud evidence, and the reviewer portal is what you send the hospital instead of a 40-page PDF. Fixed fee, so it fits a seed budget.