Beyond SOC 2
What is HIPAA compliance and when does a SaaS company need it?
What is HIPAA compliance and when does a SaaS company need it?
HIPAA compliance means meeting the Privacy, Security, and Breach Notification Rules that govern protected health information. A SaaS company needs it when it creates, receives, maintains, or transmits PHI on behalf of a covered entity, which makes it a business associate with direct legal obligations. Company size is irrelevant, and so is whether you intended to handle health data.
When it applies to you
You need HIPAA if your software handles Protected Health Information (PHI). Specifically:
| Your Customer | Data You Handle | HIPAA Required? |
|---|---|---|
| Hospital or clinic | Patient records, appointment data | Yes |
| Health insurance company | Claims data, member information | Yes |
| Healthcare software vendor | PHI passed through your system | Yes (business associate) |
| Wellness app (no PHI) | Step counts, general health tips | No |
| Non-healthcare company | Employee data (not PHI) | No |
What HIPAA Requires
| Requirement | What It Means |
|---|---|
| Business Associate Agreement (BAA) | Legal contract with healthcare customers defining your PHI responsibilities |
| Administrative safeguards | Policies, training, risk assessment for PHI handling |
| Physical safeguards | Physical access controls for systems with PHI |
| Technical safeguards | Encryption, access controls, audit logging for PHI |
| Breach notification | 60-day notification requirement for PHI breaches |
HIPAA vs. SOC 2
SOC 2 + HIPAA
Many healthcare SaaS companies pursue both. SOC 2 provides the independent audit report that healthcare buyers want to see, while HIPAA compliance is the legal requirement for handling PHI. About 60% of SOC 2 controls satisfy HIPAA requirements, so doing both is more manageable than doing them separately.
Getting Started
- Determine if you actually handle PHI (many SaaS companies don't)
- If yes, build the HIPAA control foundation: risk analysis, safeguards, BAA process, PHI data mapping, breach notification
- Add SOC 2 when a buyer asks for an independent report; most of the controls are already in place
- Have a lawyer draft your BAA template