If your SaaS product touches protected health information (PHI), HIPAA's Security Rule sets specific technical, administrative, and physical safeguard requirements — not just a general "be secure" expectation.
What counts as PHI
Protected Health Information is any individually identifiable health information — not just medical records, but also things like appointment scheduling data, billing information tied to a health condition, or free-text notes referencing a patient's treatment. If your product processes any of this on behalf of a healthcare provider, HIPAA applies.
The three safeguard categories
- Administrative safeguards — risk assessments, workforce training, access management policies.
- Physical safeguards — controls over facilities and devices where PHI is accessed or stored.
- Technical safeguards — the part most relevant to engineering teams, covering access control, audit controls, integrity controls, and transmission security.
Technical safeguards, specifically
- Access control — unique user identification for anyone accessing PHI, automatic logoff after inactivity, and encryption of PHI at rest where reasonable and appropriate.
- Audit controls — hardware, software, or procedural mechanisms to record and examine activity in systems containing PHI.
- Integrity controls — mechanisms to confirm PHI hasn't been improperly altered or destroyed.
- Transmission security — encryption of PHI in transit, and measures to guard against unauthorized access during transmission.
Business Associate Agreements
If you're a vendor processing PHI on behalf of a healthcare provider (a "covered entity"), you're a "business associate" under HIPAA, and you need a signed BAA in place before handling any PHI. This contract obligates you to the same safeguard requirements as the covered entity itself.
Breach notification
Unlike GDPR's 72-hour window, HIPAA requires notification to affected individuals without unreasonable delay, and no later than 60 days following discovery of a breach — plus notification to the Department of Health and Human Services, and in some cases the media, for larger breaches.
Where engineering teams commonly fall short
Encryption of PHI in transit is nearly universal at this point. The more common gaps are audit logging (can you actually reconstruct who accessed a specific patient's data and when?) and BAAs with sub-processors — a new logging or analytics vendor introduced without HIPAA review is a frequent, avoidable exposure.