Compliance · United States
HIPAA
If your product handles health information for US patients or providers, HIPAA affects your architecture, your choice of vendors and your processes. We help you decide whether it applies and design health apps that meet it, and we flag where FDA or EU MDR medical device rules may also come in.
Who it applies to
Is this law relevant to you?
Covered entities and business associates that create, receive, store or transmit protected health information in the US.
Core obligations
What the law asks of you
A plain language summary. Your legal team should confirm how each point applies to your business.
- Privacy rule
- Limits on how protected health information is used and shared.
- Security rule
- Administrative, physical and technical safeguards for electronic PHI.
- Business associate agreements
- A BAA with each vendor that handles PHI.
- Breach notification
- Timely notice to affected individuals and to regulators.
- Audit controls
- Logs of who accessed which health records.
- Medical device risk
- Checking whether your software counts as a medical device under FDA or EU MDR.
How we help
From gap to evidence
- Check whether HIPAA applies
- Security risk assessment
- HIPAA ready architecture on AWS, Azure or Google Cloud
- BAA and vendor review
- Audit logs and access controls in your app
Is there an official HIPAA certification?
No. The government does not issue one. You show compliance through risk assessments, policies, safeguards and the evidence behind them.
Request a HIPAA assessment
Regulations
Other laws we advise on
Start a conversation
Compliance that holds up in practice.
Start with a short assessment. We tell you which laws apply, what to fix first and what it will take.
A specialist replies within one working day. The first conversation is free.