HIPAA for SaaS companies that are business associates
What changes when your software holds PHI for healthcare customers: the duties you carry directly, the BAAs you sign and need from your own vendors, breach reporting, and where SOC 2 fits.
On this page
HIPAA for SaaS companies that are business associates: at a glance
A SaaS company becomes a HIPAA business associate when it creates, receives, maintains or transmits PHI on behalf of a covered entity customer — hosting a clinic's patient data is enough, even if your staff never look at it. Business associates are directly liable for the Security Rule, for reporting breaches to the customer within 60 days of discovery, and for flowing BAAs down to subcontractors such as cloud and AI vendors. SOC 2 is often what customers ask for, but it does not replace these HIPAA duties.
| You are a business associate if | You create, receive, maintain or transmit PHI for a covered entity customer |
|---|---|
| Directly liable for | Security Rule, breach reporting to customers, subcontractor BAAs, and specified Privacy Rule duties |
| Report breaches to customers | Without unreasonable delay, no later than 60 days after discovery |
| Subcontractors | Need a BAA with you if they handle the PHI on your behalf (often cloud, email, AI APIs, support tools) |
| When a contract ends | Return or destroy the customer's PHI if feasible |
| SOC 2 | Separate audit framework — useful to customers, not a HIPAA requirement |
When your SaaS becomes a business associate
You are a business associate when you create, receive, maintain or transmit PHI on behalf of a covered entity (45 CFR 160.103). For software companies that usually means a clinic, practice or health plan uses your product to store or process patient information. HHS’s cloud computing guidance is explicit that storing PHI is enough — even if it’s encrypted and you don’t hold the key.
If you are not sure, start with business associates and the health app startup page.
What you are directly liable for
Since 2013, business associates answer to OCR directly — not only to their customers — for a specified list of duties (HHS fact sheet). The ones that shape a SaaS company’s work:
- The Security Rule. A documented risk analysis, administrative, physical and technical safeguards, and written policies and procedures.
- Breach reporting to customers. You must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured PHI (45 CFR 164.410). Most customer BAAs ask for faster notice — read what you sign.
- Subcontractor BAAs. Every subcontractor that meets the business associate definition — it creates, receives, maintains or transmits the PHI on your behalf — needs a BAA with you (164.308(b), 164.502(e)).
- Using PHI only as the BAA allows and providing customers what they need to meet patients’ rights requests.
The BAA chain
Your promises to customers can only be as strong as your vendors’ promises to you. Before signing a customer BAA, map where PHI goes:
| Layer | Typical vendors | Check |
|---|---|---|
| Hosting and database | AWS, Azure, Google Cloud | BAA signed; services you use are on the covered list |
| Email and notifications | Transactional email, SMS | BAA, or keep PHI out of messages |
| AI features | LLM APIs | BAA and the specific endpoints it covers; data retention settings |
| Observability | Logging, error tracking, analytics | Keep PHI out, or use a vendor that signs a BAA |
| Support | Help desk, screen sharing | BAA if tickets or sessions can contain PHI |
Compare options in HIPAA hosting and AI and LLM tools.
When a customer leaves, the BAA must require you to return or destroy their PHI if feasible, keeping no copies (45 CFR 164.504(e)(2)(ii)(J)). Build deletion and export into the product early.
Where SOC 2 fits
Healthcare customers often send security questionnaires and ask for a SOC 2 report. SOC 2 is an audit against AICPA criteria, not part of HIPAA; it overlaps with Security Rule safeguards and is often what wins enterprise deals, but it doesn’t replace the risk analysis, policies and BAAs HIPAA requires. Compliance platforms can manage both from one set of controls.
Main risks
- Signing a customer BAA that promises more than your own cloud, email or AI vendors' BAAs cover.
- PHI flowing into tools without a BAA — logging, error tracking, analytics, support desks, AI APIs.
- No documented risk analysis, even though the Security Rule applies to you directly.
- No process to tell customers about a breach within the 60 days the rules allow.
- Treating a SOC 2 report as proof of HIPAA compliance.
Requirements that matter most here
- Business associate →§ 160.103Who counts as a HIPAA business associate, common examples including SaaS and cloud vendors, subcontractors, and what business associates must do.
- Business associate agreements (BAAs) →§ 164.502(e)A vendor that creates, receives, maintains or transmits PHI on your behalf is generally a business associate, and you need a signed BAA with it before it touches patient data. No BAA means you should not put PHI in that tool.
- Security risk analysis →§ 164.308(a)(1)(ii)(A)Every covered entity and business associate must document an accurate and thorough assessment of risks to the ePHI it holds — and then act on it. It is one of the most commonly missing pieces of HIPAA compliance, including in small practices.
- Access control and sign-in →§ 164.312(a)(1)Only the right people should reach ePHI, each under their own account, with a reliable way to confirm who is signing in. In practice: unique user accounts, strong authentication such as MFA, and automatic logoff.
- Audit controls and activity logs →§ 164.312(b)Systems holding ePHI must record activity so you can review who accessed what. When choosing a tool, check that you — not only the vendor — can see sign-ins and access to records, and for how long.
- Encryption of ePHI →§ 164.312(a)(2)(iv)Encryption is "addressable", not optional: you encrypt ePHI at rest and in transit where reasonable and appropriate, or document why not and use an equivalent alternative where that is reasonable. For email and cloud tools, encrypting is almost always the reasonable choice.
- Notifying patients of a breach →§ 164.402An impermissible use or disclosure of unsecured PHI is presumed to be a breach unless a documented four-factor assessment shows a low probability of compromise. Affected individuals must be notified without unreasonable delay and no later than 60 days after discovery.
- HIPAA policies and procedures →§ 164.316What written policies and procedures HIPAA requires, how to keep them current, and how long to keep them — for small practices and business associates.
- HIPAA training requirements →§ 164.530(b)Who must be trained under HIPAA, on what, how often, and how to document it — and what the rule does not actually require.
Solutions to look at
- HIPAA hosting and cloud platforms →ToolCloud platforms and managed hosts that sign a BAA — and the big difference between infrastructure you secure yourself and hosting where the provider runs the safeguards for you.
- AI tools and LLMs →ToolWhich AI assistants and model APIs sign a BAA — ChatGPT, Claude, Gemini, Copilot and healthcare-specific assistants — on which plans, and what you have to switch on before any patient information goes in.
- HIPAA compliance software →ToolPlatforms that help you run a HIPAA program — policies, risk analysis, staff training and vendor BAAs in one place — compared on what they actually include and whether they publish prices.
- HIPAA email services →ToolEmail services that sign a BAA, compared on what actually protects patient messages — and what you still have to configure yourself.
- Cloud storage and file sharing →ToolCloud storage services that sign a BAA — on which plans, how you put the agreement in place, and what you must configure before storing patient files.
- Online HIPAA training courses →ToolOnline HIPAA training for staff — what each course covers, how long it takes, what it costs, and whether owners get completion records that help document the workforce training HIPAA requires.
If something happens
- You had a data breach →A misdirected email, a lost laptop, a hacked mailbox. What to do, in order, in the first days — and the deadlines that start running when you discover it.
- You received a letter from OCR →A complaint investigation or compliance review from the HHS Office for Civil Rights. What the letter means, what to send, and how these cases usually end.
- HIPAA training for new employees — and the rest of onboarding →What HIPAA training a new employee needs, when, and how to document it — plus the access steps when someone joins your practice or company and when they leave.
Your path to compliance
- Confirm HIPAA applies to you and in which role — Does HIPAA apply?
- Put the requirements above in place, starting with a documented risk analysis.
- Choose how to do the work — yourself, with templates, software, a consultant or an attorney — compare every route.
Frequently asked questions
Is my SaaS a business associate if we only host encrypted data?
Usually yes. HHS guidance says a cloud provider that stores PHI for a covered entity is a business associate even if it holds only encrypted data and has no key.
Do we have to sign the customer's BAA?
You need a BAA, but not necessarily theirs. Many SaaS companies keep their own standard BAA and negotiate from it; check that what you sign matches what your own vendors' BAAs let you promise.
Does SOC 2 make us HIPAA compliant?
No. SOC 2 is an independent audit against AICPA criteria. It overlaps with Security Rule safeguards and helps answer security questionnaires, but HIPAA requires its own risk analysis, policies and BAAs.
What do we do with customer PHI when they cancel?
The BAA must require you to return or destroy it if feasible, keeping no copies; if that isn't feasible, the protections continue for as long as you hold it.