HIPAA for startups

HIPAA binds two kinds of organizations. Covered entities — providers, health plans, clearinghouses — and their business associates: vendors that handle protected health information on a covered entity’s behalf. Most digital-health startups enter as business associates. The moment a clinic, payer, or health system routes PHI through your product, you belong in scope, and the business associate agreement (BAA) you sign makes it contractual as well as regulatory. Signing a BAA is not a formality; it attaches direct obligations, including liability for breaches on your watch.

Founders misjudge the boundary in both directions. A consumer wellness app whose users type in their own data, sold direct to consumers, may sit entirely outside HIPAA. Meanwhile a scheduling tool that merely displays appointment details for a clinic sits inside it. The label “health tech” decides nothing — the data flow and the relationship decide everything, so map both before you assume. The HIPAA framework overview covers the rule structure; the operated HIPAA program covers how Agency runs it.

Plainly: the government certifies no one under HIPAA. No badge, no registry, no official seal. HIPAA is a regulatory obligation you comply with continuously and demonstrate on request — through your risk analysis, your safeguards, your training records, and, when buyers want third-party weight, an independent assessment or attestation over your program. Anyone selling you a “HIPAA certificate” is selling a training completion or an assessment wearing a costume.

This matters commercially, not just technically. Health-system security reviewers know there’s no certification, so a vendor claiming to be “HIPAA certified” flags itself as either confused or overselling — while a vendor that says “no certification exists; here is our risk analysis, our safeguards, and our third-party assessment” sounds like it has done this before. Precision is the trust signal in this market.

Enterprise health buyers rarely stop at “are you HIPAA compliant?” — an unverifiable yes satisfies no reviewer. The standard pattern is HIPAA plus a SOC 2 report with HIPAA mapped into scope: the law is answered by your program, and the reviewer gets an audited artifact to read. On a mapped platform one control set feeds both, so the pairing is closer to one program with two outputs than two programs.

Then there’s HITRUST — the heavyweight certification large health systems and payers sometimes name as a procurement gate. It is a genuinely bigger lift, and the sensible posture for a startup is contract-driven: build HIPAA plus SOC 2 now, and treat HITRUST as a roadmap conversation the first time a signed-revenue opportunity puts it in writing. The control base you’ve already built carries much of the way there.

Popp shows the motion end to end: an AI copilot for recruiting that took on HIPAA alongside SOC 2 and ISO 27001 through Agency to meet enterprise requirements — and converted that stack into closed deals. For a digital-health startup, Agency builds the same machinery inside the startup program: risk analysis, policies, safeguards, training, the SOC 2 pairing, and the attestations that make it all demonstrable, for $2,500 to $12,500 all-in depending on stage and stack.

And when your buyers want a security leader in the room — a person who can field a hospital CISO’s questions live — that’s the healthcare vCISO engagement, which sits naturally on top of the compliance program rather than replacing it.