HIPAA Compliance Checklist Template for Health Tech Products

Yes, if the data qualifies as PHI. PHI is any individually identifiable health information created or received by a covered entity or business associate. If your app collects health conditions, symptoms, medications, or diagnoses linked to an identifiable person, it is likely PHI regardless of who entered it. The exception is consumer wellness data (step counts, sleep tracking) that is not connected to a covered entity.

A covered entity is a health plan, healthcare clearinghouse, or healthcare provider that transmits health information electronically. A business associate is any organization that creates, receives, maintains, or transmits PHI on behalf of a covered entity. Most health tech startups are business associates. This means you need a BAA with the covered entity you serve and with any subcontractors who touch PHI.

Penalties range from $100 to $50,000 per violation, with an annual maximum of $1.5 million per violation category. The OCR (Office for Civil Rights) considers factors like whether the violation was due to willful neglect and whether the organization took corrective action. Beyond fines, breaches damage trust. A single publicized breach can end a health tech startup.

Yes. AWS, GCP, and Azure all offer HIPAA-eligible services and will sign BAAs. However, the BAA only covers specific services. You must ensure every service you use is on the provider's HIPAA-eligible list. For example, AWS RDS and S3 are covered, but not all AWS services are. Check the provider's HIPAA documentation and configure services according to their compliance guides.

For early-stage products, a documented self-assessment based on the HIPAA Security Rule is usually sufficient. As you scale and sell to larger health systems, HITRUST CSF certification becomes a de facto requirement because enterprise buyers use it as a procurement gatekeeper. Plan for HITRUST when you start selling to organizations with 500+ beds or when a prospect's security questionnaire explicitly requires it. ---