🛡️ COMPLIANCE · HIPAA FOR SAAS
Is my SaaS HIPAA compliant? Here's how to actually know.
First, the honest part: there is no official "HIPAA certified" badge. No one hands you a certificate. HIPAA is a posture you hold, not a test you pass — so "compliant" really means can you show the work. Work the triage below.
Operator-honest tech-help · no jargon · no upsell to something you don't need.
The HIPAA triage
Work these in order · steps 1–2 decide whether you're even in scope
- Confirm you actually touch PHI. HIPAA only applies if your product creates, receives, stores, or transmits Protected Health Information — health data tied to an identifiable person. If you only handle anonymous or fully de-identified data, you may not be in scope at all. Be precise here; guessing wide wastes money, guessing narrow is a violation.
- Know your role — Business Associate, almost certainly. A hospital or clinic is a Covered Entity. A SaaS tool that handles PHI on their behalf is a Business Associate — that's you. Business Associates are directly liable under HIPAA. Knowing your role tells you exactly which rules bind you.
- Sign BAAs — in both directions. You need a signed Business Associate Agreement with every Covered Entity client, and with every subprocessor that touches PHI for you — your cloud host, database, email, logging, analytics. A missing downstream BAA (e.g. a vendor that won't sign one) is a silent gap that fails an audit fast.
- Check the technical safeguards. The Security Rule expects, at minimum: encryption in transit and at rest, role-based access controls, unique user IDs, audit logging of PHI access, and automatic logoff. "Our cloud provider is HIPAA-eligible" is not the same as "our app is configured correctly" — the configuration is on you.
- Do — and document — a Security Risk Assessment. A HIPAA Security Risk Assessment is required, not optional, and it's the single thing regulators ask for first. It identifies where PHI lives, the risks to it, and your plan to reduce them. An assessment that's missing — or two years stale — is the most common real-world finding.
- Have the administrative pieces. Written policies, documented workforce HIPAA training, a designated security/privacy point of contact, and an incident and breach response plan. HIPAA is roughly half paperwork — and the paperwork is what proves the posture when someone asks.
🛡️ The deeper fix · SideGuy builds it
A compliance posture that someone actually maintains
SideGuy is the operator layer for your compliance — not a vendor that sells you a badge and disappears. We map where PHI actually flows in your SaaS, find the missing BAAs and config gaps, and keep the posture true as the product changes. Vanta or Drata can run the engine; SideGuy is the operator who makes sure it's pointed at reality.
It starts with a $250 Operator Audit — a real read on whether your SaaS would survive a HIPAA security questionnaire, with an operator-honest yes/no on what's actually needed. The first hour is free. Text PJ and we'll scope it.
