La Jolla Academic Spin-Out Compliance · HIPAA + NIST + Research Data Integrity

The compliance map for research-funded operations

Spinning out of UCSD/Salk/Scripps with research data and NIH funding is fundamentally different from a commercial SaaS launch. The honest map:

• If you handle PHI from clinical-site partners: HIPAA Privacy + Security + Breach Rules + BAAs. Even if your spin-out doesn't directly treat patients, if you receive de-identified or limited-dataset PHI from collaborator clinical sites, you're a HIPAA business associate. BAAs must be executed with EVERY upstream and downstream entity that touches PHI.
• If you have NIH or federal-agency funding: NIST 800-171 (110 controls). Self-implementation if your funding doesn't trigger CMMC, third-party assessment if it does. Affects research data storage, transmission, sharing with collaborators. Many academic-spin-outs underestimate this.
• If you're FDA-regulated (drug, device, diagnostic): 21 CFR Part 11 for electronic records. Different from HIPAA. Governs electronic signatures + audit trails on systems used in FDA-regulated research. Most platform-provider tools (Veeva, Medidata, OpenClinica) handle this; custom-built systems usually don't.
• Data Use Agreements (DUAs) with academic collaborators are CONTRACTUAL, not regulatory. But they often impose stronger restrictions than HIPAA — specific data destruction timelines, named-individual access only, prohibition on linking, etc. Track DUAs separately from regulatory compliance.
• IRB-approved protocols govern WHAT data you can use HOW. Different from compliance frameworks. Even if you're HIPAA + NIST compliant, using data outside the IRB-approved purposes is a research integrity violation. Coordinate with the originating IRB.
• SOC 2 layered on top: only when you have COMMERCIAL customers. Pure-research operations often don't need SOC 2 — your stakeholders are NIH, IRBs, collaborator institutions, not enterprise customers. SOC 2 becomes relevant when you start selling SaaS to pharma companies or healthcare-system customers.
• UC tech transfer (TTO) often has additional requirements. If you spun out via UCSD's tech-transfer office, the licensing agreement may impose ongoing compliance reporting + audit rights. Read those terms carefully — they outlive your university affiliation.

The La Jolla reality · operator scene

La Jolla's tech operator scene leans academic-spin-out — UCSD, Salk Institute, Scripps Research, Sanford Burnham Prebys — different than the venture-funded commercial SaaS scenes elsewhere on the coast. The actual operator on Torrey Pines Road or in the Village is more likely: post-doc or PI founder, NIH-funded research, IRB protocols active, clinical-site collaborator network, planning to commercialize via SaaS or therapeutic IP licensing in 18-36 months. For that operator, compliance starts with HIPAA + NIST research data integrity — SOC 2 is years down the road.

And the geography matters: PJ's office is in Solana Beach (S Cedros, around the corner from Belly Up Tavern). For La Jolla operators, coffee in 90 minutes is a real option — not marketing copy. Founder to founder, not vendor to prospect.