Health tech founders often assume HIPAA applies to them, or assume it does not, without checking. We work out whether you are a covered entity, a business associate or neither, then draft or review the BAAs your customers and vendors need. Where other health privacy laws apply instead, we tell you that too.
At a glance
- Practice
- Privacy
- Pricing
- Flat fee, quoted before we start
- Included
- 6 deliverables
- Process
- 3 steps, one named attorney
- Where we work
- Slack, email or a call
When founders call us
The moments that usually bring a company to us for this work.
- 01
A hospital, clinic or health plan wants you to sign their BAA
- 02
You are building a health app and are not sure whether HIPAA covers you
- 03
You need BAAs with your cloud, email or analytics vendors that touch patient data
- 04
A customer asked for your HIPAA compliance documentation during a security review
What you get
Scoped in writing before we start. One flat fee for all of it.
- HIPAA applicability analysis for your product and customers
- Business associate agreement template for your customers
- Review and negotiation of customer-provided BAAs
- Subcontractor BAA review for vendors that handle protected health information
- Overview of related laws such as the FTC Health Breach Notification Rule and state health data laws
- Checklist of HIPAA administrative, physical and technical safeguards to discuss with your team
How it works
- 1
Applicability review
We review your product, customers and data flows to determine how HIPAA applies.
- 2
BAA drafting
We prepare your BAA template and review any agreements customers have sent.
- 3
Vendor alignment
We check that your downstream vendors are covered by appropriate BAAs.
Mistakes we help you avoid
The ones we see most often, and catch before they cost you.
- Avoided
Signing a BAA when HIPAA does not apply and taking on obligations you did not need
- Avoided
Storing protected health information with a vendor that will not sign a BAA
- Avoided
Assuming a consumer health app is outside all regulation when FTC or state health data rules apply
- Avoided
Breach notification timelines in a customer BAA that are shorter than your team can meet
HIPAA / BAAs: questions founders ask
It is a contract HIPAA requires between a covered entity, such as a provider or health plan, and a vendor that creates, receives, maintains or transmits protected health information on its behalf. It sets out permitted uses, safeguards and breach reporting duties. Business associates need similar agreements with their own subcontractors.
Not necessarily. HIPAA applies to covered entities and their business associates. A consumer app that people use on their own, without a provider or health plan involved, is often outside HIPAA but may be subject to FTC rules and state health data laws. The answer depends on who your customers are and how data flows.
If the vendor stores or processes protected health information for you, yes. Major cloud providers offer BAAs, but they typically cover only specific eligible services. You need to configure and use those services in line with the agreement.
No, the BAA is only one requirement. Business associates must also implement Security Rule safeguards, conduct risk analyses and follow breach notification rules. The BAA documents obligations your operations then have to meet.
Get a flat-fee quote for HIPAA / BAAs.
A short call with an attorney. You leave with a written scope and one fixed price.
Book a call