HIPAA Compliance: Assessing the Real Risk
A recorded session for teams building products that handle US patient data. It covers what HIPAA requires and what turns health data into PHI. It also goes through how a Business Associate Agreement moves responsibility to vendors, with a real enforcement case at the end.
What You'll Learn About HIPAA Compliance
What HIPAA Is (and Isn't)
HIPAA is a 1996 US federal law that was later expanded to cover protected health information. The HHS Office for Civil Rights enforces it directly, with no notified bodies and no certificate to obtain. The session clears up four common myths and compares HIPAA with GDPR on scope, consent, breach deadlines, penalties and data residency. It also walks through the three rules HIPAA is built on.
Sensitive Data Identifiers
Health data becomes PHI once it is linked to any one of 18 identifiers. These range from names and email addresses to device serial numbers, IP addresses and full-face photos. Side-by-side examples show how the same heart rate reading can count as PHI in one table and fall outside HIPAA in another, depending on what it is stored next to.
Business Associate Agreements
A BAA is the contract between a covered entity and any vendor that handles PHI on its behalf. It has to be signed before PHI reaches the vendor. The session lists what a standard BAA contains and which responsibilities stay with the covered entity. Since the 2013 Omnibus Rule, regulators can fine business associates directly.
HIPAA in Practice
The practical part turns the rules into safeguards across four areas: administrative, technical, physical and maintenance. It covers risk analysis, audit logs on every read and write to PHI, retention schedules and subcontractor BAAs. It then looks at what follows a breach and at a 2011 case where UCLA Health paid $865,500 because employees had viewed celebrity patients' records without a permissible reason.
Assessing Your Risk
Most real risk sits in routine gaps, such as an unsigned BAA or a cloud resource tag with a patient's name in it. Every safeguard on the list is something the team controls. The session closes with a checklist of those safeguards that a team can plan into the build.
Built for Teams Handling US Patient Data
Founders and product leads planning a launch in the US healthcare market who need to know what HIPAA asks of them.
Engineering teams building products that store or process health data for a hospital or health plan.
Vendors asked to sign a BAA who want to understand what they are agreeing to before they sign.
Teams already working to GDPR who want to know how much of that work carries over to HIPAA.
Where This Comes From
Momentum is a healthtech software company. We have been building health applications since 2016. Our business analysis team works through requirements like these with clients before a build starts.
We also set up HIPAA and GDPR compliant infrastructure on the major cloud platforms, from encryption and access control to audit logging and audit readiness.
More Recorded Sessions
Webinar
ISO, MDR & FDA: Medical Device Certification Explained
.avif)
Webinar
MDR: What Changes When You Need a CE Mark?
Webinar
FDA: How Medical Devices Are Certified in the US?
More on HIPAA
HIPAA Compliance FAQ
Is there an official HIPAA certification?
HHS does not issue any HIPAA certification, so "HIPAA certified" is a marketing phrase with no legal standing. HIPAA is a set of rules enforced by the HHS Office for Civil Rights. Compliance is an ongoing risk management practice backed by security measures.
What is PHI?
Protected health information (PHI) is individually identifiable health information held by a covered entity or its business associates. In practice, health data becomes PHI once it is linked to any one of the 18 identifiers HIPAA lists. A heart rate tied to a named user account is PHI. The same reading averaged across all users or stored with no identifier attached falls outside HIPAA.
What are the 18 HIPAA identifiers?
The 18 HIPAA identifiers are names, geographic subdivisions smaller than a state, all elements of dates tied to a person except the year (such as birth or admission dates), phone numbers, fax numbers, email addresses, Social Security numbers, medical record numbers, health plan beneficiary numbers, account numbers, certificate or license numbers, vehicle identifiers, device identifiers and serial numbers, web URLs, IP addresses, biometric identifiers, full-face photos and any other characteristic that could uniquely identify the individual.
What is a Business Associate Agreement?
A Business Associate Agreement (BAA) is the contract HIPAA requires between a covered entity and any vendor that handles PHI on its behalf. It sets the permitted uses of PHI and the vendor's safeguard obligations. It also covers breach notification deadlines and the vendor's own subcontractors. A closing clause says what happens to the data when the contract ends. HHS publishes a free sample BAA that most agreements build on.
When does a vendor need to sign a BAA?
A vendor needs a signed BAA before any PHI reaches it. Moving PHI to a vendor without one is a HIPAA violation even if nothing goes wrong technically. Any subcontractor the vendor brings in needs its own equivalent BAA.
Is GDPR compliance enough for HIPAA?
GDPR compliance covers most HIPAA requirements, since GDPR is the higher bar on almost every dimension. Cross-compliance still cannot be assumed. HIPAA uses BAAs where GDPR uses data processing agreements. The two laws also differ on consent and breach deadlines.
Does HIPAA restrict where patient data is stored?
HIPAA sets no data residency restriction. The Security Rule safeguards and the BAA chain apply wherever PHI is stored. GDPR is stricter here: personal data can leave the EEA only under an adequacy decision or other approved safeguards.
What does the HIPAA Security Rule require?
The Security Rule covers electronic PHI and requires technical safeguards such as encryption and access logs. It also requires physical safeguards like facility access control, plus administrative safeguards like workforce training and risk assessments.
What is the HIPAA breach notification deadline?
A covered entity has to notify affected individuals within 60 days of discovering a breach. Breaches affecting 500 or more people also go to HHS within 60 days, while smaller ones are reported to HHS once a year. A business associate reports to the covered entity instead, within a shorter deadline set in the BAA, often 10 to 30 days.
What are the penalties for a HIPAA violation?
Civil penalties start at a few hundred dollars per violation and rise to more than $2 million a year for uncorrected willful neglect. A corrective action plan with years of mandated audits is a more common outcome than a fine. Willful misuse of PHI for personal gain can lead to criminal penalties of up to 10 years in prison.
How do I watch the session?
Sign up with the form on this page and the link to the recording arrives by email right away. You can watch it whenever it suits you.
Is this legal advice?
The session is educational material for product and engineering teams. For decisions specific to your product, check with your legal counsel.