HealthTech Security and Compliance: A Complete Guide

For HealthTech companies, security and compliance decide who will buy from you. Hospitals and health plans will not share patient data with a vendor that cannot show HIPAA safeguards, sign a business associate agreement, and back its claims with an independent report such as SOC 2 or HITRUST. This guide brings the topic together: which rules apply to your product, what HIPAA requires of software teams, how business associate agreements work, how to handle and share health data safely, how SOC 2 and HITRUST compare, and a practical roadmap. Each section links to a detailed guide.

Which rules and frameworks apply to your product

Rule or framework	Type	When it applies
HIPAA Privacy, Security, and Breach Notification Rules	US federal law	You are a covered entity, or a business associate that creates, receives, maintains, or transmits protected health information (PHI) on a covered entity's behalf
FTC Health Breach Notification Rule	US federal rule	Health apps and similar technologies that hold consumer health data and are not covered by HIPAA
State health privacy laws	State law	Consumer health data in states with their own rules, such as Washington's My Health My Data Act
SOC 2	Independent attestation report	Customers ask for evidence that your security controls are designed and operating effectively
HITRUST	Certifiable control framework	Customers, often large health systems and payers, require a HITRUST assessment

HIPAA, the FTC rule, and state laws are legal obligations. SOC 2 and HITRUST are voluntary frameworks, but in practice many healthcare buyers require one of them.

HIPAA for software teams

Most HealthTech vendors handle PHI as business associates of providers and health plans. The HIPAA Security Rule then requires administrative, physical, and technical safeguards for electronic PHI, starting with a documented risk analysis. The Breach Notification Rule requires notifying affected individuals without unreasonable delay and within 60 days of discovery, notifying HHS, and notifying the media when a breach affects more than 500 residents of a state.

HHS published a proposed update to the Security Rule on January 6, 2025, including stronger requirements for encryption and multi-factor authentication. It has not been finalized, so the current rule still applies, but many teams are already designing toward it. HHS also does not recognize any official "HIPAA certification"; compliance is shown through your own safeguards, documentation, and audits.

• HIPAA compliance for software development covers how the rules translate into engineering work.
• The HIPAA compliant app development checklist maps ten controls to the Security Rule with evidence and tests.
• Our HIPAA compliance audit guide explains how to prepare for and run an audit.

Business associate agreements

HIPAA requires a written business associate agreement (BAA) before a vendor handles PHI for a covered entity, and business associates need BAAs with their own subcontractors that touch PHI. The BAA sets permitted uses, safeguards, breach reporting, and what happens to data at the end of the contract. HHS guidance on cloud computing makes clear that a cloud provider storing electronic PHI is a business associate even if the data is encrypted and the provider does not hold the key. See our guide to the business associate agreement for software vendors.

Handling and sharing health data safely

• De-identification. HIPAA offers two methods: Safe Harbor, which removes 18 types of identifiers, and Expert Determination, where a qualified expert documents that re-identification risk is very small. Our guide to PHI de-identification methods compares them.
• Cloud infrastructure. Responsibility is shared between you and the cloud provider. Our guide to HIPAA compliance on AWS covers the engineering controls.
• AI and large language models. Any AI service that processes PHI needs a BAA and the same safeguards as other systems. See HIPAA-compliant AI and securing AI systems in healthcare.

SOC 2 and HITRUST: what healthcare buyers ask for

	SOC 2	HITRUST
What it is	An attestation report by an independent CPA firm under the AICPA's Trust Services Criteria	A certifiable framework (the HITRUST CSF) with assessments validated by HITRUST
Scope	Security, plus optional availability, processing integrity, confidentiality, and privacy criteria	Prescriptive controls mapped to HIPAA, NIST, ISO, and other sources
Options	Type 1 assesses control design at a point in time; Type 2 assesses operating effectiveness over a period	e1, i1, and r2 assessments, increasing in depth
Typical buyer	Common across healthcare and other industries	Often required by large health systems and payers

Our guides to SOC 2 for HealthTech startups and HITRUST vs SOC 2 explain how to choose and prepare.

A practical compliance roadmap for HealthTech companies

1. Map your data and your role. Identify where PHI enters, is stored, and leaves, and whether you act as a covered entity, business associate, or neither.
2. Run a risk analysis. Document threats and vulnerabilities to electronic PHI and the controls that address them.
3. Build safeguards into the product. Access control, encryption, audit logging, backup, and secure development belong in the architecture from the start.
4. Put contracts in place. Sign BAAs with customers and with every subcontractor that touches PHI.
5. Write and test incident response. Make sure you can meet breach notification timelines.
6. Choose an attestation. Start with SOC 2 or HITRUST based on what your target customers require, and collect evidence continuously rather than before the audit.

Guides in this cluster

• HIPAA Compliance for Software Development: A Practical Guide
• HIPAA Compliant App Development Checklist: 10 Controls, Evidence and Tests
• Business Associate Agreement for Software Vendors
• PHI De-identification Methods: A Practical HIPAA Guide
• HIPAA Compliance Audit: A Practical Guide
• HIPAA Compliance on AWS: A Practical Engineering Guide
• HIPAA-Compliant AI: How to Use LLMs With PHI Safely
• SOC 2 for HealthTech Startups: Roadmap from Zero to Audit
• HITRUST vs SOC 2: Which Does a HealthTech Company Need?
• Securing AI Systems in Healthcare: Controls That Matter
• Building Secure Healthcare AI Solutions for Enterprise Providers

If your software is also a medical device, see our Medical Device Software Regulation guide.

Conclusion

HealthTech security and compliance come down to four things: knowing which rules apply, building HIPAA safeguards into the product, putting business associate agreements in place, and proving your controls with SOC 2 or HITRUST. Handle data carefully when you de-identify it, move it to the cloud, or send it to AI services, and keep watching the proposed Security Rule update. Treated as part of engineering rather than a last-minute audit, compliance becomes a reason customers choose you. To build secure, compliant healthcare software, explore Ekipa's HealthTech engineering services or book a consultation.

Frequently asked questions

Does HIPAA apply to my HealthTech company?

It applies if you are a covered entity or if you create, receive, maintain, or transmit PHI on behalf of one as a business associate. Consumer health apps that people choose on their own are usually outside HIPAA but may be covered by the FTC Health Breach Notification Rule and state laws.

Is there an official HIPAA certification?

No. HHS does not recognize any HIPAA certification. You show compliance through a risk analysis, safeguards, policies, documentation, and audits, often supported by an independent SOC 2 or HITRUST report.

Do I need a business associate agreement with my cloud provider?

Yes, if the provider stores or processes electronic PHI for you. HHS guidance says this applies even when the data is encrypted and the provider does not have the decryption key.

Should a HealthTech startup choose SOC 2 or HITRUST first?

Let your target customers decide. SOC 2 is widely accepted and often the faster first step, while some large health systems and payers require HITRUST. Many companies start with SOC 2 and add HITRUST when enterprise deals demand it.

Has the HIPAA Security Rule been updated?

HHS proposed significant changes on January 6, 2025, including stronger encryption and multi-factor authentication requirements. The proposal has not been finalized, so the existing Security Rule still applies.