October 23, 2026
Your startup needs a HIPAA business associate agreement (BAA) if it creates, receives, maintains or transmits protected health information on behalf of a covered entity (a health plan, a healthcare clearinghouse or a provider that bills electronically) or on behalf of another business associate. If you sell software or services to hospitals, clinics, insurers or digital health companies that handle patient data for them, you almost certainly need one, and you need BAAs with your own vendors that touch that data too. If you sell a wellness or health app directly to consumers with no covered entity behind it, HIPAA usually doesn't apply, but the FTC's Health Breach Notification Rule and state consumer health data laws such as Washington's My Health My Data Act often do.
Key takeaways
HIPAA's Privacy, Security and Breach Notification Rules apply to two groups. Covered entities are health plans, healthcare clearinghouses and healthcare providers that conduct standard transactions, such as insurance billing, electronically. Almost every hospital, physician practice, pharmacy and insurer is one. A business associate is a person or company that creates, receives, maintains or transmits protected health information (PHI) on behalf of a covered entity, or performs a service for it that involves PHI. A subcontractor that does the same for a business associate is also a business associate.
For a startup, that typically means EHR integrations, revenue cycle and billing tools, care coordination platforms, remote patient monitoring sold to providers, AI scribes, analytics on claims data and the cloud and support vendors behind them. Storing encrypted PHI without the key still counts: HHS treats a cloud provider that stores PHI as a business associate even if it can't read the data. The only narrow exception is a pure conduit, such as an internet service provider, that only transmits data with transient storage.
HIPAA doesn't reach health data that a consumer gives you directly when no covered entity is involved, such as a fitness tracker, a period tracking app or a direct-to-consumer telehealth marketplace that isn't itself a provider. It also doesn't cover data that has been properly de-identified under HIPAA's safe harbor (removing 18 specified identifiers) or expert determination methods.
Outside HIPAA, three regimes matter most. The FTC Health Breach Notification Rule, amended effective July 29, 2024, applies to most health apps and connected devices that aren't covered by HIPAA. It treats an unauthorized disclosure, such as sharing health data with an advertising platform without consent, as a breach that requires notice to users and the FTC, and violations carry civil penalties per violation. State consumer health data laws, led by Washington's My Health My Data Act and a similar Nevada law, require consent to collect and share consumer health data, prohibit geofencing around health facilities, and in Washington give consumers a private right to sue. California's Confidentiality of Medical Information Act reaches providers and also some businesses that offer software or devices designed to maintain medical information. General state privacy laws treat health data as sensitive data too. See US Data Privacy Laws.
| Situation | HIPAA applies? | What governs instead or as well |
|---|---|---|
| You host or process patient data for a hospital or clinic | Yes, as a business associate | BAA, HIPAA Security and Breach Notification Rules |
| You are a vendor to a digital health company that is itself a business associate | Yes, as a subcontractor | Subcontractor BAA |
| Consumers download your app and enter their own health data | No | FTC Health Breach Notification Rule, state consumer health and privacy laws |
| A patient sends you records they obtained from their provider | No | Same as above |
| You only receive properly de-identified data | No | Data use agreement and contract terms |
The required terms are set by 45 CFR § 164.504(e). A BAA must state the permitted and required uses and disclosures of PHI and bar any others, require appropriate safeguards and compliance with the Security Rule for electronic PHI, require you to report uses or disclosures the contract doesn't allow, including breaches of unsecured PHI, and require any subcontractor that handles the PHI to agree to the same restrictions. It must also require you to help the covered entity give individuals access to and amendments of their records and an accounting of disclosures, make your books and records available to HHS, and return or destroy PHI at the end of the relationship, or extend the protections if that isn't feasible. The covered entity must be able to terminate if you materially breach.
Since 2013, business associates are directly liable to HHS for Security Rule compliance. That means a documented risk analysis, risk management, written policies and procedures, a security officer, workforce training, access controls, audit logs, contingency planning and encryption where reasonable. In January 2025, HHS proposed rewriting the Security Rule to make encryption, multifactor authentication, asset inventories, annual penetration testing and tested incident response plans mandatory, and to require business associates to verify their safeguards. The final rule has been delayed, and the federal regulatory agenda now points to 2027, so build toward the proposal but check its status.
On a breach of unsecured PHI, you must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. The covered entity then notifies affected individuals within 60 days, notifies HHS (within the same 60 days for breaches affecting 500 or more people, and annually for smaller ones) and, for more than 500 residents of a state, notifies the media. OCR enforces HIPAA with civil money penalties and corrective action plans, and state attorneys general can sue under HIPAA as well as state law. See Data Breach Response.
Every vendor that will create, receive, maintain or transmit PHI for you. The major cloud platforms, including AWS, Google Cloud and Microsoft Azure, sign BAAs that cover a defined list of services, and you must stay within that list. Google Workspace and Microsoft 365 offer BAAs on business plans. Many analytics, session replay, ad tech, customer support, email marketing and AI tools won't sign one, or only on enterprise plans, so design your product to keep PHI out of them. Tracking pixels on patient-facing pages are a frequent source of enforcement; see Tracking Pixels and Cookie Banners.
Expect the BAA on the customer's paper, often with terms well beyond the regulation. The usual pressure points are a breach notice deadline of 24 to 72 hours rather than the regulatory 60 days (ask for notice of confirmed breaches within a workable period, with updates as facts develop), uncapped indemnity and breach costs such as notification, credit monitoring and call centers (tie these to a separate, higher cap in your master agreement instead of leaving them unlimited), audit rights (limit them to once a year on notice, satisfied first by a SOC 2 or HITRUST report), bans on offshore access, restrictions on de-identifying data for product improvement, and insurance requirements. Make sure the BAA and the master agreement point to the same liability cap; a BAA that says "notwithstanding anything in the agreement" can quietly undo it. See Negotiate Customer Contracts.
Ask three questions. First, is your customer, or your customer's customer, a covered entity or a business associate? Second, will you create, receive, maintain or transmit health information on its behalf, rather than receiving it from consumers for your own service? Third, is the data identifiable, or properly de-identified before it reaches you? If the answer to the first two is yes and the data is identifiable, you are a business associate and need a BAA before you touch any data.
Example. A startup sells a remote monitoring dashboard to a 40-physician cardiology practice that bills insurers electronically, so the practice is a covered entity and the startup is its business associate. The startup hosts on AWS under a BAA, uses Google Workspace under a BAA, and keeps PHI out of its support ticketing tool, which won't sign one. On 3 March, the startup discovers a misconfigured storage bucket exposed records of 600 patients in one state. The regulation would allow notice to the practice as late as 2 May, 60 days after discovery, but the practice's BAA requires notice within five business days, by 10 March. Because 600 residents of one state are affected, the practice must notify the patients, HHS and prominent media outlets in that state. The BAA makes the startup pay for notification and credit monitoring up to the higher data breach cap in the master agreement. If the same startup also sold its app directly to consumers, those users' data would sit outside HIPAA, and the FTC rule and state law would govern it instead.
For more, see US Data Privacy Laws, Data Privacy Best Practices, Privacy Policy and Negotiate Customer Contracts.
If a healthcare customer has sent you a BAA or you aren't sure HIPAA applies to your product, contact us.
