Who HIPAA actually binds
HIPAA applies to covered entities — providers, health plans, clearinghouses — and to business associates: anyone who creates, receives, maintains, or transmits protected health information (PHI) on a covered entity's behalf. If you build software that touches PHI for a healthcare customer, you are almost certainly a business associate, and the obligations attach to you directly. They also flow downstream: your cloud provider becomes a subcontractor business associate, which is why the paperwork chain below matters.
There is no HIPAA certificate. No auditor hands you a stamp. Compliance is a posture you maintain and can demonstrate — through risk analysis, safeguards, policies, and signed agreements — and it is tested when a customer's compliance team, or an OCR investigator after a breach, asks you to show your work.
BAAs: the paperwork that comes first
Before architecture, get the Business Associate Agreements in order. You need a BAA with each covered-entity customer, and you need one from every vendor that touches PHI — starting with your cloud. AWS, Microsoft, and Google all offer BAAs (AWS through AWS Artifact, Microsoft through its product terms, Google Cloud through a signable addendum), and each publishes a list of eligible services. That list is a real constraint: run PHI only through services your provider's BAA covers.
The same test applies to every SaaS tool in the data path. Error tracking, analytics, logging pipelines, LLM APIs, customer support tools — if PHI can end up there, you need a BAA there, or you need to keep PHI out by design. Most accidental HIPAA exposure in startups is exactly this: PHI leaking into a tool nobody thought of as "the medical system."
The Security Rule, mapped to cloud primitives
The Security Rule's technical safeguards translate cleanly to cloud services. Access control: unique identities for every user, enforced MFA, least-privilege IAM roles, and automatic session timeout — IAM/Entra ID/Cloud IAM, with no shared accounts anywhere near PHI. Encryption: at rest via KMS-backed encryption on S3, EBS, RDS, Azure Storage, and Cloud Storage; in transit via TLS everywhere, including service-to-service. Audit controls: CloudTrail, Azure Monitor, or Cloud Audit Logs capturing who touched what, retained long enough to investigate — six years is the safe retention benchmark for HIPAA documentation generally. Integrity and transmission security round it out: versioning, backups you have tested, and no unencrypted transport paths.
Administrative safeguards get less attention and cause more findings: a written risk analysis (the single most-cited gap in OCR enforcement), a sanction policy, security awareness training, contingency planning, and a breach notification procedure with real timelines — 60 days to notify affected individuals is the outer bound, and many customer BAAs demand you tell them much sooner.
Making it demonstrable
When a hospital's compliance team evaluates you, they ask for artifacts: your risk analysis, your access review cadence, proof MFA is universal, evidence encryption is on everywhere PHI lives, and your audit log story. The difference between a painful quarter and a routine questionnaire is whether those artifacts describe your environment as it is today.
This is where continuous posture management earns its keep: a live inventory of everything PHI could touch, identity findings that flag the account without MFA before a reviewer does, misconfiguration findings for the unencrypted bucket, and HIPAA documentation generated from your actual environment. Cybermatic does that mapping — including HIPAA-tailored document generation — so the evidence exists before anyone asks.
Related on the platform