What is HIPAA?
HIPAA protects patients’ health information (PHI) in the United States. It applies to healthcare providers, health plans and clearinghouses, and to the vendors that handle PHI on their behalf, known as business associates. There is no official HIPAA certificate: companies demonstrate compliance through risk assessments, safeguards and Business Associate Agreements.
Who needs it
- Health tech startups selling to US providers, payers or digital health companies
- Software vendors that store or process PHI on behalf of a covered entity (business associates)
What usually triggers it
- A US healthcare customer asks you to sign a Business Associate Agreement
- Your product starts storing patient data
How the process works
- Confirm whether you handle PHI and in which systems
- Run a HIPAA security risk assessment
- Implement administrative, physical and technical safeguards
- Sign BAAs with customers and sub-processors
- Train staff and document everything
How Holam helps
We work out whether HIPAA is what your customers actually need, and in what order alongside other frameworks. We then introduce you to a compliance platform and specialists that fit your stage, and stay involved until the result is in your hands. Holam receives a referral fee from providers we introduce when you engage them. You pay the provider directly, we add nothing to their price, and you remain free to choose another provider.
Frequently asked questions
Can we get HIPAA certified?
There is no official certification. Third-party assessments and SOC 2 reports with HIPAA mapping are common ways to show compliance.
Does HIPAA apply to every company with health data?
No. It applies to covered entities (providers, health plans, clearinghouses) and their business associates. A consumer health app with no covered-entity customers may fall outside HIPAA, while other rules can still apply. A European vendor serving US covered entities can be in scope.