HIPAA Compliance for SaaS: A Practical Checklist

Most healthcare SaaS founders discover their compliance gaps at the worst possible time: during an enterprise sales cycle, a security review, or worse, after a breach. If you are starting from scratch, what it actually takes to build a HIPAA-compliant platform is a useful place to begin. This checklist covers what actually needs to be in place before you go to market with a healthcare platform. For the API layer specifically, see building HIPAA-compliant APIs with FHIR R4.

Strong HIPAA compliance for SaaS platforms is a key part of building good healthcare compliance practices that hospitals and enterprise clients expect before trusting your system.

HIPAA compliance is not a certification you pay for. It is a set of safeguards you implement, document, and maintain. When you are building a multi-tenant platform, the rules change compared to traditional on-premise software.

But while the rulebook sounds straightforward, implementation is where developers struggle, especially when dealing with HIPAA technical safeguards, vendor BAAs, and audit requirements that were clearly not designed for modern cloud stacks.

Many teams only realize their gaps after a hospital legal team asks for their BAA or after an auditor finds PHI in their Sentry logs. Understanding healthcare SaaS compliance requirements early changes everything. It turns a panic-driven retrofit into a structured, predictable deployment that actually passes review.

HIPAA Compliance for SaaS: A Practical Checklist for Healthcare Platforms (illustration)

This HIPAA compliance checklist covers what actually needs to be in place before you go to market with a healthcare platform.

Understand Your Role: Covered Entity or Business Associate?

HIPAA divides responsibility into two categories.

If you store, process, or transmit Protected Health Information (PHI) on behalf of a hospital, clinic, or insurance company, you are a Business Associate (BA). This determines your obligations. This is where healthcare SaaS compliance starts.

Get your BAA signed with every client before data flows. This is not optional. This is your legal status under the HITECH Act.

For example, one team launched a patient messaging feature, collected appointment data, and only realized they needed BAAs with three vendors when their first hospital client asked for a compliance review.

Without a signed BAA (Business Associate Agreement) with every client, you cannot touch their data.

Period.

Technical Safeguards Checklist

Here is what HIPAA technical safeguards actually require in practice.

Encryption at Rest and In Transit

TLS 1.2+ on all data in transit. No older protocols. No exceptions.
AES-256 encryption at rest for databases, backups, and file storage.
Field-level encryption for highly sensitive fields like SSN and diagnosis codes. If your main database leaks, these stay protected.
Customer-managed keys are recommended. Rotate them regularly.

Access Management

MFA for all admin and provider access. "It is annoying" is not a valid reason to skip this.
Role-based access control, least privilege. Your support person does not need access to clinical notes.
Automatic session timeout. 15 minutes of inactivity triggers logout.

Audit Controls and Visibility

Every view, edit, create, and delete of PHI must be logged. This is a core HIPAA technical safeguards requirement.
Audit logs: immutable, timestamped, retained minimum 6 years.
No PHI in URLs, query strings, logs, or error messages. Never.
PHI security depends entirely on knowing who accessed what and when. Without audit logs, you have no visibility.

This is where most startups fail during their first audit.

The PHI Security Rule: What You Must Know

The PHI security rule (formally the HIPAA Security Rule) establishes national standards for protecting electronic Protected Health Information (ePHI).

It requires three things:

Confidentiality, integrity, and availability of ePHI
Protection against reasonably anticipated threats
Compliance by your entire workforce

PHI security is not just about encryption. It is about access, logging, breach detection, and vendor management.

Every safeguard below ties back to one of these three requirements.

Vendor and Infrastructure Checklist

Every vendor that touches PHI needs a signed BAA. This is non-negotiable for HIPAA compliance.

Cloud Providers: AWS, Azure, and GCP all offer BAAs. You must explicitly request and sign them. A default account is not HIPAA-compliant.

Email & SMS: Email providers like SendGrid, Mailgun, and AWS SES require BAAs. Standard SMTP relays are not acceptable. SMS through Twilio requires a signed BAA, and you may only use Twilio products it lists as HIPAA-eligible.

Observability (The Most Common Gap): Sentry offers a BAA, but you must scrub data. By default, Sentry captures console logs and request bodies often full of PHI. Do not send PHI logs to Datadog or New Relic without a signed BAA. Never send raw database rows to CloudWatch Logs without filtering.

Analytics: Do not use Google Analytics on any page that touches PHI. Use a self-hosted or BAA-compliant analytics solution.

Telehealth: Zoom for Healthcare is eligible. Twilio is eligible. Standard Zoom is not.

Operational Safeguards

Healthcare SaaS compliance is not just about code.

Workforce training: Every employee, including engineers, must complete annual HIPAA security training. Document this.

Access termination: Automated process to revoke GitHub, cloud console, and internal tool access immediately when an employee leaves.

Incident response plan: Written plan that includes who to call, how to isolate servers, and when to notify.

The 60-day breach notification rule: From the moment you discover a breach, you have 60 days to notify. Document your detection and response timeline now, not after an incident.

PHI security relies on people following procedures. The best encryption in the world does not matter if an ex-employee still has access.

What HIPAA Compliance Reviews Miss Most Often (Real Production Gaps)

These gaps come up again and again in production healthcare SaaS platforms. Each one breaks a HIPAA technical safeguard.

1. PHI appearing in Sentry error logs via full API response logging

Your API hits a 500 error. It returns the full user object (name, DOB, phone) in the response body. Sentry captures it. Now your error tracker contains PHI.

Fix: Add data scrubbing filters to every external service before going live.

2. Shared admin credentials across engineering team

Three engineers share the admin@company.com login for your cloud dashboard. HIPAA requires audit trails. How do you know who did what?

Fix: Every person gets their own login. Shared accounts are a breach waiting to happen.

3. BAA missing with transactional email provider

You have a BAA with AWS. But you send patient appointment reminders through a standard Mailgun account without a BAA.

Fix: Check every email provider. Get BAAs for all of them.

4. Audit logs stored in same DB as application data, not tamper-evident

Your audit log lives in the same MySQL database as patient records. Database compromised. Attacker deletes patient data and the log showing they did it.

Fix: Audit logs go to separate, immutable storage. AWS S3 with Object Lock works.

5. No process for revoking access when a team member leaves

An engineer leaves the company. Their GitHub, cloud console, and internal tool access are still active for weeks.

Fix: Automate access revocation immediately upon departure.

FAQs

Are you a Covered Entity or a Business Associate under HIPAA?

If you store, process, or transmit PHI on behalf of a hospital, clinic, or insurer, you're a Business Associate, which means you need a signed BAA with every client before any data flows, not after.

What encryption does HIPAA compliance require for a SaaS platform?

TLS 1.2+ for all data in transit, AES-256 encryption at rest for databases and backups, field-level encryption for highly sensitive fields like SSNs and diagnosis codes, and customer-managed keys rotated regularly.

Which third-party vendors need a signed BAA?

Any vendor that touches PHI: cloud providers like AWS, Azure, or GCP, email and SMS providers like SendGrid or Twilio, and observability tools like Sentry, which by default captures console logs and request bodies that often contain PHI.

What's the most common HIPAA gap found during production reviews?

PHI appearing in error-tracking logs, for example when a 500 error response includes a full user object with name, date of birth, and phone number, and that response body gets captured by a tool like Sentry without data-scrubbing filters in place.

How long must audit logs be retained, and where should they live?

A minimum of 6 years, stored as immutable, timestamped records, in separate storage from the application database. If the database is compromised, audit logs sitting in that same database could be altered or deleted along with the evidence.

What's the deadline for HIPAA breach notification?

60 days from the moment a breach is discovered. Documenting the detection and response timeline in advance, not improvising it after an incident has already happened, is the safer approach.

Conclusion

HIPAA compliance is not just a legal requirement. It is the gatekeeper for selling into healthcare.

Compliance built in from day one is cheaper than retrofitting it.

Teams that understand HIPAA technical safeguards early move faster through enterprise sales cycles, reduce security review failures, and build systems that scale reliably in real clinical environments. Strong PHI security becomes a competitive advantage, not a bottleneck.

Teams that don't often end up rebuilding their entire security architecture under pressure.

For more, read our guide to HIPAA basics and our deep dive on FHIR API best practices.

If you are building healthcare SaaS compliance into your platform, mastering these requirements is not optional. It is foundational.