The Engineering HIPAA Compliance Checklist for Healthcare Startups

Why Most Startups Fail Hospital Vendor Audits

Building a healthcare app is the easy part. Getting a major hospital system to sign a Business Associate Agreement (BAA) and onboard your product as a vendor is a completely separate, far more grueling process.

Hospital IT security teams will send you a questionnaire with 200+ questions about your architecture. Here is what they are almost certain to ask about.

1. Encryption at Rest and In Transit

Treat encryption at rest for every datastore holding Protected Health Information (PHI) as mandatory in practice. Under the current Security Rule it is an addressable implementation specification (45 CFR 164.312(a)(2)(iv)): you must implement it or document why an equivalent measure is reasonable, and hospital questionnaires will not accept the second answer. HHS's January 2025 proposed Security Rule would make encryption required, but it is not final.

# AWS RDS with KMS encryption
resource "aws_db_instance" "phi_store" {
  storage_encrypted = true
  kms_key_id        = aws_kms_key.phi_key.arn
}

In transit, all communication must use TLS 1.2 or higher. Any API that accepts unencrypted HTTP requests will be an immediate audit failure. This applies equally to any EHR middleware layer that proxies HL7/FHIR data between systems.

2. Automated Audit Logging

You must be able to prove who accessed which PHI record and when. AWS CloudTrail plus immutable S3 log storage is the standard pattern. Keeping logs for 6 years is a conservative practice: HIPAA's 6-year retention rule (45 CFR 164.316(b)(2)(i)) covers required documentation, not audit logs specifically.

3. Access Control & Zero Trust

Implement the principle of least privilege. No production IAM role should have blanket * permissions. Every microservice should have its own role with exactly the S3 buckets, DynamoDB tables, or Secrets Manager secrets it needs — nothing more.

This same RBAC principle extends to application-level access control. The CCM/PCM Operations Platform reference shows how role-based access is implemented across a multi-tenant SaaS with separate manager, care coordinator, and admin permission tiers.

4. Business Associate Agreements (BAAs)

Every vendor in your supply chain that could touch PHI must have a signed BAA. This includes:

• Your cloud provider (AWS, GCP, Azure all offer BAAs)
• Your email provider (only some providers sign BAAs)
• Your analytics/logging tools

If you're using RPA bots for billing automation, the compute environment running those bots also falls within BAA scope if it touches PHI during workflow execution.

Conclusion

Passing a hospital vendor audit is a months-long engineering effort, not an afternoon of paperwork. Starting with a Zero Trust architecture from day one is the only cost-effective approach.

See the HIPAA & SOC 2 Architecture for Healthcare SaaS service for a full breakdown of the security engineering approach.

Last reviewed 2026-09-25. Sources: 45 CFR 164.312, 45 CFR 164.316.