HIPAA & SOC 2 Architecture for Healthcare SaaS

Ongoing. HIPAA compliance requires continuous monitoring, regular risk assessments, employee training, and patching vulnerabilities as they're discovered. Treating it as a one-time checklist is a common way to drift out of compliance. We set up automated monitoring so configuration drift is caught as your infrastructure evolves.

Usually yes, if you're selling to enterprise hospitals. HIPAA is a legal requirement for handling PHI; a SOC 2 report is an attestation, issued by a licensed CPA firm, on how your security controls are designed and operate. No certificate is issued. Hospitals use SOC 2 reports to speed up vendor security reviews; without one, expect longer and more detailed questionnaires.

A SOC 2 Type II report is an attestation issued by a licensed CPA firm after it tests how your controls operated over an observation window — commonly 3 to 12 months; the AICPA does not set a fixed minimum. No certificate is issued. The window can only start once the controls are in place and documented, so the engineering comes first. We engineer the technical controls auditors test; a CPA firm issues the report.

HIPAA does not require customer-managed keys. Encryption is an addressable implementation specification that names no algorithm or key type (45 CFR 164.312(a)(2)(iv)). Customer-managed keys (KMS) are good practice — they give you control over key rotation, access policies, and revocation — and security questionnaires ask about them. HHS's January 2025 proposed Security Rule update would make encryption required, but it is not final. Last reviewed 2026-09-25. Source: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312

Encryption at rest protects data stored in databases and S3 buckets (using KMS). Encryption in transit protects data as it moves between servers, browsers, and APIs (using SSL/TLS). The HIPAA Security Rule lists both as addressable specifications, and hospital security teams expect both. Many startups forget to enforce SSL/TLS on internal API calls between services, which fails hospital audits.

Not entirely, but direct SSH/database access must be restricted. Instead, we implement session-based access via AWS Systems Manager or GCP IAP, with all actions logged and time-limited. Engineers can still troubleshoot production, but they can't extract PHI without audit trails.

HIPAA requires breach notification to affected individuals, to HHS's Office for Civil Rights (OCR), and to prominent media outlets when a breach affects more than 500 residents of a state or jurisdiction. Civil money penalties are assessed per violation, not per patient record. Amounts in effect since Jan 28, 2026 (HHS inflation adjustment, 91 FR 3665): $145 to $73,011 per violation for tiers 1–3, and $73,011 to $2,190,294 for uncorrected willful neglect, with a calendar-year cap of $2,190,294 per identical provision. The architecture we build includes breach detection (CloudTrail anomaly detection) and incident response runbooks to limit exposure. Last reviewed 2026-09-25. Source: https://www.federalregister.gov/documents/2026/01/28/2026-01688/annual-civil-monetary-penalties-inflation-adjustment

KMS encryption, CloudTrail logging, and VPC isolation add to baseline cloud costs; how much depends mostly on log volume and key usage, and it can be estimated from your expected traffic before you commit. For a vendor selling to hospitals, that cost is usually small next to the value of the contracts it helps you qualify for.