HIPAA (Health Insurance Portability and Accountability Act) is a U.S. federal law that sets standards for protecting sensitive patient health information. It includes the Privacy Rule (governing PHI use and disclosure), the Security Rule (requiring administrative, physical, and technical safeguards for ePHI), and the Breach Notification Rule. Organizations that handle PHI must comply with all applicable HIPAA provisions.

HIPAA applies to covered entities (healthcare providers, health plans, and healthcare clearinghouses) and their business associates—any organization that creates, receives, maintains, or transmits PHI on their behalf. This includes SaaS companies serving healthcare customers, cloud hosting providers, billing platforms, and any vendor with access to patient data.

HIPAA spans multiple rules with dozens of required and addressable safeguards across administrative, physical, and technical domains. A checklist breaks these requirements into actionable steps, helps you prioritize by risk level, and ensures you're addressing all applicable provisions—not just the ones that are most visible.

There's no formal HIPAA certification or audit—compliance is self-assessed and enforced through OCR investigations. Most organizations need 3–6 months to implement the required safeguards, conduct a risk assessment, establish policies, and train their workforce. Ongoing compliance requires continuous monitoring and annual risk assessment updates.