Every healthcare software vendor claims to be 'HIPAA compliant'. The claim is nearly meaningless without specifics. HIPAA is not a certification, it's a US federal regulation with specific administrative, physical and technical safeguards. This is the substance.
The one-sentence version
HIPAA (the Health Insurance Portability and Accountability Act, 1996, updated multiple times) protects Protected Health Information (PHI) in the United States. Any software that stores, processes or transmits PHI must implement the Administrative, Physical and Technical Safeguards defined in the Security Rule.
Who has to comply
Two categories: **Covered Entities** (healthcare providers, health plans, healthcare clearinghouses) and **Business Associates** (vendors that handle PHI on behalf of Covered Entities). If you build software that processes PHI for a hospital, insurer or clinician, you're a Business Associate. You need to sign a Business Associate Agreement (BAA) with them.
The technical safeguards that actually get audited
**Access controls.** Role-based access, unique user IDs, automatic logoff. In practice: SSO with SAML/OIDC, RBAC in the database and application layer, session timeouts under 15 minutes for clinical apps.
**Audit controls.** Every access to PHI logged. Immutable, tamper-evident logs. Retained 6 years minimum. In practice: append-only audit tables (or an external service like Datadog + retention policy), user + resource + action + timestamp on every PHI read/write.
**Integrity controls.** Detect unauthorized modification of PHI. In practice: hashing critical records, or database-level tamper detection.
**Transmission security.** Encryption in transit. TLS 1.3, no exceptions. Internal service-to-service traffic encrypted too — 'we're inside the VPC' doesn't cut it any more.
**Encryption at rest.** PHI encrypted in storage. Modern cloud providers offer this at the volume level; belt-and-braces implementations add application-level field encryption for the most sensitive columns (SSN, MRN).
The compliance theatre to ignore
**'HIPAA-certified cloud provider'** — HIPAA doesn't certify cloud providers. AWS, Azure and GCP sign BAAs and offer HIPAA-eligible services; those services are yours to configure correctly. The certification claim is marketing.
**'HITRUST certified'** — Actually meaningful. HITRUST is a real certification framework that maps to HIPAA. Getting HITRUST certified takes 6-12 months and $150k-$500k. Enterprises expect it. If you're selling to hospitals, plan for it.
**'SOC 2 Type II'** — Meaningful but different. SOC 2 attests to your operational controls broadly. HIPAA is health-specific. Enterprises usually want both.
The BAA in practice
The Business Associate Agreement is a contract that flows down HIPAA obligations from Covered Entity to Business Associate. Real requirements: BAA with every downstream vendor that touches PHI, BAA with every cloud provider, BAA with every third-party API that receives PHI. Documented, dated, current.
When we build for healthcare clients, we maintain a BAA registry — every service we use, whether it has a BAA in place, and when it was last reviewed. Auditors love this document.
The AI wrinkle
AI features in HIPAA-covered products need extra care. Rules of thumb: (1) never send PHI to a provider you don't have a BAA with (OpenAI signs BAAs at the enterprise tier; Anthropic signs BAAs; Google Cloud Vertex signs BAAs); (2) never use PHI to fine-tune public models; (3) log every LLM call as a PHI access event.
For teams that can't or won't send PHI to a hosted LLM provider, the pattern is sovereign / on-prem inference on open-weight models. We've deployed this pattern for regulated clients — see Document Intelligence for the architecture.
The Origami POV
HIPAA compliance is boring engineering discipline plus paperwork. The engineering is well-understood; the paperwork is where teams stumble. Every healthcare engagement we take, we spend the first two weeks setting up the compliance scaffolding — BAA registry, audit log framework, encryption policy, incident response runbook — because retrofitting compliance is 10x the effort of building it in from day one.