HIPAA Compliance for AI Startups: A Complete Checklist
Building healthcare AI? This is the HIPAA compliance checklist that actually matters — from someone who's been through it. BAAs, encryption, audit logs, and the pitfalls that kill enterprise deals.
Quick answer: Yes, AI startups handling PHI need HIPAA compliance. No, you don't need to be perfect on day one. But you do need these 12 controls before any serious healthcare customer will talk to you.
The Reality Check
Most AI startups think HIPAA compliance is a checkbox you tick before selling to hospitals. It's not. It's a competitive moat.
We learned this building OralMind — our AI dental workflow platform. The moment we could say "HIPAA-compliant, BAA-ready" in sales conversations, everything changed. Procurement stopped blocking. Legal stopped asking 47 questions. Deals moved forward.
Here's what we implemented, in the order that actually matters for closing deals.
Phase 1: The Non-Negotiables (Week 1-2)
These four controls are table stakes. Without them, you can't even start a HIPAA compliance conversation with enterprise customers.
1. Encryption at Rest and In Transit
This is the easiest win. If you're using modern cloud infrastructure, you're probably already compliant.
What You Need:
- ✓TLS 1.2+ for all data in transit (HTTPS everywhere, no exceptions)
- ✓AES-256 encryption for data at rest (database, backups, file storage)
- ✓Key management via AWS KMS, GCP Cloud KMS, or Azure Key Vault
What we did: Enabled encryption on RDS, S3, and all application-layer storage. Added explicit TLS enforcement in our application config. Total time: 2 hours.
Customer question you'll get: "Do you encrypt PHI at rest and in transit?" Answer: Yes, with specifics.
2. Access Controls (RBAC + MFA)
HIPAA requires "minimum necessary" access — people only see what they need to do their job.
What You Need:
- ✓Role-based access control (RBAC) — admin, clinician, billing, read-only
- ✓MFA for all users — no exceptions, including developers
- ✓Automatic session timeout — 15 minutes of inactivity
- ✓Unique user IDs — no shared accounts, ever
What we did: Implemented RBAC with four default roles. Forced MFA via Auth0. Set session timeout to 15 minutes. Added "no shared accounts" to employee handbook.
Customer question: "How do you control access to PHI?" Show them your role matrix and MFA policy.
3. Audit Logs (Who Accessed What, When)
This is where most startups fail. HIPAA requires you to log every access to PHI — and be able to produce those logs on demand.
What You Need:
- ✓Log every PHI access — view, create, update, delete
- ✓Immutable logs — write-once, can't be modified or deleted
- ✓Retention: 6+ years — HIPAA minimum is 6 years from creation
- ✓Searchable — ability to query "show me everyone who accessed Patient X's record"
What we did: Built audit logging into our data access layer. Every query that touches PHI logs: user ID, timestamp, action, patient ID, IP address. Logs go to a separate write-once S3 bucket with 7-year retention.
// Simplified audit log example
async function accessPatientRecord(userId: string, patientId: string) {
await auditLog.create({
userId,
action: 'READ',
resourceType: 'PATIENT_RECORD',
resourceId: patientId,
timestamp: new Date(),
ipAddress: getRequestIP(),
});
return db.patients.findById(patientId);
}Customer question: "Can you produce an audit report for all accesses to a specific patient's data?" You need to be able to say yes — and demonstrate it.
4. Business Associate Agreement (BAA)
This is the contract that makes you legally responsible for protecting PHI. You need two things:
What You Need:
- ✓BAA template ready — have your legal counsel draft this early
- ✓Cloud provider BAA signed — AWS, GCP, Azure all offer BAAs (enable in console)
- ✓Subprocessor BAAs — any vendor touching PHI needs a BAA
What we did: Signed AWS BAA (free, takes 5 minutes in AWS console). Had our counsel draft a customer-facing BAA template. Documented all subprocessors in a public-facing list.
Red flag: If you're using any third-party API that processes PHI without a BAA (looking at you, generic LLM APIs), you're not HIPAA-compliant. Period.
LLM Warning: Most LLM APIs (OpenAI, Anthropic, etc.) do NOT sign BAAs for their standard offerings. If you're sending PHI to these APIs, you're violating HIPAA. Options: (1) Use HIPAA-eligible offerings (Azure OpenAI Service with BAA), (2) Deploy models on your own infrastructure, (3) Strip all PHI before sending to third-party APIs.
Phase 2: The Deal Accelerators (Week 3-4)
These controls won't block deals initially, but they'll speed up procurement and legal review significantly.
5. Data Backup and Disaster Recovery
HIPAA requires "contingency planning" — basically, what happens when things break.
What You Need:
- ✓Daily automated backups — encrypted, tested quarterly
- ✓Recovery time objective (RTO) — document your target (we use 4 hours)
- ✓Recovery point objective (RPO) — max data loss window (we use 24 hours)
- ✓Tested restore procedure — document and test restoring from backup
What we did: Enabled automated daily RDS snapshots with 30-day retention. Documented restore procedure in runbook. Tested restore quarterly (takes 30 minutes).
6. Incident Response Plan
HIPAA requires you to document how you handle security incidents — and notify customers within specific timeframes.
What You Need:
- ✓Written incident response plan — who does what when a breach occurs
- ✓Breach notification timeline — 60 days max under HIPAA, customers may require faster
- ✓Designated security officer — one person responsible for incident response
- ✓Documentation requirements — log every incident, even minor ones
What we did: Created a 3-page incident response runbook. Named our CTO as security officer. Committed to 72-hour customer notification (stricter than HIPAA minimum).
7. Employee Training and Policies
HIPAA requires workforce training. This is easier than it sounds.
What You Need:
- ✓HIPAA training for all employees — annual requirement, document completion
- ✓Security policies in employee handbook — password requirements, PHI handling, incident reporting
- ✓Confidentiality agreements — all employees sign as part of onboarding
- ✓Termination procedure — revoke access immediately when employees leave
What we did: Used free HIPAA training videos (HHS website has them). Added security policies to handbook. Required signed confidentiality agreements. Added access revocation to offboarding checklist.
Phase 3: The Enterprise Differentiators (Month 2+)
These controls matter for large health systems and multi-year contracts. You can close initial deals without them, but they'll come up in renewal negotiations.
8. Penetration Testing
Annual pen tests are required by most enterprise customers. Get one done by a reputable third party.
What we did: Hired a healthcare-focused security firm. Cost: $8,000-15,000 depending on scope. Got a formal report. Fixed all high/critical findings. Share executive summary with customers under NDA.
9. SOC 2 Type II (Eventually)
SOC 2 isn't required by HIPAA, but enterprise customers will ask for it. Start with SOC 2 Type I (point-in-time), then Type II (over time) after you have 6+ months of controls operating.
Timeline: Type I takes 2-3 months. Type II requires 6 months of operating controls + 2-3 months for audit. Budget $20,000-40,000 depending on company size.
10. Data Processing Addendum (DPA)
If you have European customers or handle EU citizen data, you'll need a DPA for GDPR compliance. Even for US-only customers, having a DPA ready signals sophistication.
Common Pitfalls (That Kill Deals)
❌ Using third-party APIs without BAAs
Fix: Audit your entire stack. Any vendor touching PHI needs a signed BAA.
❌ Developers accessing production PHI
Fix: Production PHI access should be restricted to specific roles. Use anonymized data for development.
❌ PHI in logs, analytics, or error tracking
Fix: Strip PHI before sending to external services (Sentry, LogRocket, Google Analytics).
❌ No data retention policy
Fix: Document how long you keep PHI and how you securely delete it.
❌ Emailing PHI unencrypted
Fix: Use encrypted email or secure messaging for any PHI communication.
The Sales Conversation
Here's how HIPAA compliance comes up in enterprise sales:
Typical procurement questions:
- "Are you HIPAA-compliant?" → Yes, here's our checklist.
- "Can we see your BAA?" → Yes, attached.
- "Do you have a pen test report?" → Yes, under NDA.
- "Where is data hosted?" → AWS US-East-1, encrypted at rest and in transit.
- "Who has access to PHI?" → Only authorized clinical staff. Developers access anonymized data only.
Having ready answers to these questions — with documentation to back them up — is the difference between a 3-week procurement process and a 3-month one.
The Bottom Line
HIPAA compliance for AI startups isn't about perfection. It's about demonstrating you take data security seriously.
Start with Phase 1 (encryption, access controls, audit logs, BAA). You can implement these in 2-4 weeks with a small team. Then layer in Phase 2 as you close your first enterprise deals. Phase 3 comes when you're selling to health systems with 10+ hospitals.
The companies that win in healthcare AI aren't necessarily the ones with the best models. They're the ones that make procurement and legal say "yes" fastest.
HIPAA compliance is how you get to "yes."
Building Healthcare AI?
OralMind is our HIPAA-compliant AI platform for dental practices. X-ray analysis, auto-documentation, clinical decision support — built with compliance from day one.