A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →HIPAA, the US Health Insurance Portability and Accountability Act, sets national rules for protecting individuals' health information. Its Security Rule requires administrative, physical, and technical safeguards for electronic protected health information (ePHI). It applies to healthcare providers, health plans, and the business associates that handle health data on their behalf.
If your software touches patient data on behalf of a covered entity, you are likely a business associate and must sign a Business Associate Agreement (BAA) and meet the Security Rule. That obligation flows down your subcontractor chain too.
HIPAA is principles-based rather than a fixed checklist, centered on a documented risk analysis. Many health-tech vendors layer SOC 2 on top to give buyers an independent attestation alongside their HIPAA posture.
traztech delivers HIPAA Security Rule readiness for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
HIPAA arrives through a customer contract far more often than through a regulator. A health system or payer asks you to sign a Business Associate Agreement, and the obligations follow from that.
The most common gap is the Security Rule risk analysis. It is mandatory, it is specific, and it is frequently missing entirely because teams assumed a policy set covered it.
No. Nobody issues a HIPAA certificate. What your customers are asking for is evidence: the risk analysis, your safeguards, your BAAs and your breach notification process.
No. A BAA from AWS, GCP or Azure covers their layer. Your application, access controls, logging and staff training sit outside it and are exactly what a customer security team will ask about.