Access control and unique user identification
ZTNA, secure server access, device control and application filtering decide who reaches PHI from where, and automatic logoff and screen lock close the gap at the device.
HIPAA
HIPAA, built into the product instead of bolted on.
There is no HIPAA certificate to buy. There is a Security Rule with safeguards you either implement or do not, and a hospital security team that will ask. Osto implements the technical half and keeps the proof.
What it asks for
What a hospital security review asks you to prove.
HIPAA applies to covered entities and to business associates, which is what most health-tech startups are. No regulator audits you on the way in; your customer does, and their questionnaire is the real exam.
The Security Rule safeguards
Administrative, physical and technical. The technical set, access control, audit controls, integrity, authentication and transmission security, is the part a platform can actually implement rather than document.
The Privacy Rule and PHI handling
What counts as protected health information, who may see it, what patients can demand, and what minimum necessary means in your schema. This one is a product decision, not an infrastructure one.
Business associate agreements
You sign one with every covered entity you serve, and one with every subcontractor who touches PHI. Hospital counsel reads these closely, and a gap in your downstream chain stops the deal.
Breach notification, on a clock
Sixty days from discovery, with content requirements and a threshold that decides whether media notice applies. The clock starts when you should have known, which makes detection a compliance control.
How Osto covers it
The technical safeguards, as running software.
HIPAA names outcomes rather than products, so the question is always which system produces the outcome. These do.
Audit controls that record themselves
Continuous monitoring across cloud, network and endpoint. When a review asks who accessed what, the answer comes from the enforcement layer, not from a reconstruction.
Integrity and transmission security
Disk encryption, file access DLP, web and API protection in front of anything that carries PHI, and DNS and domain filtering on the way out.
Evaluation, which the rule explicitly requires
Expert-led VAPT plus web, mobile and API scanning. The Security Rule's evaluation standard is the clause people forget until a customer cites it.
Every module named above is on the platform page, with a short demo of each.
The honest difference
Policies on a shared drive, and safeguards in production.
HIPAA has no certifying body, so it is unusually easy to believe you are compliant. The test arrives as someone else's security questionnaire.
A policy pack
- Written safeguards and a training record
- A BAA template ready to sign
- A risk analysis completed once
- No system producing access logs
- Breach detection that depends on someone noticing
With Osto underneath
- The same written safeguards, enforced by a control
- The same BAA, with a downstream chain you can evidence
- A risk analysis kept current by what the platform sees
- Access logs generated by the enforcement layer
- Continuous detection, so the sixty-day clock starts honestly
HIPAA library
Everything we have written about HIPAA.
Written by the team that runs the controls, not a content desk.
Start here
The rules themselves
- The HIPAA Security Rule explained: safeguards and requirements
- HIPAA Security Rule: safeguards that matter
- The HIPAA Privacy Rule explained: PHI, rights and uses
- HIPAA Privacy Rule: access, consent and rights
- HIPAA Breach Notification Rule: who, when and how
- Breach Notification Rule: the 60-day clock
- HIPAA violations and penalties
BAAs, PHI and vendors
Building it in
- HIPAA for health tech startups: build it into your MVP
- HIPAA compliance for SaaS startups: a practical guide
- Essential components of HIPAA compliance for a startup
- HIPAA risk assessment: a step-by-step guide
- HIPAA for AI and health apps: what founders must know
- HIPAA compliance for remote teams: a practical guide
- HIPAA training requirements: who, what and how often
By stage
India, and other frameworks
- Do Indian health startups need HIPAA? A clear answer
- HIPAA for Indian healthtech founders: what it actually requires
- HIPAA and DPDP for Indian healthtech selling to US buyers
- HIPAA vs SOC 2: what is the difference?
- HIPAA vs SOC 2: do healthtech startups need both?
- HIPAA vs GDPR: key differences explained
Questions
The things founders ask first.
Can software be HIPAA certified?
No. There is no official HIPAA certification and no accrediting body, so any vendor selling you a HIPAA certificate is selling you their own badge. What exists is a set of safeguards you implement and can evidence.
Does HIPAA apply to an Indian company?
It applies if you handle PHI for a US covered entity, regardless of where you are incorporated. For Indian healthtech selling into US hospitals, HIPAA is a sales requirement, and DPDP applies in parallel at home.
We are pre-revenue. Is it too early?
The technical safeguards are much cheaper to build into an MVP than to retrofit after a hospital pilot is blocked. The administrative half, training, policies, a named security officer, can wait until you have people to train.
What is a business associate agreement?
A contract that passes HIPAA obligations down the chain. The covered entity signs one with you; you sign one with every subcontractor that touches PHI. Your cloud provider will have one ready. Smaller vendors often will not, and that is where chains break.
Do we need SOC 2 as well?
Often, yes, and for a different reason. HIPAA answers a legal obligation; SOC 2 answers a procurement question. The controls overlap enough that running one programme for both is normal, which is what the comparison post in the hub below works through.
Get HIPAA ready the way it actually works.
Thirty minutes, your stack on screen, an honest read on what is already in place and what is not.