HIPAA Compliance: The Complete Guide for Startups | Osto<\/title>\n<meta name=\"description\" content=\"A complete guide to HIPAA compliance: who it covers, the Privacy, Security, and Breach Notification rules, the safeguards, and how to stay compliant.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">HIPAA compliance, explained end to end. What it is, who it applies to, the rules and safeguards it requires, and how a lean team actually achieves and maintains it. This is the overview that ties the whole picture together.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>10 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>HIPAA compliance means meeting the US law that protects health information: following the Privacy, Security, and Breach Notification Rules, implementing administrative, physical, and technical safeguards, and keeping evidence that it all works. It applies to covered entities and their business associates.<\/p>\n <p>It is not a one-time certificate but an ongoing program anchored by a risk analysis. For a lean team, the practical route is one platform that provides the controls and the evidence together, mapped to HIPAA.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What HIPAA compliance is<\/a><\/li>\n <li><a href=\"#who\">Who must comply<\/a><\/li>\n <li><a href=\"#rules\">The core rules<\/a><\/li>\n <li><a href=\"#safeguards\">The safeguards<\/a><\/li>\n <li><a href=\"#achieve\">How to achieve it<\/a><\/li>\n <li><a href=\"#maintain\">Staying compliant<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">What HIPAA compliance is<\/h2>\n <p>HIPAA, the Health Insurance Portability and Accountability Act, is the US law that governs how protected health information is used and protected. Compliance means meeting its requirements: following its rules, putting safeguards in place around health data, and being able to demonstrate that you do. It applies to organisations that handle PHI and is enforced by the HHS Office for Civil Rights. Importantly, HIPAA compliance is a continuous state, not a certificate you earn once and file away.<\/p>\n\n <div style=\"background:linear-gradient(135deg,#0e1444,#1c267a 55%,#242f86);border-radius:20px;padding:34px 34px 30px;margin:30px 0;box-shadow:0 18px 50px rgba(14,20,68,.28);position:relative;overflow:hidden\">\n <div style=\"position:absolute;top:-50px;right:-40px;width:260px;height:260px;background:radial-gradient(circle,rgba(58,70,192,.45),transparent 68%);pointer-events:none\"><\/div>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#aeb6ee;margin-bottom:6px\">The whole picture<\/div>\n <div style=\"font-size:21px;font-weight:800;color:#fff;margin-bottom:24px;letter-spacing:-.01em\">What HIPAA compliance covers<\/div>\n <div style=\"display:grid;grid-template-columns:1fr 1fr 1fr ;gap:16px\"><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M12 4v16M7 20h10\"\/><path d=\"M12 6l-6 2 6-2 6 2-6-2z\"\/><path d=\"M6 8l-2.5 5a2.5 2.5 0 0 0 5 0L6 8z\"\/><path d=\"M18 8l-2.5 5a2.5 2.5 0 0 0 5 0L18 8z\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">The rules<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">Privacy, Security, and Breach Notification requirements.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M12 3l7 3v5c0 4.4-3 8.2-7 9-4-.8-7-4.6-7-9V6l7-3z\"\/><path d=\"M9 11.5l2 2 4-4\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">The safeguards<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">Administrative, physical, and technical protections for PHI.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M4 12a8 8 0 0 1 13.5-5.8L20 8\"\/><path d=\"M20 4v4h-4\"\/><path d=\"M20 12a8 8 0 0 1-13.5 5.8L4 16\"\/><path d=\"M4 20v-4h4\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">The practice<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">An ongoing program, not a one-time certification.<\/div>\n <\/div><\/div>\n<\/div>\n\n <h2 class=\"sec\" id=\"who\">Who must comply with HIPAA<\/h2>\n <p>HIPAA divides the world into two groups. Covered entities are healthcare providers, health plans, and healthcare clearinghouses, the organisations at the centre of care and payment. Business associates are the vendors and partners that handle PHI on a covered entity’s behalf, which includes most healthtech and SaaS companies serving healthcare. If you are either, HIPAA applies to you, and business associates carry direct compliance obligations, not just contractual ones.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">Most startups are business associates<\/div>If your company handles PHI for healthcare customers, you are almost certainly a business associate, which means HIPAA applies to you directly. You must meet its safeguards and sign a BAA with each covered-entity customer.<\/div>\n\n <h2 class=\"sec\" id=\"rules\">The core rules of HIPAA<\/h2>\n <p>HIPAA compliance is built on three central rules, each governing a different aspect of protecting health information.<\/p>\n\n <div class=\"otable\"><table class=\"regtable\">\n <tr><th>Rule<\/th><th>What it governs<\/th><\/tr>\n <tr><td><strong>Privacy Rule<\/strong><\/td><td>How PHI may be used and disclosed, and patients’ rights over it<\/td><\/tr>\n <tr><td><strong>Security Rule<\/strong><\/td><td>Safeguards for electronic PHI: administrative, physical, technical<\/td><\/tr>\n <tr><td><strong>Breach Notification Rule<\/strong><\/td><td>What to do and whom to notify when PHI is breached<\/td><\/tr>\n <\/table><\/div>\n\n <p>The <a href=\"https:\/\/www.osto.one\/resources\/glossary\/hipaa-privacy-rule\/\">Privacy Rule<\/a> sets the boundaries on using health data, the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/hipaa-security-rule\/\">Security Rule<\/a> mandates how electronic PHI must be protected, and the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/hipaa-breach-notification-rule\/\">Breach Notification Rule<\/a> defines your obligations when something goes wrong. Together they form the backbone of compliance.<\/p>\n\n <h2 class=\"sec\" id=\"safeguards\">The safeguards HIPAA requires<\/h2>\n <p>The Security Rule organises its protections into three categories of safeguards, and a compliant program needs all three.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">The full scope<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">Everything HIPAA compliance includes<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">From who is covered to how you stay compliant over time, these are the pieces this guide connects.<\/div>\n <svg viewBox=\"0 0 700 250\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Overview map of what HIPAA compliance covers\">\n<g font-family=\"Inter,Arial,sans-serif\" text-anchor=\"middle\">\n <circle cx=\"350\" cy=\"125\" r=\"54\" fill=\"#1c267a\"\/>\n <text x=\"350\" y=\"120\" fill=\"#fff\" font-size=\"13\" font-weight=\"800\">HIPAA<\/text>\n <text x=\"350\" y=\"138\" fill=\"#c3c9ee\" font-size=\"10.5\">compliance<\/text>\n <g>\n <rect x=\"55\" y=\"24\" width=\"150\" height=\"42\" rx=\"11\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.3\"\/>\n <text x=\"130\" y=\"50\" fill=\"#2b3596\" font-size=\"11.5\" font-weight=\"700\">Who it covers<\/text>\n <rect x=\"55\" y=\"104\" width=\"150\" height=\"42\" rx=\"11\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.3\"\/>\n <text x=\"130\" y=\"130\" fill=\"#2b3596\" font-size=\"11.5\" font-weight=\"700\">The rules<\/text>\n <rect x=\"55\" y=\"184\" width=\"150\" height=\"42\" rx=\"11\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.3\"\/>\n <text x=\"130\" y=\"210\" fill=\"#2b3596\" font-size=\"11.5\" font-weight=\"700\">Safeguards<\/text>\n <rect x=\"495\" y=\"24\" width=\"150\" height=\"42\" rx=\"11\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.3\"\/>\n <text x=\"570\" y=\"50\" fill=\"#0a7d6c\" font-size=\"11.5\" font-weight=\"700\">Breaches<\/text>\n <rect x=\"495\" y=\"104\" width=\"150\" height=\"42\" rx=\"11\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.3\"\/>\n <text x=\"570\" y=\"130\" fill=\"#0a7d6c\" font-size=\"11.5\" font-weight=\"700\">Enforcement<\/text>\n <rect x=\"495\" y=\"184\" width=\"150\" height=\"42\" rx=\"11\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.3\"\/>\n <text x=\"570\" y=\"210\" fill=\"#0a7d6c\" font-size=\"11.5\" font-weight=\"700\">Staying compliant<\/text>\n <\/g>\n <g stroke=\"#c9cfee\" stroke-width=\"1.5\">\n <line x1=\"205\" y1=\"45\" x2=\"300\" y2=\"105\"\/><line x1=\"205\" y1=\"125\" x2=\"296\" y2=\"125\"\/><line x1=\"205\" y1=\"205\" x2=\"300\" y2=\"145\"\/>\n <line x1=\"495\" y1=\"45\" x2=\"400\" y2=\"105\"\/><line x1=\"495\" y1=\"125\" x2=\"404\" y2=\"125\"\/><line x1=\"495\" y1=\"205\" x2=\"400\" y2=\"145\"\/>\n <\/g>\n<\/g><\/svg>\n \n<\/div>\n\n <p>Administrative safeguards are the policies, procedures, and workforce controls that manage security. Physical safeguards protect facilities, devices, and media. Technical safeguards, access control, encryption, audit logging, and transmission security, protect ePHI in your systems. A gap in any category is a gap in compliance.<\/p>\n\n <h2 class=\"sec\" id=\"achieve\">How to achieve HIPAA compliance<\/h2>\n <p>Achieving compliance follows a logical sequence. It starts with a <a href=\"https:\/\/www.osto.one\/resources\/glossary\/risk-assessment\/\">risk analysis<\/a>, the foundational, most-scrutinised requirement, which identifies risks to your PHI. From there you implement safeguards to address those risks, document policies and procedures, sign BAAs with vendors, train your workforce, and collect the evidence that proves each control operates. The order matters: the risk analysis tells you what the rest of the program needs to be.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Start with the risk analysis<\/div>Every HIPAA program begins with a thorough, current risk analysis. It is the anchor requirement, the most common enforcement gap, and the thing that tells you which safeguards you actually need. Build from it outward.<\/div>\n\n <h2 class=\"sec\" id=\"maintain\">Staying compliant over time<\/h2>\n <p>Because compliance is a continuous state, the work does not end at implementation. You maintain it by keeping evidence current, reviewing and updating your risk analysis as you grow, monitoring controls, retraining your workforce, and keeping BAAs and policies up to date. HIPAA compliance that was real a year ago can lapse quietly if nothing maintains it, which is why continuous monitoring and evidence matter as much as the initial build.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to HIPAA compliance<\/h2>\n <p>Seen whole, HIPAA compliance is a lot of connected parts, rules, safeguards, evidence, and ongoing upkeep, and most of the technical load is repeatable work that a small team should not hand-assemble across disconnected tools. Consolidation is what makes the whole program achievable without a dedicated security function.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. The technical safeguards, access control, encryption, audit logging, and monitoring, run on one platform and produce evidence automatically, and built-in training and risk visibility round out the program, all mapped to HIPAA alongside 200+ other frameworks. A startup can achieve and maintain HIPAA compliance without a security team, which is why lean teams treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Achieve and maintain HIPAA compliance, end to end.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Put the safeguards, evidence, training, and monitoring of a full HIPAA program on one platform. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is HIPAA compliance?<\/summary><p>Meeting the US law that protects health information: following the Privacy, Security, and Breach Notification Rules, implementing <a href=\"https:\/\/www.osto.one\/resources\/glossary\/technical-safeguards\/\">administrative, physical, and technical safeguards<\/a> for PHI, and keeping evidence that it all works. It is an ongoing state, not a one-time certificate.<\/p><\/details>\n <details><summary>Who has to comply with HIPAA?<\/summary><p>Covered entities, healthcare providers, health plans, and clearinghouses, and their <a href=\"https:\/\/www.osto.one\/resources\/glossary\/business-associate\/\">business associates<\/a>, the vendors and partners that handle PHI on their behalf. Most healthtech and SaaS companies serving healthcare are business associates with direct obligations.<\/p><\/details>\n <details><summary>What are the main HIPAA rules?<\/summary><p>The Privacy Rule, governing how PHI is used and disclosed and patients’ rights; the Security Rule, requiring safeguards for electronic PHI; and the Breach Notification Rule, defining what to do when PHI is breached. Together they form the core of compliance.<\/p><\/details>\n <details><summary>How do you become HIPAA compliant?<\/summary><p>Start with a risk analysis, then implement safeguards to address the risks, document policies, sign BAAs with vendors, train your workforce, and collect evidence that each control operates. The risk analysis anchors and directs the rest of the program.<\/p><\/details>\n <details><summary>Is HIPAA compliance a one-time thing?<\/summary><p>No. It is a continuous state. You must maintain evidence, review your risk analysis, monitor controls, retrain staff, and keep BAAs and policies current. Compliance can lapse quietly if nothing maintains it, so ongoing monitoring is essential.<\/p><\/details>\n <details><summary>Is there a HIPAA certificate?<\/summary><p>No official HIPAA certification exists. Compliance is a state you maintain and can demonstrate through your controls and evidence, not a certificate issued by the government. Beware any claim to sell you an official HIPAA certification.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>HIPAA Compliance: The Complete Guide for Startups | Osto HIPAA compliance, explained end to end. What it is, who it\u2026<\/p>\n","protected":false},"author":8,"featured_media":911,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[111,388],"class_list":["post-910","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-hipaa","tag-hipaa-compliance-guide"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/910","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=910"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/910\/revisions"}],"predecessor-version":[{"id":912,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/910\/revisions\/912"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/911"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=910"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=910"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=910"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":910,"date":"2026-08-17T18:55:02","date_gmt":"2026-08-17T18:55:02","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=910"},"modified":"2026-08-17T18:55:02","modified_gmt":"2026-08-17T18:55:02","slug":"hipaa-compliance","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/hipaa-compliance\/","title":{"rendered":"HIPAA Compliance: The Complete Guide for Startups"},"content":{"rendered":"\n\n\n\n\n\nHIPAA Compliance: The Complete Guide for Startups | Osto<\/title>\n<meta name=\"description\" content=\"A complete guide to HIPAA compliance: who it covers, the Privacy, Security, and Breach Notification rules, the safeguards, and how to stay compliant.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">HIPAA compliance, explained end to end. What it is, who it applies to, the rules and safeguards it requires, and how a lean team actually achieves and maintains it. This is the overview that ties the whole picture together.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>10 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>HIPAA compliance means meeting the US law that protects health information: following the Privacy, Security, and Breach Notification Rules, implementing administrative, physical, and technical safeguards, and keeping evidence that it all works. It applies to covered entities and their business associates.<\/p>\n <p>It is not a one-time certificate but an ongoing program anchored by a risk analysis. For a lean team, the practical route is one platform that provides the controls and the evidence together, mapped to HIPAA.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#what\">What HIPAA compliance is<\/a><\/li>\n <li><a href=\"#who\">Who must comply<\/a><\/li>\n <li><a href=\"#rules\">The core rules<\/a><\/li>\n <li><a href=\"#safeguards\">The safeguards<\/a><\/li>\n <li><a href=\"#achieve\">How to achieve it<\/a><\/li>\n <li><a href=\"#maintain\">Staying compliant<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"what\">What HIPAA compliance is<\/h2>\n <p>HIPAA, the Health Insurance Portability and Accountability Act, is the US law that governs how protected health information is used and protected. Compliance means meeting its requirements: following its rules, putting safeguards in place around health data, and being able to demonstrate that you do. It applies to organisations that handle PHI and is enforced by the HHS Office for Civil Rights. Importantly, HIPAA compliance is a continuous state, not a certificate you earn once and file away.<\/p>\n\n <div style=\"background:linear-gradient(135deg,#0e1444,#1c267a 55%,#242f86);border-radius:20px;padding:34px 34px 30px;margin:30px 0;box-shadow:0 18px 50px rgba(14,20,68,.28);position:relative;overflow:hidden\">\n <div style=\"position:absolute;top:-50px;right:-40px;width:260px;height:260px;background:radial-gradient(circle,rgba(58,70,192,.45),transparent 68%);pointer-events:none\"><\/div>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#aeb6ee;margin-bottom:6px\">The whole picture<\/div>\n <div style=\"font-size:21px;font-weight:800;color:#fff;margin-bottom:24px;letter-spacing:-.01em\">What HIPAA compliance covers<\/div>\n <div style=\"display:grid;grid-template-columns:1fr 1fr 1fr ;gap:16px\"><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M12 4v16M7 20h10\"\/><path d=\"M12 6l-6 2 6-2 6 2-6-2z\"\/><path d=\"M6 8l-2.5 5a2.5 2.5 0 0 0 5 0L6 8z\"\/><path d=\"M18 8l-2.5 5a2.5 2.5 0 0 0 5 0L18 8z\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">The rules<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">Privacy, Security, and Breach Notification requirements.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M12 3l7 3v5c0 4.4-3 8.2-7 9-4-.8-7-4.6-7-9V6l7-3z\"\/><path d=\"M9 11.5l2 2 4-4\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">The safeguards<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">Administrative, physical, and technical protections for PHI.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M4 12a8 8 0 0 1 13.5-5.8L20 8\"\/><path d=\"M20 4v4h-4\"\/><path d=\"M20 12a8 8 0 0 1-13.5 5.8L4 16\"\/><path d=\"M4 20v-4h4\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">The practice<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">An ongoing program, not a one-time certification.<\/div>\n <\/div><\/div>\n<\/div>\n\n <h2 class=\"sec\" id=\"who\">Who must comply with HIPAA<\/h2>\n <p>HIPAA divides the world into two groups. Covered entities are healthcare providers, health plans, and healthcare clearinghouses, the organisations at the centre of care and payment. Business associates are the vendors and partners that handle PHI on a covered entity’s behalf, which includes most healthtech and SaaS companies serving healthcare. If you are either, HIPAA applies to you, and business associates carry direct compliance obligations, not just contractual ones.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">Most startups are business associates<\/div>If your company handles PHI for healthcare customers, you are almost certainly a business associate, which means HIPAA applies to you directly. You must meet its safeguards and sign a BAA with each covered-entity customer.<\/div>\n\n <h2 class=\"sec\" id=\"rules\">The core rules of HIPAA<\/h2>\n <p>HIPAA compliance is built on three central rules, each governing a different aspect of protecting health information.<\/p>\n\n <div class=\"otable\"><table class=\"regtable\">\n <tr><th>Rule<\/th><th>What it governs<\/th><\/tr>\n <tr><td><strong>Privacy Rule<\/strong><\/td><td>How PHI may be used and disclosed, and patients’ rights over it<\/td><\/tr>\n <tr><td><strong>Security Rule<\/strong><\/td><td>Safeguards for electronic PHI: administrative, physical, technical<\/td><\/tr>\n <tr><td><strong>Breach Notification Rule<\/strong><\/td><td>What to do and whom to notify when PHI is breached<\/td><\/tr>\n <\/table><\/div>\n\n <p>The <a href=\"https:\/\/www.osto.one\/resources\/glossary\/hipaa-privacy-rule\/\">Privacy Rule<\/a> sets the boundaries on using health data, the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/hipaa-security-rule\/\">Security Rule<\/a> mandates how electronic PHI must be protected, and the <a href=\"https:\/\/www.osto.one\/resources\/glossary\/hipaa-breach-notification-rule\/\">Breach Notification Rule<\/a> defines your obligations when something goes wrong. Together they form the backbone of compliance.<\/p>\n\n <h2 class=\"sec\" id=\"safeguards\">The safeguards HIPAA requires<\/h2>\n <p>The Security Rule organises its protections into three categories of safeguards, and a compliant program needs all three.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">The full scope<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">Everything HIPAA compliance includes<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">From who is covered to how you stay compliant over time, these are the pieces this guide connects.<\/div>\n <svg viewBox=\"0 0 700 250\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Overview map of what HIPAA compliance covers\">\n<g font-family=\"Inter,Arial,sans-serif\" text-anchor=\"middle\">\n <circle cx=\"350\" cy=\"125\" r=\"54\" fill=\"#1c267a\"\/>\n <text x=\"350\" y=\"120\" fill=\"#fff\" font-size=\"13\" font-weight=\"800\">HIPAA<\/text>\n <text x=\"350\" y=\"138\" fill=\"#c3c9ee\" font-size=\"10.5\">compliance<\/text>\n <g>\n <rect x=\"55\" y=\"24\" width=\"150\" height=\"42\" rx=\"11\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.3\"\/>\n <text x=\"130\" y=\"50\" fill=\"#2b3596\" font-size=\"11.5\" font-weight=\"700\">Who it covers<\/text>\n <rect x=\"55\" y=\"104\" width=\"150\" height=\"42\" rx=\"11\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.3\"\/>\n <text x=\"130\" y=\"130\" fill=\"#2b3596\" font-size=\"11.5\" font-weight=\"700\">The rules<\/text>\n <rect x=\"55\" y=\"184\" width=\"150\" height=\"42\" rx=\"11\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.3\"\/>\n <text x=\"130\" y=\"210\" fill=\"#2b3596\" font-size=\"11.5\" font-weight=\"700\">Safeguards<\/text>\n <rect x=\"495\" y=\"24\" width=\"150\" height=\"42\" rx=\"11\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.3\"\/>\n <text x=\"570\" y=\"50\" fill=\"#0a7d6c\" font-size=\"11.5\" font-weight=\"700\">Breaches<\/text>\n <rect x=\"495\" y=\"104\" width=\"150\" height=\"42\" rx=\"11\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.3\"\/>\n <text x=\"570\" y=\"130\" fill=\"#0a7d6c\" font-size=\"11.5\" font-weight=\"700\">Enforcement<\/text>\n <rect x=\"495\" y=\"184\" width=\"150\" height=\"42\" rx=\"11\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.3\"\/>\n <text x=\"570\" y=\"210\" fill=\"#0a7d6c\" font-size=\"11.5\" font-weight=\"700\">Staying compliant<\/text>\n <\/g>\n <g stroke=\"#c9cfee\" stroke-width=\"1.5\">\n <line x1=\"205\" y1=\"45\" x2=\"300\" y2=\"105\"\/><line x1=\"205\" y1=\"125\" x2=\"296\" y2=\"125\"\/><line x1=\"205\" y1=\"205\" x2=\"300\" y2=\"145\"\/>\n <line x1=\"495\" y1=\"45\" x2=\"400\" y2=\"105\"\/><line x1=\"495\" y1=\"125\" x2=\"404\" y2=\"125\"\/><line x1=\"495\" y1=\"205\" x2=\"400\" y2=\"145\"\/>\n <\/g>\n<\/g><\/svg>\n \n<\/div>\n\n <p>Administrative safeguards are the policies, procedures, and workforce controls that manage security. Physical safeguards protect facilities, devices, and media. Technical safeguards, access control, encryption, audit logging, and transmission security, protect ePHI in your systems. A gap in any category is a gap in compliance.<\/p>\n\n <h2 class=\"sec\" id=\"achieve\">How to achieve HIPAA compliance<\/h2>\n <p>Achieving compliance follows a logical sequence. It starts with a <a href=\"https:\/\/www.osto.one\/resources\/glossary\/risk-assessment\/\">risk analysis<\/a>, the foundational, most-scrutinised requirement, which identifies risks to your PHI. From there you implement safeguards to address those risks, document policies and procedures, sign BAAs with vendors, train your workforce, and collect the evidence that proves each control operates. The order matters: the risk analysis tells you what the rest of the program needs to be.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Start with the risk analysis<\/div>Every HIPAA program begins with a thorough, current risk analysis. It is the anchor requirement, the most common enforcement gap, and the thing that tells you which safeguards you actually need. Build from it outward.<\/div>\n\n <h2 class=\"sec\" id=\"maintain\">Staying compliant over time<\/h2>\n <p>Because compliance is a continuous state, the work does not end at implementation. You maintain it by keeping evidence current, reviewing and updating your risk analysis as you grow, monitoring controls, retraining your workforce, and keeping BAAs and policies up to date. HIPAA compliance that was real a year ago can lapse quietly if nothing maintains it, which is why continuous monitoring and evidence matter as much as the initial build.<\/p>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to HIPAA compliance<\/h2>\n <p>Seen whole, HIPAA compliance is a lot of connected parts, rules, safeguards, evidence, and ongoing upkeep, and most of the technical load is repeatable work that a small team should not hand-assemble across disconnected tools. Consolidation is what makes the whole program achievable without a dedicated security function.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. The technical safeguards, access control, encryption, audit logging, and monitoring, run on one platform and produce evidence automatically, and built-in training and risk visibility round out the program, all mapped to HIPAA alongside 200+ other frameworks. A startup can achieve and maintain HIPAA compliance without a security team, which is why lean teams treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Achieve and maintain HIPAA compliance, end to end.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Put the safeguards, evidence, training, and monitoring of a full HIPAA program on one platform. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is HIPAA compliance?<\/summary><p>Meeting the US law that protects health information: following the Privacy, Security, and Breach Notification Rules, implementing <a href=\"https:\/\/www.osto.one\/resources\/glossary\/technical-safeguards\/\">administrative, physical, and technical safeguards<\/a> for PHI, and keeping evidence that it all works. It is an ongoing state, not a one-time certificate.<\/p><\/details>\n <details><summary>Who has to comply with HIPAA?<\/summary><p>Covered entities, healthcare providers, health plans, and clearinghouses, and their <a href=\"https:\/\/www.osto.one\/resources\/glossary\/business-associate\/\">business associates<\/a>, the vendors and partners that handle PHI on their behalf. Most healthtech and SaaS companies serving healthcare are business associates with direct obligations.<\/p><\/details>\n <details><summary>What are the main HIPAA rules?<\/summary><p>The Privacy Rule, governing how PHI is used and disclosed and patients’ rights; the Security Rule, requiring safeguards for electronic PHI; and the Breach Notification Rule, defining what to do when PHI is breached. Together they form the core of compliance.<\/p><\/details>\n <details><summary>How do you become HIPAA compliant?<\/summary><p>Start with a risk analysis, then implement safeguards to address the risks, document policies, sign BAAs with vendors, train your workforce, and collect evidence that each control operates. The risk analysis anchors and directs the rest of the program.<\/p><\/details>\n <details><summary>Is HIPAA compliance a one-time thing?<\/summary><p>No. It is a continuous state. You must maintain evidence, review your risk analysis, monitor controls, retrain staff, and keep BAAs and policies current. Compliance can lapse quietly if nothing maintains it, so ongoing monitoring is essential.<\/p><\/details>\n <details><summary>Is there a HIPAA certificate?<\/summary><p>No official HIPAA certification exists. Compliance is a state you maintain and can demonstrate through your controls and evidence, not a certificate issued by the government. Beware any claim to sell you an official HIPAA certification.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>HIPAA Compliance: The Complete Guide for Startups | Osto HIPAA compliance, explained end to end. What it is, who it\u2026<\/p>\n","protected":false},"author":8,"featured_media":911,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[111,388],"class_list":["post-910","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-hipaa","tag-hipaa-compliance-guide"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/910","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=910"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/910\/revisions"}],"predecessor-version":[{"id":912,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/910\/revisions\/912"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/911"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=910"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=910"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=910"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}