HIPAA Security Rule for US Health-Tech Start-ups

• Done for you, end to end

  We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.

• Simple and quick

  A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.

• 8,100+ client engagements

  In 60+ countries over 20+ years, with experts who bring 30+ years of experience.

• Under US$10,000, all-inclusive

  For most start-ups and SMEs: SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001, including the independent audit. A fixed quote follows a free gap assessment.

Quick, done for you, and backed by a 100% success and on-time completion record. We run the free gap assessment against Subpart C, write the risk analysis, policies and procedures around your stack, set up the evidence, and run the internal evaluation while your engineers keep shipping. The independent HIPAA assessment is performed by people with no part in the consulting, so those who consult never assess you. You deal with Sterling throughout: 8,100+ client engagements in 60+ countries over 20+ years, with experts bringing 30+ years of experience.

Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:

• Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
• Sterling Academy: preferential course access, with complimentary awareness training for your people.
• Internal auditor training for your audit team, as applicable to your standard.
• For information-security engagements, a vulnerability assessment.

These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.

Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.

Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.

What the fee covers, and what it doesn't:

• It is the fee for your first SOC 2 report or your first certification only.
• Annual work is always additional and billed the following year: later SOC 2 report periods, and ISO surveillance and recertification audits.
• It assumes a typical start-up or SME scope: one product or service and one main location.
• Larger or multi-site scopes get a fixed quote after the gap assessment.
• PCI DSS is quoted separately: a fixed quote follows a free gap assessment.

^[1] Occupational Employment and Wage Statistics, May 2025: 15-1212 Information Security Analysts, national annual median wage. US Bureau of Labor Statistics. accessed October 23, 2026.

The outcome. Within weeks you know whether the rule reaches you, and you meet a US health-system security review with the evidence it expects.

US hospitals, clinics and health plans sit under the rule as covered entities: a health plan, a health care clearinghouse, or a provider that transmits health information electronically in connection with a covered transaction^[2]. Most start-ups are not covered entities, but many are business associates. That term covers anyone who, on behalf of a covered entity, creates, receives, maintains or transmits protected health information, or provides services such as consulting, management or data aggregation that involve disclosing it^[2]. It also reaches a downstream vendor working on behalf of a business associate^[2].

Subpart C then says a covered entity or business associate must comply with its standards and requirements for electronic protected health information^[1].

• You are likely in scope if your product stores, processes or passes along patient data for a US provider, plan or another business associate.
• You may not be if your app serves consumers directly and not on behalf of a covered entity. That is a legal question; confirm it with counsel.

The outcome. Your team knows where it has room to scale and where it has none, so effort goes where a US reviewer will look.

The rule is built from standards. Sections 164.308, 164.310 and 164.312 set administrative, physical and technical safeguards; 164.314 covers business associate contracts; 164.316 covers policies and documentation^[1]. Section 164.306 sets four goals: confidentiality, integrity and availability of electronic protected health information, protection against reasonably anticipated threats and impermissible uses, and workforce compliance^[1].

• Flexible by size. Section 164.306(b) lets you choose measures that reasonably and appropriately meet the standards, weighing your size and capabilities, technical infrastructure, cost, and the probability and criticality of risks^[1]. You must be able to explain each choice.
• Required versus addressable. Each standard carries specifications marked required or addressable^[1]. Required ones must be met. For an addressable one you assess whether it is reasonable and appropriate, then put it in place, or document why not and adopt an equivalent alternative where reasonable and appropriate^[1]. Addressable never means optional.

Standards and the required or addressable labels come from the rule text^[1]; the right-hand column is Sterling's reading for a software company.

These patterns come from Sterling's consulting work, not from statistics. Each one can be fixed before your next review.

• A stale risk analysis. The rule requires an accurate and thorough assessment of potential risks and vulnerabilities to electronic protected health information^[1]. Reviewers want a dated analysis that matches your real architecture.
• Encryption treated as yes or no. Encryption is addressable under both access control and transmission security^[1]. Assess it and record the decision; for a cloud product holding patient data, the usual conclusion is to encrypt.
• Untracked business associate agreements. The rule requires written assurances, and a business associate must obtain the same from its own vendors that handle the data^[1]. Analytics, logging and support tools are often missed.
• Unclear incident reporting. The contract must require the business associate to report security incidents it becomes aware of, including breaches of unsecured protected health information^[1]. Breach notice to the covered entity must come without unreasonable delay and no later than 60 calendar days after discovery^[3]; follow your contract where it is stricter.
• Training and sanctions on paper only. The rule requires a training program and sanctions for workforce members who fail to comply^[1]. Keep completion records.
• Documentation drift. Policies must be reviewed periodically and updated when operations or the environment change^[1].

The outcome. You describe your status in words a US procurement or legal team accepts, with no badge language that backfires.

Subpart C sets duties; it does not provide for a report or seal from an outside examiner^[1]. Sterling therefore offers HIPAA compliance consulting and an independent HIPAA assessment: we help you meet the standards, then a separate team tests your position against the rule text and reports on it. Present the result as a dated, independent assessment, never as a government approval.

An assessment does not replace a SOC 2 report, and many US enterprise health buyers want both. Our HIPAA vs SOC 2 guide explains when you need each; the HIPAA hub covers the rule itself.

The outcome. A dated plan your sales team can share with a US hospital or plan. In Sterling's planning view, for one product and a small team: 1. Month 1. Confirm your role with counsel, map where patient data enters, lives and leaves, and name the security official. 2. Months 1–2. Complete the risk analysis and risk management plan; most other decisions follow from them. 3. Months 2–4. Write the policies, set up access control, logging and backups, record encryption decisions, and sign business associate agreements, including with your own vendors. 4. Months 3–5. Train the workforce, run an incident exercise and test a restore. 5. Months 5–6. Run the internal evaluation, close findings and complete the independent HIPAA assessment.

After that, review at least yearly and whenever systems or vendors change. The pace depends on scope and on what already exists.

This is Sterling's recommendation, not an instruction from HHS or any regulator, and not legal advice. 1. Settle your business associate status with counsel first. 2. Do the risk analysis before writing policies, so policies describe controls you actually run. 3. Treat every addressable specification as a decision to document. 4. Keep one inventory of vendors that touch patient data, with agreement status beside each. 5. Add SOC 2 when US enterprise health customers ask for a report alongside HIPAA evidence. 6. Start before your first large health-system deal reaches security review.

Get started now, and walk into that review with the evidence already in hand.

• HIPAA: standard overviewStandard overview
• SOC 2: standard overviewStandard overview
• ISO/IEC 27001: standard overviewStandard overview
• Clear US Enterprise Security Reviews and Questionnaires FastUnited States
• Meet US Contract, MSA and RFP Compliance Clauses FastUnited States
• HIPAA vs SOC 2: What US Health-Tech Start-ups NeedUnited States
• How US Start-ups Answer Security Questionnaires FastUnited States
• SOC 2 for Series A: What Founders Need and WhenUnited States
• HIPAA for US Healthtech Companies: What Health Systems and Payers RequireUnited States
• Sterling in the United StatesUnited States

1. 45 CFR Part 164, Subpart C, Security Standards for the Protection of Electronic Protected Health Information (sections 164.302 to 164.318). eCFR (US National Archives and Records Administration / GPO). accessed October 23, 2026.

2. 45 CFR 160.103, Definitions (business associate, covered entity, electronic protected health information). eCFR. accessed October 23, 2026.

3. 45 CFR 164.410, Notification by a business associate. eCFR. accessed October 23, 2026.

The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.

Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.

Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.

Standards and marks named on this site belong to their respective owners.