United States · Healthtech companies
HIPAA for US Healthtech Companies: What Health Systems and Payers Require
What US health systems and payers require from healthtech vendors under HIPAA: risk analysis, safeguards, BAAs and an independent HIPAA assessment.
Did you know HIPAA compliance consulting and an independent HIPAA assessment can cost less than US$10,000, all-inclusive? If you've been quoted more, talk to us before you sign.
100% success, on time: the Sterling Promise
We stay with you until your agreed outcome is achieved, through consulting, audit preparation and the resolution of audit findings. The engagement defines the standard, scope, outcome and responsibilities; your organization puts the agreed controls into use; an independent assessor reviews your HIPAA program, and that decision stays independent.
Done for you, end to end
We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.
Simple and quick
A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.
8,100+ client engagements
In 60+ countries over 20+ years, with experts who bring 30+ years of experience.
Under US$10,000, all-inclusive
For most start-ups and SMEs: SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001, including the independent audit. A fixed quote follows a free gap assessment.
Included in every engagement
Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:
- Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
- Sterling Academy: preferential course access, with complimentary awareness training for your people.
- Internal auditor training for your audit team, as applicable to your standard.
- For information-security engagements, a vulnerability assessment.
These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.
Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.
Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.
All-inclusive pricing for start-ups and SMEs
Did you know SOC 2 or ISO 27001 can cost less than US$10,000, all-inclusive? If you've been quoted more, talk to us before you sign.
Sterling's all-inclusive fee for SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001 is under US$10,000 for most start-ups and SMEs. It covers our done-for-you consulting and the independent audit: the SOC 2 report from a US-licensed CPA firm, as AICPA standards require, or the certification audit by an accredited certification body. For HIPAA, it covers HIPAA compliance consulting and an independent HIPAA assessment. Effivity, training and a vulnerability assessment are included. That's less than a month's cost of an in-house security hire: the US Bureau of Labor Statistics puts the national median annual wage for information security analysts at $129,180 (May 2025), about $10,765 a month in pay alone[1].
A fixed quote follows a free gap assessment.
What the fee covers, and what it doesn't:
- It is the fee for your first SOC 2 report or your first certification only.
- Annual work is always additional and billed the following year: later SOC 2 report periods, and ISO surveillance and recertification audits.
- It assumes a typical start-up or SME scope: one product or service and one main location.
- Larger or multi-site scopes get a fixed quote after the gap assessment.
- PCI DSS is quoted separately: a fixed quote follows a free gap assessment.
[1] Occupational Employment and Wage Statistics, May 2025: 15-1212 Information Security Analysts, national annual median wage. US Bureau of Labor Statistics. accessed October 23, 2026.
Why US health systems and payers ask healthtech vendors for HIPAA evidence
The outcome: a documented, independently assessed HIPAA program that a US hospital, clinic group or health plan can accept in one review, so the contract moves instead of stalling in compliance. We do the heavy lifting; your engineers stay on the product.
US healthtech companies rarely meet HIPAA in a statute. They meet it in a procurement email. Three US situations bring it up.
- US covered entities sending you patient data. A provider or plan that lets your product create, receive, maintain or transmit electronic protected health information needs a business associate agreement with you, and then wants proof behind it.
- US enterprise security reviews. In Sterling's experience, health-system vendor questionnaires go straight to risk analysis, access logs, encryption and incident handling.
- US investors and acquirers. In Sterling's experience, diligence on a digital-health company asks how patient data is protected and who signed for it.
What the US HIPAA Security Rule requires of business associates
The outcome: you know exactly which federal text applies to you and have the evidence mapped to it.
- Direct duty. Under 45 CFR 164.306, covered entities and business associates must ensure the confidentiality, integrity and availability of all electronic protected health information they create, receive, maintain or transmit, and protect against reasonably anticipated threats[1]. A healthtech vendor on the business associate side carries that duty itself, not only through contracts.
- Flexible by design. The rule lets you choose reasonable and appropriate measures, weighing your size, complexity, infrastructure, cost and the likelihood and criticality of risks[1]. That is why US reviewers ask to see your reasoning, not a checklist.
- Addressable is not optional. Where a specification is addressable, you assess it, adopt it if reasonable and appropriate, or document why not and use an equivalent alternative where reasonable[3].
- Six-year records. Policies and records of required actions are kept for six years from creation or the date last in effect, whichever is later[6].
Where patient data sits in a US healthtech stack
The outcome: a scope that matches what you told your US customers, and an assessed environment no larger than it needs to be.
- Product. The production app, databases, cloud accounts and managed services behind them.
- Interfaces. EHR integrations, FHIR or HL7 feeds, wearable and device data, claims files, patient apps and portals.
- Support tools. Ticketing, screen sharing, logs and error trackers that catch patient data by accident.
- Copies. Backups, recovery sites and staging environments seeded from real records.
- Vendors. Any downstream vendor handling the data may do so only after you obtain satisfactory assurances, documented in a written contract or other arrangement[2].
We also settle your role. A company selling software to US providers while running its own clinic can be both a business associate and a covered entity.
The safeguards US health-system reviewers check first
The outcome: each question in a US hospital's questionnaire points to a record that already exists.
1. Risk analysis and risk management. An accurate and thorough assessment of risks to patient data, and measures that reduce them to a reasonable and appropriate level[4]. 2. A named security official. One person responsible for the policies and procedures[4]. 3. Access control. Unique user identification and an emergency access procedure are required[5]; termination procedures cover leavers[4]. 4. Audit controls and log review. Mechanisms that record activity[5] and a schedule for reviewing it[4]. 5. Encryption. At rest and in transit, both addressable specifications[5], documented where and how. 6. Training, incidents and contingency. Workforce awareness, incident procedures, and backup, disaster recovery and emergency-mode plans[4].
| Question a US reviewer asks | Where it comes from | What we prepare |
|---|---|---|
| Have you assessed risks to patient data? | Risk analysis and risk management[4] | Dated risk analysis tied to real systems, with decisions recorded |
| Who is accountable for security? | Assigned security responsibility[4] | Named security official and written role description |
| Can you show who accessed what? | Audit controls and activity review[4][5] | Log sources, review schedule and signed review records |
| Do your downstream vendors protect the data? | Business associate contracts[2] | Vendor register, agreements and review dates |
| Can you recover? | Contingency plan[4] | Backup, recovery and emergency-mode plans with a test record |
Business associate agreements with US covered entities
The outcome: every clause you sign with a US provider or plan has a working process behind it.
The agreement must provide that you comply with the applicable Security Rule requirements, bind your own downstream vendors to the same, and report security incidents you become aware of, including breaches of unsecured protected health information[2].
- Customer agreements. We check each one's incident-reporting terms against your real process.
- Vendor agreements. Every cloud, analytics, messaging or support tool that holds patient data needs one.
We do not give legal advice; we flag mismatches for your counsel.
Where US healthtech teams lose time
The outcome: we clear these before any reviewer sees them.
- Template binders. Policies describing a company that does not exist.
- A one-off risk analysis. The rule requires measures to be reviewed and updated as your environment changes[1].
- Unlisted data. Error trackers, spreadsheets, chat channels and support attachments.
- Vendors without agreements. The gap we find most often.
- Overclaiming. Describe it accurately: safeguards you operate and an independent assessment of the result.
How we take US healthtech companies to a successful HIPAA assessment
The outcome: a successful, on-time result with the work done for you. Sterling's record is 100% success and on-time completion across 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience. The people who consult never assess you.
1. Free gap assessment. We map where patient data lives, review your agreements and safeguards, and propose a scope. 2. Risk analysis and design. We run the risk analysis with your engineers and write policies, procedures and the reasoning for each addressable specification. 3. Evidence. Your team operates the safeguards; Effivity, our GRC automation platform, holds the register and evidence trail. 4. Internal audit and management review. We test first and fix findings. 5. Independent HIPAA assessment. An independent assessor evaluates your safeguards and issues a written assessment you can share. You deal with Sterling throughout.
To move your next US health-system deal forward, choose Get a proposal and a Sterling expert will respond.
Sources
1. 45 CFR 164.306 Security standards: General rules. Electronic Code of Federal Regulations (HHS HIPAA Security Rule). accessed October 23, 2026.
2. 45 CFR 164.314 Organizational requirements. Electronic Code of Federal Regulations (HHS HIPAA Security Rule). accessed October 23, 2026.
3. 45 CFR 164.306 (d) Implementation specifications, required and addressable. Electronic Code of Federal Regulations (HHS HIPAA Security Rule). accessed October 23, 2026.
4. 45 CFR 164.308 Administrative safeguards. Electronic Code of Federal Regulations (HHS HIPAA Security Rule). accessed October 23, 2026.
5. 45 CFR 164.312 Technical safeguards. Electronic Code of Federal Regulations (HHS HIPAA Security Rule). accessed October 23, 2026.
6. 45 CFR 164.316 Policies and procedures and documentation requirements. Electronic Code of Federal Regulations (HHS HIPAA Security Rule). accessed October 23, 2026.
Information only
The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.
Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.
Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.
Standards and marks named on this site belong to their respective owners.
FAQs
Frequently asked questions
Is HIPAA compliance required for a healthtech start-up?
It depends on your role. The Security Rule applies to covered entities and business associates handling electronic protected health information[1]. If your product creates, receives, maintains or transmits that information for a provider or plan, you are in scope. If you only handle consumer data with no covered entity involved, a different rulebook may apply. We settle this in the gap assessment.
Is there a government HIPAA seal for our product?
No such seal appears in the rule text. The Security Rule sets standards and specifications that you apply, with flexibility of approach[1]. What you can show a US customer is an independent assessment of your safeguards, together with your risk analysis and records. We describe our work as HIPAA compliance consulting and an independent HIPAA assessment, never as a status someone grants.
What is a business associate agreement and who needs one?
It is the contract that records a vendor's commitment to protect electronic protected health information. It must provide that the business associate complies with the Security Rule, makes its downstream vendors agree to the same, and reports security incidents including breaches of unsecured protected health information[2]. You need one with customers who are covered entities, and with your own vendors that handle the data.
What does 'addressable' mean in the HIPAA Security Rule?
It means you must assess whether the specification is reasonable and appropriate for you. If it is, you adopt it. If not, you document why and put an equivalent alternative in place where reasonable[3]. Addressable does not mean you can skip it without explanation. US reviewers read these decisions closely, so we write the reasoning for each one and keep it with your risk analysis.
How long must HIPAA documentation be kept?
The documentation standard requires written policies and procedures and written records of required actions and assessments, retained for six years from the date of creation or the date it last was in effect, whichever is later[6]. We build that retention into your evidence process so records are not lost when tools change.
Is SOC 2 enough for a US healthcare customer?
Often not on its own. A SOC 2 report examines controls against the AICPA Trust Services Criteria, while HIPAA is a federal legal framework with its own specifications and contract duties[1][2]. Many US healthtech companies hold both and map one control set to each. Our guide to HIPAA versus SOC 2 sets out the overlap and where the evidence can be shared.
How is the independent HIPAA assessment kept separate from your consulting?
Consulting and auditing are always separated: the people who consult never assess you. The independent assessor evaluates the safeguards you operate and writes up the result. Sterling coordinates the process end to end, so you deal with one team, but the assessment itself stays independent of the people who built your controls.
What is included when we work with Sterling?
Every engagement includes a full-year subscription to Effivity, our GRC automation platform; preferential Sterling Academy course access, with complimentary awareness training for your people; and internal auditor training for your audit team, as applicable to your standard. For information-security engagements we add a vulnerability assessment.
Keep exploring
More in Compliance for Healthtech companies in the US
Compliance for Healthtech companies in the US
Free gap assessment
Start with a free gap assessment
Not sure where you stand? Start with a free gap assessment. In one conversation, a Sterling consultant looks at what your customers, investors or contracts are asking for, compares it with what you have in place today, and tells you what is missing, in what order to fix it and how long it is likely to take.
usa@sterling-grc.com+1 201 263 4443 (global headquarters) · A Sterling consultant replies within one working day
What would you like to achieve?
Choose a starting point. The enquiry form asks for your name, work email, phone with country code and company.
Book my free gap assessmentContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice