Is your product HIPAA-aware?
Fifteen questions across the seven areas a hospital security review, a covered entity or an investor’s technical diligence will check. Answer honestly, get a score and see which category is weakest. This is not legal advice or a certification.
Your score
Check the boxes that are true
Leave a box unchecked if you’re not sure. An unverified safeguard behaves like a missing one in a real review.
This checklist is not
- A legal opinion, a certification, or a substitute for counsel
- A full reading of the HIPAA Security Rule’s implementation specifications
- Aware of your state’s additional health-privacy laws
- Relevant if you never create, receive, maintain or transmit PHI
US-relevant only: HIPAA is US federal law. If you operate in the UK, EU or Canada, different rules apply (GDPR, UK GDPR and PIPEDA among them), and this checklist does not score against any of those.
What the score is built from
Four safeguard areas every security review covers
The checklist covers seven categories; these four are where we see the most expensive gaps in practice.
Data inventory & vendor map
Every other safeguard depends on knowing where PHI enters, lives and leaves your system, and which third parties ever touch it.
Encryption & access control
At rest, in transit, and behind roles that can be revoked individually without breaking anyone else's access. The mechanics are well understood; the gap is usually in coverage, not technique.
Audit logging
Who read or wrote a PHI record, and when, retained for years and hard to tamper with. Without it, you end up guessing at a security review's questions.
Breach response
A written plan is the minimum. Few teams have rehearsed theirs even once, and rehearsal is what counts in the first hour of an incident.
Methodology
What the score covers and what it doesn’t
Each of the fifteen questions maps to one of seven categories, and each category mirrors a section of how we build HIPAA-aware systems: data inventory, vendor agreements and tracking SDKs, encryption, access control and identity, audit logging, breach response, and segregation of the regulated core. The score is simply the share of checked boxes, and the weakest-categories panel is sorted by the same arithmetic, with no hidden weighting toward any answer.
It does not interpret the HIPAA Security Rule’s implementation specifications, which run to dozens of addressable and required items with their own legal interpretation. It is a practical proxy for what a security questionnaire, a hospital’s vendor-risk team or a technical due-diligence pass asks about first, since that is the review your product will face.
We build HIPAA-aware, compliance-conscious systems. We do not issue certifications or legal sign-off.
If your score is low and you have not yet shipped to patients, fix it now, while it is cheapest. Retrofitting audit logging and access control onto a live system holding PHI is a harder and more expensive project than designing them in before the schema exists.
FAQ
HIPAA compliance checklist questions
Is a 100% score the same as being HIPAA compliant?
No. This checklist scores the safeguards a buyer, hospital security team or investor's technical diligence checks for in practice. It does not cover the full text of the HIPAA Security Rule's implementation specifications, and it cannot give you a legal opinion or a certification. HIPAA has no official certification. A perfect score means you cover what we check for on every HIPAA-aware build, which is a strong starting point.
Why does this only apply in the US?
Because HIPAA is US federal law. If you operate in the UK, EU or Canada, the safeguards that matter are broadly similar in spirit (encryption, access control, audit logging, breach response), but the legal framework is different: GDPR and the UK GDPR outside the US, PIPEDA in Canada. This checklist scores against HIPAA specifically and shouldn't be read as coverage for those regimes.
What's the most common gap you see?
Analytics and crash-reporting SDKs receiving PHI in event payloads without anyone noticing. A field name like `patient_name` or a raw error message containing a diagnosis gets logged straight into Firebase, Sentry or Mixpanel, none of which have signed a BAA, and nobody catches it because the SDK is doing what it was told to do. It's in the vendor-agreements category on this checklist for that reason.
We're pre-revenue and don't have PHI yet. Should we still care?
Yes, if your product will eventually create, receive, maintain or transmit PHI. The cheapest time to build in these safeguards is while you design the data model, well before a hospital security questionnaire lands on your desk.
What happens after I see my score?
The weakest-categories panel shows which of the seven areas need work, and each one maps to a section of how we build HIPAA-aware systems. If you want a second opinion or a plan to close the gaps, talk it through with us.
Next steps
Closing the gaps
Work with us
Send us your weakest categories
We'll reply, usually within a business day, with what a HIPAA-aware version one would need to include, plus a fixed price and a date.