1. ePHI inventory + data flow diagram. Where PHI enters, where it lives, where it leaves. This is the foundation. If you can't show it to OCR in 24 hours, nothing else matters. Two days of work.

2. Sign BAAs with every vendor touching PHI. Likely list: AWS (have it), Twilio (need it), SendGrid (need it), any analytics vendor, any LLM provider (OpenAI has one), your error monitoring (Sentry — they have one). One missing BAA = HIPAA violation regardless of how good your other controls are.

3. Workforce training + access agreements. Every employee, contractor, and intern signs an access agreement + completes HIPAA training before getting any access to systems that touch PHI. Annual refresher. Document the dates.

4. Minimum Necessary policy. Written policy that says 'workforce members only access the PHI necessary for their job function.' Then enforce via role-based access on your DB, not just app-level.

5. Audit logging on PHI access. Who looked at what patient record when. Logs retained 6 years (HIPAA requirement). CloudTrail for AWS + app-level audit log for PHI reads.

6. Encryption at rest + in transit. TLS 1.2+ everywhere, encrypted EBS/RDS, KMS-managed keys, no client-side storage of PHI without explicit encryption.

7. Risk assessment (annual + when anything material changes). This is the one OCR will ask for first. Use NIST 800-66 Rev 2 as the framework. Document it. Don't skip it.

8. Incident response runbook. What happens in the first 60 minutes of a suspected breach. Who calls who, who decides if it's a breach, who notifies. Tabletop exercise once a year.

9. BAA chain audit. Your BAA with AWS isn't enough — you need BAAs (or attestation) from any vendor AWS uses for PHI processing. Most are fine; document it.

10. Right-of-access + amendment workflows. Patients can demand their PHI in 30 days and request amendments. Have the workflow built before someone asks. Most healthtech ignores this until they get a complaint.

What's NOT a HIPAA priority (skip for now):

SOC 2 (it overlaps but isn't HIPAA — do it later)
HITRUST (enterprise customers may want it eventually, not pre-GA)
State-specific laws (CCPA, NY SHIELD) — relevant but distinct

Want me to draft #1 (data flow diagram) first?

✦ grounded in your files + site · memory on · 200M proxies + 4,000 tools

Pairs well with

HIPAA works best alongside these 3.

Legal & Compliance Expert NDAs, NOCs, contracts, compliance notices — drafted to be signed, not negotiated for weeks. Operations Expert SOPs, vendor mgmt, procurement, RFPs, change management — the office's quiet engine. Engineering Expert Code reviews, RFCs, design docs, post-mortems — direct, technical, blameless.

Put HIPAA on your team.

Plus 18 other experts. One subscription. No setup.

Start free →