HIPAA-readiness sprint for a healthtech MVP

Educational only — not legal or compliance advice. HIPAA requirements vary by entity type (covered entity vs business associate), state, and use case. Confirm everything with a HIPAA-experienced attorney before signing your first BAA.

A healthtech MVP that handles Protected Health Information (PHI) needs HIPAA-readiness before the first paying customer signs a Business Associate Agreement (BAA). The honest version of "HIPAA-ready" at MVP stage is: you've done the foundational work, you can credibly answer the questionnaire, and you have a defensible posture if audited. It's not "fully compliant in perpetuity" — that's an ongoing operational thing, not a sprint thing.

The 8-week sprint that gets you there:

Week 1-2 — Scoping and infrastructure

What: Define what PHI you actually touch. Map every system that stores, transmits, or processes it. Identify your role (covered entity vs business associate; most healthtech startups are business associates).

Output: A one-page system inventory listing every data store, every API, every third-party that touches PHI.

Infrastructure decisions:

• Hosting: AWS, Azure, GCP — all offer HIPAA-eligible services with a signed BAA at the hosting layer. Sign their BAA early.
• Database: Postgres-on-RDS, Aurora, or Supabase Enterprise (which has a HIPAA add-on). Avoid hosting your own PHI database on a tier without infrastructure-level BAA coverage.
• Email: Resend, Postmark, and SendGrid have HIPAA-eligible tiers — but they're paid tiers requiring a separate BAA. Don't send PHI via the free tier of any of these.

Spend: ~$0-500 this stage. Mostly infrastructure-account setup.

Week 3-4 — Policies and procedures

What: Write the HIPAA-required policies. The Security Rule mandates ~20 policies; the Privacy Rule another ~10. Most are short documents (2-5 pages each).

Required policies include:

• Risk assessment and management
• Workforce security training and access management
• Information access management
• Security incident procedures
• Contingency plan (backup, disaster recovery, emergency mode)
• Workstation security
• Device and media controls
• Audit controls
• Person or entity authentication
• Transmission security
• Privacy notice and minimum necessary

Output: A policy library, version-controlled (Notion or a GRC platform like Vanta / Drata work). Each policy reviewed and signed off by founder + technical lead.

Spend: ~$2-5k if using GRC platform templates as a starting point and customising. ~$10-20k if drafted from scratch with a HIPAA attorney.

Week 5 — Technical controls

What: Implement the technical safeguards mandated by the Security Rule.

• Encryption at rest: AES-256 on all data stores. Mandatory.
• Encryption in transit: TLS 1.2+ everywhere. Mandatory.
• Access controls: MFA mandatory for all staff. Role-based access to PHI; principle of least privilege.
• Audit logging: every read / write / delete of PHI gets logged with user, timestamp, action. Logs retained 6+ years.
• Session management: automatic logout after inactivity. Failed-login lockout.
• Backup and disaster recovery: documented RPO/RTO targets, tested at least annually.

Output: A technical-controls audit checklist showing each mandate is implemented and tested.

Spend: mostly engineering hours — budget 80-120 hours of senior engineering time.

Week 6 — Workforce training and access management

What: Every employee with potential PHI access takes HIPAA training before being granted access. Document training completion. Implement a starter / joiner / leaver process so access is granted on hire and revoked on termination.

Output:

• Training records for all employees.
• An access-management process document.
• A reviewed-quarterly list of who has PHI access and why.

Spend: $50-200 per employee for HIPAA training (services like HIPAA Secure Now, Compliancy Group offer it).

Week 7 — Risk assessment

What: Conduct a formal HIPAA Risk Assessment. This is the Security Rule's keystone requirement — it's the document that proves you've identified your risks and have a plan to mitigate them.

Output: A documented risk assessment covering:

• Inventory of PHI assets and locations
• Threats and vulnerabilities to each
• Likelihood and impact assessment for each threat
• Existing safeguards
• Risk mitigation plan with timelines

Spend: $3-8k if done with a HIPAA consultant. Doable in-house at the MVP stage with a good template, but a consultant review adds defensibility.

Week 8 — BAA framework and customer-facing materials

What: Prepare your BAA template (the agreement you'll sign with covered-entity customers) and your customer-facing security posture document.

Output:

• A BAA template, reviewed by your HIPAA attorney. The HHS sample BAA is a starting point; you'll need it customised.
• A "Security & Compliance" page on your website or a dedicated PDF that prospects can review. Covers your HIPAA posture, technical safeguards, breach-notification commitment, and audit availability.

Spend: $2-5k for attorney review of the BAA template.

Total spend for the 8-week sprint

• Engineering time: 80-120 hours (already in headcount).
• Outside costs: ~$10-25k all-in (legal + consulting + training + GRC platform).

What you still don't have after the sprint

• SOC 2 Type II audit (different framework; takes 6-12 months observation).
• HITRUST certification (much heavier; only required by certain large payer/provider customers).
• Active monitoring of compliance posture (ongoing, not sprint-able).
• Incident-response track record (only built through actual operation).

What this gets you

• The ability to credibly sign your first BAA.
• A defensible audit posture if the OCR (Office for Civil Rights) ever investigates.
• A foundation for SOC 2 Type I, which you'll add when an enterprise customer demands it.
• The ability to answer security questionnaires from prospects with concrete, documented answers.

What to do today

If you haven't done this sprint yet:

1. Decide if you're a covered entity or business associate. Mostly: if you're selling software to providers/payers/clearinghouses, you're a BA.
2. Engage a HIPAA-experienced attorney now (not after you have a customer asking). The first hour is usually free; the relationship matters.
3. Pick a GRC platform if budget allows. They accelerate the documentation work materially.
4. Schedule the 8-week sprint as protected time. It will not happen in the cracks between feature work; it needs a focused engineering and legal cycle.