Find the PHI
Where PHI enters, is stored and is shared, including subcontractors, to set the scope of the risk analysis.
// HIPAA · SECURITY, PRIVACY AND BREACH RULESHandle US health data
Handle US health data
the way HIPAA expects.
For software and service companies that handle protected health information for US healthcare customers: we run the Security Rule risk analysis, put the safeguards in place, sort out Business Associate Agreements and get you ready to answer a hospital’s security review.
Security RulePrivacy RuleBreach Notification RuleBusiness associates
3Rules: Security, Privacy and Breach Notification
3Safeguard types: administrative, physical, technical
54HIPAA controls tracked in the Bitkosh Readiness Platform
// WHAT HIPAA MEANS FOR A VENDOR
If you touch PHI for a US provider, you are directly liable.
HIPAA is enforced by the US Department of Health and Human Services. It applies to covered entities (health plans, providers and clearinghouses) and to the business associates that handle protected health information (PHI) for them, which includes most health-tech software vendors. There is no official HIPAA certificate. What a hospital’s security team and a regulator look for is a documented risk analysis, the Security Rule’s administrative, physical and technical safeguards in place, signed Business Associate Agreements and a breach process that works.
// DELIVERY STANDARD
Built for decisions, evidence and accountable execution.
Whether this is a commercial engagement or a government program, the work is structured so technical teams can act and leadership can verify progress.
Risk analysis and gaps
The Security Rule risk analysis and a gap assessment against each safeguard, ranked by risk.
Safeguards and BAAs
Administrative, physical and technical safeguards put in place, policies written and Business Associate Agreements sorted.
Evidence and reviews
Training records, access reviews and logs tracked in the Bitkosh Readiness Platform, ready for any customer review.
// PROJECT OUTPUTS
What your team can take into the next review.
- PHI inventory and data-flow map
- Security Rule risk analysis and risk management plan
- HIPAA policy and procedure set
- Business Associate Agreement template and subcontractor BAA review
- Breach assessment and notification procedure
- Security questionnaire answer pack
// BUILT FOR
Designed around the people who own the outcome.
- Health-tech SaaS vendors selling into the US
- Indian teams building or operating software for US providers
- Medical billing, transcription and telehealth companies
- Engineering leaders asked to sign a BAA
Security Rule risk analysis
The documented risk analysis the Security Rule requires: where electronic PHI lives, the threats to it and the safeguards that reduce them, refreshed when your systems change.
Administrative safeguards
Security officer, workforce training, access management, sanctions, contingency planning and periodic evaluation, documented and actually running.
Technical safeguards
Access control, unique user IDs, audit logging, integrity controls and encryption of PHI in transit and at rest, configured in your cloud and application.
Business Associate Agreements
A BAA template for your customers and a review of the BAAs you need from your own subcontractors, such as cloud and email providers that touch PHI.
Breach notification readiness
How you decide whether an incident is a reportable breach, who notifies the covered entity, and what goes in the notice, rehearsed before it happens.
Customer security reviews
Policies, evidence and answers ready for the questionnaires hospitals and health plans send, so procurement does not stall your deal.
// PRICING
Scoped to you, priced in writing.
Every engagement is scoped to your frameworks, your team and how much help you want — you get a written proposal before anything starts.
Risk analysis and gap assessment
Talk to us
The Security Rule risk analysis plus a written gap report and plan.
Full HIPAA readiness programme
Talk to us
Risk analysis to working safeguards and evidence. Legal review of contracts, where needed, comes from your own US counsel.
HIPAA work is scoped by how many systems and subcontractors handle PHI. Talk to us and we'll send a written proposal.
Frequently Asked Questions
Can we get HIPAA certified?
There is no official HIPAA certification from the US government. Some companies buy third-party "HIPAA certificates", but they carry no regulatory weight. What protects you is a current risk analysis, working safeguards, signed BAAs and evidence, which is what we help you build. Customers who want an independent report usually ask for SOC 2 with HIPAA mapping.
We are an Indian company. Does HIPAA apply to us?
If you handle PHI on behalf of a US covered entity or another business associate, you are a business associate and HIPAA applies to how you protect that data, wherever your team is based. Your customer will also pass HIPAA obligations to you through the BAA.
Is the HIPAA Security Rule changing?
HHS published proposed changes to the Security Rule in January 2025, including making some safeguards such as multi-factor authentication and encryption required rather than addressable. As of now it is still a proposal and not binding; the current Security Rule is what applies. We build to the current rule and, where it is cheap to do so, to the proposal as well.
Are you a law firm?
No. We are a compliance and security team: risk analysis, safeguards, policies and evidence. Contract terms and legal interpretations should come from your US counsel, and we work alongside them.
How does HIPAA relate to SOC 2 and ISO 27001?
Many safeguards overlap, such as access control, logging, encryption and incident response. The Bitkosh Readiness Platform maps evidence across all three, so one control can serve HIPAA, SOC 2 and ISO 27001.
Let's build together
Answer the hospital’s security review with evidence, not promises.
Book a free 30-minute consultation with our engineering team — no obligation, just a clear, practical plan.