A customer asked, "Are you HIPAA compliant?"
Be honest: explain your controls and BAAs, never promise a checkbox no one can guarantee.
- 1
Clarify what they mean
Ask whether they mean you will sign a BAA, support their audit, or meet specific security standards. Vague questions get vague answers.
- 2
Describe how you protect health data
Encryption, access controls, logging, backups, and subprocessors are concrete. Avoid marketing fluff.
- 3
Offer a BAA if you handle PHI
If their data includes patient information, offer your standard BAA and security documentation.
- 4
Point to independent review if available
SOC 2, HITRUST, or penetration test summaries help, but they do not replace the customer's own risk assessment.
Important
HIPAA compliance is shared: your customer must configure your product correctly and train their staff, you cannot "HIPAA certify" them.
Related
Still unsure? Ask AI about this situation →
Not legal advice. Follow your organization's policies and consult counsel for legal questions.