News
Aesto Health AWS Breach Hits HHS Portal at 9.54 Million Patients Across 30 Provider Clients, Including Everside Health · Data BreachTheGentlemen Ransomware Group Threatens Nutex Health's 27-Hospital Network; Class Action Filed Days After SEC Disclosure · Data BreachOCR Settles with California Eye Care Provider Azul Vision for Failure to Provide Timely Patient Record Access — 55th Right of Access Enforcement Action · OCR EnforcementShinyHunters Claims Leak of 7.1 Million Baxter International Salesforce Records Including Patient PII · Data BreachCareCloud EHR Vendor Breach Exposes Medical and Financial Data of 345,000 Patients · Data BreachOptalis Management Solutions and Other HIPAA-Regulated Entities Disclose Patient Data Breaches Affecting Thousands · Data BreachFive Small Healthcare Organizations Disclose Patient Data Breaches: Family Medical Associates of Raleigh, Arkansas Oral & Maxillofacial Surgeons, Alpine Agency of the Midlands, Princeton Family Eye Care, and Others · Data BreachAesto Health AWS Breach Hits HHS Portal at 9.54 Million Patients Across 30 Provider Clients, Including Everside Health · Data BreachTheGentlemen Ransomware Group Threatens Nutex Health's 27-Hospital Network; Class Action Filed Days After SEC Disclosure · Data BreachOCR Settles with California Eye Care Provider Azul Vision for Failure to Provide Timely Patient Record Access — 55th Right of Access Enforcement Action · OCR EnforcementShinyHunters Claims Leak of 7.1 Million Baxter International Salesforce Records Including Patient PII · Data BreachCareCloud EHR Vendor Breach Exposes Medical and Financial Data of 345,000 Patients · Data BreachOptalis Management Solutions and Other HIPAA-Regulated Entities Disclose Patient Data Breaches Affecting Thousands · Data BreachFive Small Healthcare Organizations Disclose Patient Data Breaches: Family Medical Associates of Raleigh, Arkansas Oral & Maxillofacial Surgeons, Alpine Agency of the Midlands, Princeton Family Eye Care, and Others · Data Breach

A customer asked, "Are you HIPAA compliant?"

Be honest: explain your controls and BAAs, never promise a checkbox no one can guarantee.

  1. 1

    Clarify what they mean

    Ask whether they mean you will sign a BAA, support their audit, or meet specific security standards. Vague questions get vague answers.

  2. 2

    Describe how you protect health data

    Encryption, access controls, logging, backups, and subprocessors are concrete. Avoid marketing fluff.

  3. 3

    Offer a BAA if you handle PHI

    If their data includes patient information, offer your standard BAA and security documentation.

  4. 4

    Point to independent review if available

    SOC 2, HITRUST, or penetration test summaries help, but they do not replace the customer's own risk assessment.

Important

HIPAA compliance is shared: your customer must configure your product correctly and train their staff, you cannot "HIPAA certify" them.

Related

Ask AI about this situation →

Not legal advice. Follow your organization's policies and consult counsel for legal questions.