Legal Infrastructure for Healthcare SaaS & AI

If your platform creates, receives, maintains, or transmits protected health information (PHI) for a covered entity, HIPAA pulls you in as a business associate and a Business Associate Agreement (BAA) becomes mandatory. But HIPAA is a federal floor. State medical-privacy and consumer-health-data laws layer on top, and several do not care whether you signed a BAA.

Who this page is for

• Digital health and telehealth startups preparing to sign their first hospital or clinic customer.
• Healthcare AI companies that need to position their product relative to FDA software-as-a-medical-device rules.
• Behavioral-health and substance-use-disorder platforms that also touch 42 CFR Part 2 data.
• Founders selling nationally who need to know which states reach beyond HIPAA.

Under 45 CFR 160.103, a person or company that creates, receives, maintains, or transmits protected health information on behalf of a covered entity is a business associate, and the definition expressly reaches a subcontractor that does the same on behalf of a business associate. So an AI vendor or model API that processes PHI in your workflow can be a business associate or a subcontractor in your chain, which generally means a BAA is required. Whether a specific data flow is PHI, and which party a given AI vendor is acting for, depends on your facts.

Training is a separate contractual question from status. Whether an AI vendor may use your inputs to train a general model is controlled by the terms you negotiate, so the AI addendum in the extension is where no-training, deletion, and subprocessor terms get written. See the HIPAA BAA generator for a starting BAA draft and does HIPAA apply to my startup for the threshold question.

Related reading: my independent medical exam claims analysis and the healthcare SaaS terms scanner.

HIPAA applies to covered entities and to business associates that handle PHI on their behalf. Since the HITECH amendments, business associates (including SaaS vendors) are directly liable to the HHS Office for Civil Rights, not just contractually liable to their customer.

• Privacy Rule: limits use and disclosure of PHI; requires minimum-necessary practices.
• Security Rule: administrative, physical, and technical safeguards for electronic PHI.
• Breach Notification Rule: notice obligations triggered by an impermissible use or disclosure (see the breach timeline section).

This is where most national products get surprised. Some states regulate consumer health data that HIPAA never reaches, and some comprehensive privacy laws exempt PHI but not the company. The full 50-state map is below.

• California CMIA can be stricter than HIPAA and carries a private right of action.
• Washington My Health My Data Act reaches consumer health data outside HIPAA, with a private right of action via the Consumer Protection Act.
• Oregon, Maryland, New Jersey, Delaware use data-level (not entity-level) HIPAA exemptions, so being a business associate does not exempt your organization.

If your software provides patient-specific information used to drive a clinical decision, the FDA may regulate it as Software as a Medical Device. A narrow Clinical Decision Support exemption can apply where the basis for a recommendation is transparent enough that a clinician can independently review it. The screening tree is below.

A HIPAA BAA does not satisfy GDPR, and a GDPR-style DPA does not satisfy HIPAA. If you process personal data of EU or UK residents, or non-PHI data subject to US state laws like CCPA/CPRA, you generally need a separate Data Processing Agreement alongside the BAA.

No states match that filter.

Under CMIA Civil Code 56.06, a SaaS vendor that maintains medical information or offers health or wellness software, mobile apps, or reproductive/sexual-health digital services can itself be deemed a "provider of health care" directly subject to the CMIA. CMIA can be more stringent than HIPAA and carries a private right of action.

MHMDA exempts HIPAA PHI and intermingled data held by a covered entity or business associate, but any consumer health data collected outside the HIPAA-covered stream (direct-to-consumer, app, or web data) falls squarely within it.

That triggers opt-in consent to collect, separate consent to share, valid authorization to sell, a distinct consumer-health-data privacy policy linked on the homepage, consumer access and deletion rights, and a geofencing ban, all backed by a private right of action via the Washington Consumer Protection Act.

Texas defines "covered entity" far more broadly than HIPAA, reaching any out-of-state vendor that handles PHI of Texas residents, and adds 90-day privacy training, electronic-disclosure limits, and breach notice to the Texas AG at a 250-resident threshold.

SB 370 fully exempts both HIPAA-covered entities and HIPAA PHI, so a vendor acting solely as a HIPAA business associate processing only PHI is generally exempt. But any consumer health data collected outside the HIPAA-covered relationship (direct-to-consumer app data, marketing, or pre-relationship intake) triggers SB 370.

That means a separate consumer-health-data privacy policy, prior affirmative opt-in consent to collect and (separately) to share, written authorization to sell, and a prohibition on geofencing around health-care facilities. Enforced by the Nevada AG; no private right of action.

PHI handled under the BAA is exempt at the entity and data level, but any consumer health data the vendor touches outside HIPAA (behavioral-health-adjacent app data, marketing, geolocation) triggers PA 23-56: opt-in consent to process, a ban on selling consumer health data without consent, and a prohibition on geofencing within 1,750 feet of any mental-health, reproductive, or sexual-health facility.

Three comprehensive-law states do not grant an entity-level HIPAA exemption, so being a HIPAA business associate does not exempt the SaaS as an organization. Oregon (OCPA) and Maryland (MODPA) exempt only PHI at the data level; New Jersey (NJDPA) exempts PHI at the data level and does not exempt HIPAA-regulated entities.

For all three, the MSA and privacy-policy stack must build full controller/processor obligations (including opt-in consent for health-condition/diagnosis data) on top of the BAA. Maryland goes further with a strict-necessity minimization rule and an absolute ban on selling sensitive/consumer-health data regardless of consent. Delaware (DPDPA) is the related outlier: no entity-level exemption, a 35,000-consumer threshold with no revenue floor, and coverage of nonprofits.

For behavioral-health and substance-use-disorder customers, several states layer consent rules stricter than HIPAA on top of 42 CFR Part 2: the Michigan Mental Health Code (MCL 330.1748), the Minnesota Health Records Act (144.293, requiring signed consent even for treatment, payment, or operations), New York Mental Hygiene Law 33.13, and Pennsylvania's Act 148 (HIV), Mental Health Procedures Act, and Drug and Alcohol Abuse Control Act.

Illinois adds BIPA/GIPA private-right-of-action exposure for any biometric or genetic data. Consent flows and the BAA/MSA must permit honoring these more-stringent state authorizations.

Ranges are illustrative of typical market pricing, not quotes from specific firms. My flat fee includes up to three rounds of revisions; overflow beyond that bills at $300 per hour.

At minimum: Terms of Service, Privacy Policy, a HIPAA BAA, and a SaaS subscription agreement. If you integrate with hospital systems or handle PHI through APIs, you also need a DPA, an API license, and an SLA. Companies selling to enterprises typically need an MSA/SOW framework as well.

Whenever your platform creates, receives, maintains, or transmits PHI on behalf of a covered entity (hospital, clinic, insurer). That includes cloud-hosting PHI, processing claims data, or running analytics on patient records. Even storing encrypted PHI generally triggers the requirement.

Several. Washington (MHMDA), Nevada (SB 370), and Connecticut (CTDPA health amendments) regulate consumer health data outside HIPAA. California's CMIA can be stricter than HIPAA with a private right of action. Texas adds data-localization duties. Oregon, Maryland, New Jersey, and Delaware use data-level rather than entity-level HIPAA exemptions. See the 50-state table above; the applicable laws depend on where your users are.

Often yes. A BAA covers HIPAA PHI; a DPA covers general personal data under GDPR, UK GDPR, and CCPA/CPRA. They are not interchangeable, and most companies operating nationally need both.

An MSA with order form, a HIPAA BAA (with a 42 CFR Part 2 / CMIA schedule where needed), Terms of Service, a Privacy Policy, a DPA framework, and a compliance gap memo across your vendor stack, with up to three rounds of revisions included. Overflow beyond that bills at $300 per hour. Everything is delivered in a private, interactive workroom, not just Word files.

No. It is attorney-directed AI that provides legal information, not legal advice, and using it does not create an attorney-client relationship. For advice tailored to your facts, the engagement is where that happens.

It can, but the AI layer has to be papered. If your product creates, receives, maintains, or transmits protected health information for a covered entity, HIPAA treats you as a business associate and the same rules apply when a model touches that data. The stack needs to map the PHI flow, confirm whether each AI vendor is a business associate or a subcontractor, and set terms on training, human review, output reliance, and deletion. Whether a given data flow is PHI depends on your facts. This is the work in the Healthcare AI Extension.

Generally, if the AI vendor creates, receives, maintains, or transmits PHI on your behalf, it fits the 45 CFR 160.103 business-associate definition, which expressly reaches subcontractors, so a BAA is usually required. HHS cloud guidance is explicit that a provider holding ePHI is a business associate even if it lacks the encryption key and cannot view the data, so a no-view or encrypted-only AI vendor is not automatically exempt. Which party a vendor acts for, and whether the data is PHI, depends on the facts.

It may be, and it is a flag for attorney review rather than a settled answer. Depending on intended use, FDA Software as a Medical Device rules, ONC predictive decision-support transparency requirements, and HHS Section 1557 nondiscrimination in patient-care decision tools can each be in play, and the EU AI Act may apply to EU-facing products. Transparent support tools that a clinician can independently review sit differently from autonomous or black-box scoring. Which regime applies turns on the facts of your feature, so this is issue-spotting, not a determination.

Only if your contracts allow it, and for PHI you generally do not want it to. Training is a contractual question separate from business-associate status: whether an AI vendor may use your inputs to train a general model is governed by the terms you negotiate. The AI addendum in the extension is where no-training, use-limitation, subprocessor, and deletion terms get written so patient or claimant data is not absorbed into a general model.

They cover different obligations and often stack. A BAA addresses HIPAA PHI handled for a covered entity or business associate. A DPA covers general personal-data obligations under frameworks like GDPR and CCPA/CPRA for data that is not PHI, such as analytics or employee data. An AI Addendum covers the model-specific terms a BAA and DPA do not reach: no-training on inputs, output-reliance limits, human review, AI subprocessor terms, and the AI/PHI data-flow map. A national healthcare AI product often needs all three.

No. The core package includes a practical vendor-stack compliance gap memo and a startup HIPAA Security Rule oriented risk note, which is what most pre-launch companies need first. It is not an audit-grade HIPAA Security Rule risk analysis under 45 CFR 164.308(a)(1)(ii). A full Security Rule risk analysis, a technical security audit, SOC 2 readiness, a penetration test, forensic assessment, certification, or audit-defense are separately scoped and quoted engagements.

Not for free. I do not do free quick calls, free initial consultations, free case evaluations, free reviews of your documents or materials, discovery calls, or unpaid let's-hop-on-a-call chats, even for large or ongoing work. The fastest way to actually get me on a call is the $400 one-hour Zoom Strategy Session; for written analysis without a call, the $240 Written Attorney Consultation is the lower-cost option. Once you book, I work directly on your facts and documents. Everything else on the site is free so you can evaluate my approach first.