Compliance
HIPAA Readiness for APAC and Indian Healthtech Companies
An APAC or Indian healthtech company comes under HIPAA when it creates, receives, maintains or transmits protected health information on behalf of a US covered entity, or on behalf of one of that entity's business associates. That makes it a business associate or a subcontractor, bound by a business associate agreement, whatever country it operates from. Readiness then means a current Security Rule risk analysis, safeguards that answer it, every BAA clause mapped to a working process, and evidence a US client can check. There is no HIPAA certification. SecureRoot runs the risk analysis and builds that evidence; it does not certify anyone.
About this guide
Written by SecureRoot Risk Advisory LLP.
Start here
Work out whether you are a business associate
HIPAA attaches to the work, not the country. The rules bind covered entities, which are health plans, health care clearinghouses and health care providers that transmit health information electronically in connection with HIPAA transactions. They also bind business associates, and the federal definition sets no condition about where a business associate is based.
Under 45 CFR 160.103, a business associate is a person who, on behalf of a covered entity and other than as a member of its workforce, creates, receives, maintains or transmits protected health information for a regulated function. The definition lists examples such as claims processing, data analysis, billing, practice management and quality assurance. It also includes a subcontractor that does the same on behalf of a business associate, so the duty passes down a chain of vendors.
- You host, process or analyse patient data for a US hospital, clinic, health plan or clearinghouse: you are likely a business associate of that customer.
- You do the same for a US company that is itself a business associate, such as a US healthtech platform or billing company: you are likely a subcontractor, and the same Security Rule duties apply to you.
- Your customers are hospitals and clinics only in your own country, and no US covered entity's data reaches you: that work does not bring you under HIPAA, although your own country's privacy law will apply.
- You sell software that a US provider runs entirely on its own infrastructure, and your staff never access its patient data: you may not be a business associate. Confirm it per customer, because support access, hosted backups or log shipping can change the answer.
The role is decided per customer and per service, so a company can be a business associate for one product and outside HIPAA for another. Write the answer down for each US customer before you start any other work, because it decides which obligations you are building to.
The first document
The Security Rule risk analysis
The risk analysis is the document a US client's security team usually asks for first. 45 CFR 164.308(a)(1)(ii)(A) makes it a required implementation specification for covered entities and business associates alike: an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of the electronic protected health information you hold. Paragraph (B) then requires risk management, meaning security measures that bring those risks down to a reasonable and appropriate level.
NIST SP 800-66 Revision 2, published in February 2024, is NIST's resource guide for implementing the Security Rule and is the usual method reference. A risk analysis that a US client will accept is specific to your systems, not a generic template.
- 01
Inventory every place the data lives and travels
Production databases and object storage, backups, logs and analytics, support tooling, email, laptops of staff who can reach production, and every vendor that stores or processes the data for you. A system missing from this inventory is a gap in the risk analysis itself, because the analysis has to cover all electronic protected health information the organisation creates, receives, maintains or transmits.
- 02
Assess threats and vulnerabilities per system
For each system, record what could go wrong, how likely it is and what the impact would be. Technical findings from a vulnerability assessment or penetration test feed in here as evidence, not as a substitute for the analysis.
- 03
Decide and record a treatment for each risk
Name an owner and a decision for each risk: reduce it with a safeguard, accept it with a reason, or remove the processing. Risk management is a separate required specification, so a list of risks with no decisions does not meet the rule.
- 04
Set a review cycle
Review the analysis when your environment changes, such as a new cloud region, a new sub-processor or a new product that touches patient data, and on a fixed cycle. A risk analysis dated before your current architecture is treated as missing.
The second document
What the business associate agreement commits you to
A covered entity may let a business associate handle electronic protected health information only with satisfactory assurances documented in a written contract, and a business associate must obtain the same from its own subcontractors (45 CFR 164.308(b)). Under 45 CFR 164.314(a)(2)(i), that contract must provide, at minimum, that you will:
- Comply with the applicable requirements of the Security Rule.
- Ensure that any subcontractor that creates, receives, maintains or transmits the information on your behalf agrees to the same requirements through its own contract.
- Report to the covered entity any security incident you become aware of, including breaches of unsecured protected health information as required by 45 CFR 164.410.
45 CFR 164.410 requires a business associate to notify the covered entity of a breach of unsecured protected health information without unreasonable delay and no later than 60 calendar days after discovery. Many US customers write shorter deadlines, specific encryption requirements and audit rights into their agreements, and those contractual terms are what you will be checked against.
Treat each signed BAA as a requirements list. Map every clause to a control or a process, name an owner, and keep the evidence that it runs. If you use cloud providers, support platforms or offshore contractors that touch the data, you need BAAs with them too, because the flow-down duty is yours.
What readiness involves
What HIPAA readiness work involves
Readiness is the work that lets you answer a US client's security questionnaire and assessment with evidence rather than statements. SecureRoot runs it in six phases, each ending in a written output:
- 01
Scoping and role confirmation
Confirm covered entity or business associate status per customer and service, inventory the systems holding protected health information and map how it flows. Output: a PHI inventory and applicability memo.
- 02
Security risk analysis
Assess threats and vulnerabilities across administrative, physical and technical safeguards, scored by likelihood and impact, using HHS and NIST SP 800-66 guidance. Output: a security risk analysis report.
- 03
Safeguard design
Policies and procedures, access control and audit logging, encryption for data at rest and in transit, and a workforce training programme. Output: a HIPAA policy set and remediation plan.
- 04
Privacy and breach processes
Permitted use and disclosure rules, the patient rights request workflow, and a breach assessment and notification procedure tested in a tabletop exercise. Output: privacy procedures and a breach notification playbook.
- 05
Business associate management
Identify every vendor that touches the data, put agreements in place with each, assess their safeguards and set a reassessment cadence. Output: executed agreements and a vendor register.
- 06
Readiness review
Verify that risk analysis findings are remediated, test safeguards against the Security Rule and compile the evidence pack. Output: a HIPAA readiness report.
SecureRoot's published timeline for HIPAA readiness is 2 to 4 months. The fee is scoped against your role as a business associate, then quoted; no third party is required by the rule, although a client may demand an independent assessment. Both are on the pricing page. If you are also preparing for SOC 2 or ISO/IEC 27001, the HIPAA safeguards can sit in the same control set so that client reviews and audits draw on one body of evidence.
Regulatory status
The proposed Security Rule update: still a proposal
On 6 January 2025 HHS published a notice of proposed rulemaking to modify the Security Rule (90 FR 898, RIN 0945-AA22). Comments closed on 7 March 2025. When we checked the Federal Register on 13 November 2026, the only document filed under that RIN was the proposed rule: no final rule had been published. The current Security Rule is the one in force, and it is the one this page describes.
Plan with the proposal in view, because US clients are already asking about several of its measures. As proposed, the rule would:
- Remove the distinction between required and addressable implementation specifications and make all of them required, with specific, limited exceptions.
- Require encryption of all electronic protected health information at rest and in transit, with limited exceptions.
- Expressly require multi-factor authentication on the technology assets in the systems that handle electronic protected health information.
- Require automated vulnerability scanning at least every six months, and penetration testing by qualified persons at least once every 12 months or more often if the risk analysis calls for it.
- Require a covered entity to obtain written verification, at least once every 12 months, that each business associate has deployed the required technical safeguards, backed by a written analysis by a qualified person and a certification from someone authorised to act for the business associate.
- Apply the standard compliance date of 180 days after the effective date of a final rule.
A final rule may differ from the proposal. Check the Federal Register before you commit budget to a specific requirement, and read your BAAs: some US customers already demand encryption, MFA and annual testing by contract.
Certification
There is no HIPAA certification
HHS does not certify organisations as HIPAA compliant and does not endorse any private HIPAA certification, so a certificate from a vendor or consultant carries no regulatory weight on its own. US clients look for evidence instead: a current risk analysis, written policies and procedures, implemented safeguards, training records, signed BAAs, a breach procedure, and proof that these operate.
Many healthtech companies add SOC 2 or ISO/IEC 27001 for independent assurance that clients recognise. Those come from independent parties: a SOC 2 report from a licensed CPA firm, and an ISO/IEC 27001 certificate from an accredited certification body. SecureRoot is neither.
| Evidence | Rule | What it has to show |
|---|---|---|
| Security Rule risk analysis | 45 CFR 164.308(a)(1)(ii)(A) | An accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of all the electronic protected health information you hold |
| Risk management | 45 CFR 164.308(a)(1)(ii)(B) | Security measures that bring those risks down to a reasonable and appropriate level, with a recorded decision for each risk |
| Business associate agreement with the covered entity | 45 CFR 164.308(b) and 164.314(a)(2)(i) | At minimum: compliance with the applicable Security Rule requirements, the same requirements flowed down to subcontractors, and reporting of security incidents, including breaches of unsecured protected health information |
| Agreements with your own subcontractors | 45 CFR 164.308(b) | The same written assurances from every vendor that creates, receives, maintains or transmits the information on your behalf |
| Breach notification to the covered entity | 45 CFR 164.410 | Notice without unreasonable delay and no later than 60 calendar days after discovery; many US customers write shorter deadlines into their agreements |
Scope boundaries
What this does not cover
- There is no HIPAA certification, and SecureRoot does not issue one. A readiness report records where you stand on the date of the review; it does not guarantee compliance or the outcome of a client assessment or an HHS investigation.
- SecureRoot is not a law firm. Whether you are a business associate for a given customer, and how to negotiate a BAA, are legal questions your counsel should confirm.
- SecureRoot is not a CPA firm and not an accredited certification body, so it does not issue SOC 2 reports or ISO/IEC 27001 certificates.
- SecureRoot works from India and has no offices outside India. Work that needs physical presence at a site, such as inspecting facility controls in person, is outside remote delivery.
- Your team implements and runs the safeguards and keeps the operating evidence. Tooling such as encryption, device management or logging platforms is outside SecureRoot's fee.
- This page covers the HIPAA Security Rule and the business associate relationship. It does not cover US state health privacy laws or your own country's privacy law, which may apply to the same data.
Questions
Common questions
We are not in the US. Can HIPAA still apply to us?
Yes, through the work. If you handle protected health information on behalf of a US covered entity, or on behalf of its business associate, you meet the federal definition of a business associate or subcontractor wherever you are based, and your BAA binds you to the Security Rule.
Is the proposed Security Rule update in force?
Not as of 13 November 2026. HHS published it as a proposed rule on 6 January 2025 and the Federal Register shows no final rule under its RIN, 0945-AA22. If a final rule is published as proposed, compliance would be due 180 days after its effective date.
Does a penetration test make us HIPAA compliant?
No. The current rule requires a risk analysis and risk management; test findings are evidence for both. The proposed rule would add annual penetration testing and six-monthly vulnerability scanning, but neither is a substitute for the analysis.
Can we show a client a HIPAA certificate?
There is no official one. Show the evidence pack instead: the current risk analysis, policies, safeguards, training records, signed BAAs and the breach procedure. SOC 2 or ISO/IEC 27001 can add independent assurance alongside it.
Primary Sources
Where the Figures on This Page Come From
Figures and requirements above are taken from the sources below, linked to the primary text wherever one exists rather than to a summary of it.
- 45 CFR 160.103 - Definitions, including business associate, subcontractor and covered entity
Electronic Code of Federal Regulations, US Government Publishing Office · Link checked 2026-11-13
- 45 CFR 164.308 - Administrative safeguards, including risk analysis (a)(1)(ii)(A) and business associate contracts (b)
Electronic Code of Federal Regulations, US Government Publishing Office · Link checked 2026-11-13
- 45 CFR 164.314 - Organizational requirements: business associate contracts
Electronic Code of Federal Regulations, US Government Publishing Office · Link checked 2026-11-13
- 45 CFR 164.410 - Notification by a business associate
Electronic Code of Federal Regulations, US Government Publishing Office · Link checked 2026-11-13
- HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, proposed rule, 90 FR 898 (6 January 2025), RIN 0945-AA22
Federal Register, Office of the Federal Register (US Department of Health and Human Services) · Link checked 2026-11-13
- NIST SP 800-66 Rev. 2, Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide (February 2024)
National Institute of Standards and Technology · Link checked 2026-11-13
Related
Services and help that go with this
- HIPAA compliance services
SecureRoot's six phases, deliverables and the full HIPAA FAQ.
- Pricing
The HIPAA row: how the fee is scoped and the published timeline.
- Choosing a framework or report
Whether SOC 2 or ISO/IEC 27001 should sit beside your HIPAA evidence.
- Responding to enterprise customer security requirements
Handling the questionnaire and assessment a US customer sends.
- Scoping a VAPT engagement
What to have ready if your risk analysis calls for a penetration test.
- Evidence handling
How evidence is shared and stored during an engagement.
- Asia-Pacific
How SecureRoot works with companies across the region, remotely from India.
Find out where you stand with your US customers
Tell SecureRoot which US customers you serve, what data you handle for them and which BAAs you have signed. We will confirm the scope of a risk analysis and readiness programme and quote a fixed price in writing.