What healthtech SaaS founders usually get wrong about HIPAA compliance

Been seeing a lot of questions here from people building healthtech SaaS who aren't sure if/when HIPAA actually kicks in, so wanted to write up what I've seen trip founders up repeatedly.

"We don't store PHI" is rarely as true as people think. PHI isn't just diagnosis codes. Appointment times, patient portal metadata, even support ticket content can count if it's tied to a patient. If your product touches this on behalf of a clinic, hospital, or health plan, you're probably a Business Associate under HIPAA whether you meant to be or not.

A signed BAA gets you in the door, not through the deal. Bigger healthcare buyers increasingly want to see the operational evidence behind the BAA — access logs, encryption posture, a documented risk assessment — not just the signed paper. Teams that don't have this ready get stuck mid-procurement, which is the worst time to be scrambling.

Nobody thinks about the administrative side until an auditor asks. Everyone builds encryption and access controls because that's the "engineering" part of HIPAA. But the Security Rule also requires a designated security official, workforce training, incident response procedures, and periodic risk assessments. These are usually the first things a security reviewer asks about because they show whether compliance is a real process or a one-time checkbox someone ticked before a demo.

Retrofitting is way more expensive than building it in. If you wait until you land a big customer to think about this, you'll be doing rushed compliance work under deal pressure instead of designing it into your architecture from the start.

Spreadsheets stop working faster than people expect. Fine for a 5-person team's first risk assessment. Breaks down once you've got multiple cloud vendors, several engineers with infra access, and recurring security questionnaires from customers.

Curious what others here have run into — especially anyone who's gone through a hospital system's procurement/security review process. What actually held things up for you?

(Disclosure: I work on a compliance automation tool, so take the "spreadsheets don't scale" point with that context — but the HIPAA-s pecific points above apply regardless of what tooling you use.)