Blog / HIPAA

CCPA HIPAA Exemption: What Is Exempt and What Still Falls Under the CCPA

The CCPA HIPAA exemption covers PHI and medical information, not your whole company. Learn what HealthTech teams must still handle under the CCPA and how.

HIPAA Data Retention Requirements: What to Keep, How Long, and How to Dispose of It

HIPAA data retention requirements explained: which documents the six-year rule covers, why medical records follow state law, and how to dispose of PHI safely.

HIPAA Compliant File Sharing: A Checklist for Sharing PHI Securely

HIPAA compliant file sharing checklist: when a service needs a BAA, which technical safeguards apply, and how to configure links, access and logs for PHI.

HIPAA De-identification: Safe Harbor, Expert Determination and Limited Data Sets

HIPAA de-identification explained for HealthTech teams: Safe Harbor, Expert Determination and limited data sets, to safely use patient data for analytics or AI.

PHI in Logs: How to Keep Health Data Out of Your Application and Observability Logs

Keep PHI in logs under control: where sensitive data leaks into app, error and LLM logs, how to redact it, and which audit logs HIPAA still expects you to keep.

HIPAA Compliant Data Center: How to Choose a Colocation or Hosting Provider for ePHI

Choosing a HIPAA compliant data center: why no certification exists, what the BAA must say, which physical safeguards to verify and what evidence to request.

HIPAA Compliant Database: Requirements and Configuration Checklist for Storing PHI

What makes a HIPAA compliant database: Security Rule safeguards mapped to encryption, access, audit logs and backups, plus a configuration checklist for ePHI.

HIPAA Compliant Texting: When You Can Text Patients and How to Do It Safely

HIPAA compliant texting explained: when providers can text patients, the risks of standard SMS, and the safeguards and policy checklist that keep PHI protected.

HIPAA Permitted Uses and Disclosures: When PHI Can Be Shared Without Authorization

HIPAA permitted uses and disclosures explained for HealthTech teams: TPO, required and public-interest disclosures, and when PHI needs a signed authorization.

Who Does HIPAA Apply To? A Decision Guide for HealthTech and SaaS Founders

Who does HIPAA apply to? Learn the covered entity types, when vendors become business associates, who is exempt, and a step-by-step test for your company.