Working with a US healthcare customer can introduce requirements that your existing UK or European compliance programme does not address. We help you establish the relevant role, data flows and practical readiness work.
HIPAA applies to covered entities and business associates in the circumstances defined by the rules. Handling information about health does not, by itself, settle every applicability question. We start with the service you provide, the customer relationship, the functions you perform and how protected health information (PHI) is handled. See the HHS applicability guidance alongside qualified US legal advice.
The service is for UK and European health-tech suppliers, clinical software companies, research platforms, telehealth vendors, analytics providers and hosting or support businesses selling to US hospitals, health plans, clinics or digital-health companies. The buyer is usually a founder, CTO, compliance lead, DPO or commercial owner who has received a security questionnaire or Business Associate Agreement (BAA) and needs an accurate response before a deal stalls.
Some clients are business associates handling PHI for a covered entity. Others provide a product that does not receive PHI in the same way, or use a subcontractor that does. We clarify the role and boundary rather than assuming that every health-related product is “HIPAA certified.” If the legal status is uncertain, we identify the question for counsel to confirm.
The request may arrive as a one-line procurement question, a detailed HIPAA questionnaire, a proposed BAA, an insistence on a recent risk analysis or a requirement for an independent security report. A UK or EU company may already hold ISO 27001, Cyber Essentials or SOC 2, but still lack a documented HIPAA risk analysis, workforce training record, incident decision process or evidence about where PHI is stored.
We help translate the request into concrete obligations and customer evidence. That protects the sales process from two opposite mistakes: making a broad claim that cannot be supported, or spending months implementing controls irrelevant to the product and PHI flow.
Customers commonly ask how PHI enters the service, which systems and people can access it, whether subcontractors process it, how access is approved and removed, how risks are analysed, and how incidents are detected, contained and reported. They may ask for policies, workforce training, encryption and key-management details, vulnerability management, backup and recovery evidence, audit logs, disaster-recovery tests and the list of data centres or cloud regions involved.
HIPAA readiness also requires attention to the Privacy Rule and Breach Notification Rule where applicable, not only technical safeguards. The organisation needs a process for permitted uses and disclosures, minimum necessary access, individual rights requests where relevant, business associate terms and documented decisions after a suspected incident. A questionnaire answer should match the BAA, architecture and actual operating procedures.
We map the product, customer relationship and PHI flow through applications, support tools, analytics, backups, endpoints and subprocessors. We review existing risk assessments, policies, contracts, access controls, logging, incident management and continuity evidence. Interviews with engineering, support, operations and commercial owners expose the practical details a policy will not show, such as support staff exporting a ticket or a developer using production data for troubleshooting.
We then create a prioritised readiness plan. Work may include a HIPAA security-risk analysis, administrative/physical/technical safeguard mapping, access and workforce process improvements, incident and breach decision runbooks, BAA and subcontractor evidence coordination, supplier due diligence, risk treatment and customer questionnaire support. Legal interpretation of a BAA, breach notification or permitted use is coordinated with appropriate counsel; technical remediation and ongoing operation stay with named client owners.
Deliverables can include a documented scope and HIPAA role analysis; PHI data-flow and system-boundary diagram; risk analysis and risk register; safeguard and control matrix; access and workforce evidence checklist; incident and breach escalation runbook; supplier and subprocessor review; continuity and recovery evidence index; remediation tracker; and a customer-ready assurance pack.
The assurance pack might link a least-privilege claim to an access approval workflow, quarterly review and termination sample. It might link “encryption at rest” to the relevant storage services and key-management configuration, and link incident commitments to a tested escalation exercise. We identify gaps honestly where the evidence is incomplete instead of turning an aspiration into a compliance statement.
A focused readiness review generally takes three to six weeks. The first week confirms role, scope and customer deadline; weeks two and three map PHI, interview owners and sample controls; the final weeks produce the risk analysis, gaps and evidence plan. Implementation commonly takes eight to sixteen weeks, with longer timelines for multiple products, clinical integrations, legacy systems or extensive subcontracting.
After the initial engagement, quarterly advisory support can review new integrations, customer questionnaires, incidents, suppliers and changes to US requirements. HIPAA readiness is an operating discipline; it is not established permanently by signing one policy.
A clinical workflow vendor may discover that PHI is excluded from its core database but appears in support attachments and error logs. A research platform may have strong encryption while lacking a documented retention decision and deletion process for exports. A telehealth supplier may have a disaster-recovery plan but no evidence that a restore test meets the customer’s recovery objective. We use those concrete findings to set owners, deadlines and acceptable evidence.
This service is readiness consultancy, not an official government certification service. HIPAA does not operate as a single government certification scheme.
That depends on the service, customer relationship and functions performed. We document the role and data flow, while legal counsel confirms contractual and legal conclusions.
Some security evidence may be relevant, but reuse must be assessed against the actual HIPAA Security, Privacy and Breach Notification Rule obligations and customer scope.
No. They have different legal structures and applicability. A business can need to consider both when serving US healthcare from the UK or EU.
Book a working session with the customer request and a clear account of the service you provide.
Book a working session →