HIPAA for Growing Healthcare Companies: Where the Real Risk Lives

HIPAA written for a 10,000-person hospital system is HIPAA at scale: dedicated compliance officers, layered training programs, multi-year OCR-investigation playbooks.

HIPAA for a 25-person digital health startup or a 60-person healthcare services firm looks different in almost every meaningful way. Same law, different risk surface, different consequences when something goes wrong.

We work with growing healthtech companies every week. The risks that catch them are narrower and more specific than the HIPAA compliance checklists suggest. What actually gets regulated companies in trouble at this scale.

HIPAA should protect patients, not eat your weekends.

1. Devices that walk away

A clinician-facing laptop gets left at a conference. A contractor's phone with the EHR app on it gets stolen. A former employee's laptop never gets wiped because offboarding was informal.

At scale, these are routine incidents with standard playbooks. At 20 people, they are existential. Without enforced disk encryption, mobile device management, and automated offboarding, a single device loss can trigger a breach notification, OCR scrutiny, and customer conversations you don't want to have.

2. Unfenced analytics tooling

Growing healthcare companies often ship PHI into tools that weren't designed for it: a general-purpose BI platform, an AI writing assistant, a data science sandbox spun up by a product manager. BAAs may or may not exist. Data isolation may or may not be configured. Retention policies may or may not apply.

This is where sprawl becomes exposure. A single unfenced tool with PHI in it is a reportable breach waiting for an incident. The answer is "governed tools," with BAAs, clear PHI-flow documentation, and technical fences where appropriate.

3. BAAs on file but no review cadence

Every growing healthcare company has a folder of BAAs. Few have a process to re-review them when the subprocessor changes ownership, updates its subprocessor list, or has a breach of its own. OCR has been increasingly vocal that a signed BAA is not sufficient due diligence; ongoing vendor risk management is.

The press-release settlements get attention. The patterns behind them are what matter:

• Investigations start with breach reports. In calendar year 2024, OCR opened 730 compliance reviews, 665 of them triggered by a breach report, and it initiated no audits at all (OCR's 2024 Report to Congress on HIPAA Compliance, accessed August 2026)
• A missing or inadequate risk analysis is the finding that comes up most. OCR cited a failure to conduct a compliant risk analysis in 14 of the 22 enforcement actions summarized in that same report for 2024
• Access controls and audit logs are on OCR's own list. Its 2024 breach investigations named risk analysis, risk management, information system activity review, audit controls, and person or entity authentication as key areas for improvement (OCR's 2024 Report to Congress on the Breach Notification Program, accessed August 2026)
• Settlements normally come with a corrective action plan, and HHS monitors compliance and takes reports generally for three years (HHS on resolution agreements). Recent plans, including Assured Imaging's December 2025 agreement, set a two-year compliance term

The takeaway for a growing company: the goal is to be able to show good faith. A current risk analysis, enforced technical safeguards, documented incident response, and evidence of vendor review close most of the door.

At 10 to 50 people, this is the floor:

• A current, dated risk analysis reviewed annually
• Administrative, technical, and physical safeguards documented in policies that are approved and current
• MFA enforced everywhere PHI can be accessed
• Full-disk encryption enforced on all devices, with mobile device management
• Automated joiner / mover / leaver access workflows
• A written incident response plan with evidence of a tabletop in the last 12 months
• BAAs on file for every subprocessor that touches PHI, with an annual review cadence
• HIPAA security awareness training completed by all workforce members annually
• Audit logs recorded and reviewable, kept for a retention period you have set in writing

This is the floor that prevents the common OCR findings. Above it, sophistication scales with revenue and customer requirements.

One distinction inside that list is worth holding onto, because it is where otherwise good programs get caught out. Some of it is the rule and some of it is practice. The Security Rule requires a risk analysis and a workforce training program without saying how often either happens (45 CFR 164.308, accessed September 2026). It requires mechanisms that record and examine activity without setting any retention period for the logs (45 CFR 164.312, accessed September 2026). The six year clock people remember applies to the documentation the rule requires you to keep, rather than to audit logs (45 CFR 164.316, accessed September 2026). So the annual cadences above, and the retention period you put on your logs, are yours to choose and write down. An investigator asks you to show the choice and the evidence you kept to it, not to match a number printed in the regulation.

You should run HIPAA yourself if you have someone whose job it is to run HIPAA. You should bring in a partner when security leadership is a side-of-desk responsibility for your CTO or head of ops. The former rarely exists at under 100 people. The latter is the norm.

Cloud Sentry builds and operates HIPAA programs for growing healthcare companies: from risk analysis through workforce training through ongoing vendor review. We keep the program current, so an OCR inquiry or a customer security review finds a program already running.