Protect patient data.
Demonstrate it.

Yes, if your software accesses, stores, or transmits protected health information on behalf of a covered entity, you are a Business Associate under HIPAA — and directly liable for compliance. The HITECH Act extended direct HIPAA liability to business associates in 2013. SaaS platforms, EHR vendors, telehealth services, cloud storage providers, billing software, and health analytics tools are all common business associates. You need a signed Business Associate Agreement with every covered entity client and must comply with the Security Rule in full. This is one of the fastest-growing areas of OCR enforcement.

HIPAA compliance means your organization's policies, procedures, and controls meet HIPAA requirements. HIPAA attestation is a formal, third-party report from an independent auditor documenting that assessment — available as an examination engagement or a compliance attestation. Attestation provides covered entities, their clients, and regulators with independent, credentialed evidence of your compliance posture. For business associates, a HIPAA attestation report is increasingly required during enterprise vendor onboarding — particularly for healthcare systems, health plans, and federal healthcare programs. It goes significantly beyond self-attestation or compliance questionnaires.

HIPAA and SOC 2 address overlapping but distinct concerns. HIPAA is a legal requirement for organizations that handle PHI; SOC 2 is a voluntary attestation framework for service organizations more broadly. They share significant control overlap — access controls, audit logging, incident response, risk assessment, encryption, and vendor management all appear in both. Many health tech companies pursue both simultaneously: a HIPAA attestation satisfies healthcare-specific regulatory and client requirements, while a SOC 2 Type II report satisfies broader enterprise security expectations. Running them concurrently with Johanson Group typically reduces total cost and effort significantly, since documentation and evidence collection are largely shared across both engagements.

A Business Associate Agreement (BAA) is a legally required contract between a covered entity and any vendor or contractor that creates, receives, maintains, or transmits PHI on the covered entity's behalf. The BAA must specify permitted uses and disclosures of PHI, require the business associate to implement Security Rule safeguards, mandate breach notification within 60 days of discovering a breach, and require the same obligations to flow down to subcontractors. Operating without a signed BAA is one of the most commonly cited HIPAA violations and a frequent focus of OCR enforcement. BAAs do not have a statutory expiration date but should be reviewed annually.