Legal Infrastructure for Healthcare SaaS & AI

If your platform creates, receives, maintains, or transmits protected health information (PHI) for a covered entity, HIPAA pulls you in as a business associate and a Business Associate Agreement (BAA) becomes mandatory. But HIPAA is a federal floor. State medical-privacy and consumer-health-data laws layer on top, and several do not care whether you signed a BAA.

Who this page is for

• Digital health and telehealth startups preparing to sign their first hospital or clinic customer.
• Healthcare AI companies that need to position their product relative to FDA software-as-a-medical-device rules.
• Behavioral-health and substance-use-disorder platforms that also touch 42 CFR Part 2 data.
• Founders selling nationally who need to know which states reach beyond HIPAA.

HIPAA applies to covered entities and to business associates that handle PHI on their behalf. Since the HITECH amendments, business associates (including SaaS vendors) are directly liable to the HHS Office for Civil Rights, not just contractually liable to their customer.

• Privacy Rule: limits use and disclosure of PHI; requires minimum-necessary practices.
• Security Rule: administrative, physical, and technical safeguards for electronic PHI.
• Breach Notification Rule: notice obligations triggered by an impermissible use or disclosure (see the breach timeline section).

This is where most national products get surprised. Some states regulate consumer health data that HIPAA never reaches, and some comprehensive privacy laws exempt PHI but not the company. The full 50-state map is below.

• California CMIA can be stricter than HIPAA and carries a private right of action.
• Washington My Health My Data Act reaches consumer health data outside HIPAA, with a private right of action via the Consumer Protection Act.
• Oregon, Maryland, New Jersey, Delaware use data-level (not entity-level) HIPAA exemptions, so being a business associate does not exempt your organization.

If your software provides patient-specific information used to drive a clinical decision, the FDA may regulate it as Software as a Medical Device. A narrow Clinical Decision Support exemption can apply where the basis for a recommendation is transparent enough that a clinician can independently review it. The screening tree is below.

A HIPAA BAA does not satisfy GDPR, and a GDPR-style DPA does not satisfy HIPAA. If you process personal data of EU or UK residents, or non-PHI data subject to US state laws like CCPA/CPRA, you generally need a separate Data Processing Agreement alongside the BAA.

No states match that filter.

Under CMIA Civil Code 56.06, a SaaS vendor that maintains medical information or offers health or wellness software, mobile apps, or reproductive/sexual-health digital services can itself be deemed a "provider of health care" directly subject to the CMIA. CMIA can be more stringent than HIPAA and carries a private right of action.

MHMDA exempts HIPAA PHI and intermingled data held by a covered entity or business associate, but any consumer health data collected outside the HIPAA-covered stream (direct-to-consumer, app, or web data) falls squarely within it.

That triggers opt-in consent to collect, separate consent to share, valid authorization to sell, a distinct consumer-health-data privacy policy linked on the homepage, consumer access and deletion rights, and a geofencing ban, all backed by a private right of action via the Washington Consumer Protection Act.

Texas defines "covered entity" far more broadly than HIPAA, reaching any out-of-state vendor that handles PHI of Texas residents, and adds 90-day privacy training, electronic-disclosure limits, and breach notice to the Texas AG at a 250-resident threshold.

SB 370 fully exempts both HIPAA-covered entities and HIPAA PHI, so a vendor acting solely as a HIPAA business associate processing only PHI is generally exempt. But any consumer health data collected outside the HIPAA-covered relationship (direct-to-consumer app data, marketing, or pre-relationship intake) triggers SB 370.

That means a separate consumer-health-data privacy policy, prior affirmative opt-in consent to collect and (separately) to share, written authorization to sell, and a prohibition on geofencing around health-care facilities. Enforced by the Nevada AG; no private right of action.

PHI handled under the BAA is exempt at the entity and data level, but any consumer health data the vendor touches outside HIPAA (behavioral-health-adjacent app data, marketing, geolocation) triggers PA 23-56: opt-in consent to process, a ban on selling consumer health data without consent, and a prohibition on geofencing within 1,750 feet of any mental-health, reproductive, or sexual-health facility.

Three comprehensive-law states do not grant an entity-level HIPAA exemption, so being a HIPAA business associate does not exempt the SaaS as an organization. Oregon (OCPA) and Maryland (MODPA) exempt only PHI at the data level; New Jersey (NJDPA) exempts PHI at the data level and does not exempt HIPAA-regulated entities.

For all three, the MSA and privacy-policy stack must build full controller/processor obligations (including opt-in consent for health-condition/diagnosis data) on top of the BAA. Maryland goes further with a strict-necessity minimization rule and an absolute ban on selling sensitive/consumer-health data regardless of consent. Delaware (DPDPA) is the related outlier: no entity-level exemption, a 35,000-consumer threshold with no revenue floor, and coverage of nonprofits.

For behavioral-health and substance-use-disorder customers, several states layer consent rules stricter than HIPAA on top of 42 CFR Part 2: the Michigan Mental Health Code (MCL 330.1748), the Minnesota Health Records Act (144.293, requiring signed consent even for treatment, payment, or operations), New York Mental Hygiene Law 33.13, and Pennsylvania's Act 148 (HIV), Mental Health Procedures Act, and Drug and Alcohol Abuse Control Act.

Illinois adds BIPA/GIPA private-right-of-action exposure for any biometric or genetic data. Consent flows and the BAA/MSA must permit honoring these more-stringent state authorizations.

Ranges are illustrative of typical market pricing, not quotes from specific firms. My flat fee includes one round of revisions; overflow beyond the package estimate bills at $240 per hour.

At minimum: Terms of Service, Privacy Policy, a HIPAA BAA, and a SaaS subscription agreement. If you integrate with hospital systems or handle PHI through APIs, you also need a DPA, an API license, and an SLA. Companies selling to enterprises typically need an MSA/SOW framework as well.

Whenever your platform creates, receives, maintains, or transmits PHI on behalf of a covered entity (hospital, clinic, insurer). That includes cloud-hosting PHI, processing claims data, or running analytics on patient records. Even storing encrypted PHI generally triggers the requirement.

Several. Washington (MHMDA), Nevada (SB 370), and Connecticut (CTDPA health amendments) regulate consumer health data outside HIPAA. California's CMIA can be stricter than HIPAA with a private right of action. Texas adds data-localization duties. Oregon, Maryland, New Jersey, and Delaware use data-level rather than entity-level HIPAA exemptions. See the 50-state table above; the applicable laws depend on where your users are.

Often yes. A BAA covers HIPAA PHI; a DPA covers general personal data under GDPR, UK GDPR, and CCPA/CPRA. They are not interchangeable, and most companies operating nationally need both.

An MSA with order form, a HIPAA BAA (with a 42 CFR Part 2 / CMIA schedule where needed), Terms of Service, a Privacy Policy, a DPA framework, and a compliance gap memo across your vendor stack, with one revision round. Overflow beyond the package estimate bills at $240 per hour.

No. It is attorney-supervised AI that provides legal information, not legal advice, and using it does not create an attorney-client relationship. For advice tailored to your facts, the engagement is where that happens.