HIPAA and PHI
Determine whether the company is a covered entity, business associate, or neither, and whether it creates, receives, maintains, or transmits protected health information for another regulated party.
Regulatory analysis
What applies, state by state, before you launch.
Healthcare products sit across federal privacy and security rules, business associate contracts, state professional practice, licensure, telehealth, prescribing, pharmacy, reimbursement, and consumer protection. RegLayer maps those requirements to the care model and data flow you are actually building.
BAAs and data flow
Identify when a business associate agreement is required, what downstream vendors touch electronic PHI, and which permitted uses, safeguards, incident duties, and return or destruction terms matter.
Care delivery
Map the treating entity, clinician relationships, patient contracts, professional ownership, state licensure, telehealth consent, and standard-of-care rules.
Prescribing and pharmacy
Check controlled-substance pathways, in-person evaluation requirements, state prescribing rules, dispensing, compounding, and pharmacy relationships.
Payment and claims
Assess reimbursement, billing, fee splitting, marketing claims, subscriptions, cancellation, and other consumer-protection questions.
Beyond HIPAA
Account for state health-data and general privacy laws that may apply even when HIPAA does not, or that regulate data and consumer relationships outside HIPAA’s scope.
Illustrative Instant Brief
A launch answer tied to the care and data model.
The example is fictional. The source lines refer to real official public sources and HHS guidance.
We provide telehealth software to clinics and store patient intake data. What must be true before a New York launch?
DIRECT ANSWER
First establish the parties’ roles. If the company maintains PHI on behalf of a covered provider, it is a business associate and the arrangement requires a HIPAA-compliant BAA. The clinical model must also satisfy New York professional-practice, licensure, telehealth, consent, and prescribing requirements.
01HIPAA and BAAConfirm whether the service creates, receives, maintains, or transmits PHI for the clinic, then document permitted uses, safeguards, incident duties, subcontractors, and data disposition.
02Professional practiceConfirm which licensed entity provides care, employs or contracts with clinicians, bills patients, and controls clinical judgment.
03Telehealth and prescribingVerify clinician licensure, consent, modality, prescribing pathway, and any in-person evaluation condition for the service offered.
Questions to bring
The answer turns on the operating facts.
AskAre we a HIPAA covered entity, a business associate, or outside HIPAA for this workflow?
AskDo we need a BAA, and which vendors or subcontractors also need one?
AskWho provides, contracts for, bills for, and controls the care?
AskWhere are the patient and clinician, and what licenses and telehealth consents apply?
AskCan this product prescribe, dispense, compound, or facilitate access to the medication involved?
AskWhich state health-data, privacy, reimbursement, and consumer rules apply beyond HIPAA?
Scope
HIPAA does not apply to every health-related product or every health-data flow. A BAA is not a general certification. RegLayer identifies the questions and official sources that shape the analysis. It does not provide legal advice, clinical advice, or a compliance certification.
Healthcare and telehealth