---
title: HIPAA Requirements & Compliance Strategies for Startups
description: In this second post in a series of three posts that cover the background of HIPAA, we discuss HIPAA requirements that you need to know.
image: https://spzlegal.com/hubfs/25-1.png
---

[Skip To Content](https://spzlegal.com/blog/data-privacy/hipaa-requirements#main-content)

[![spz-legal-logo-2024](https://spzlegal.com/hubfs/logos/spz-legal-logo-2024.svg)](https://spzlegal.com/)

- [Clients](https://spzlegal.com/our-clients) 
    - [Featured Clients](https://spzlegal.com/our-clients)
    - [Case Study: Verto Education](https://spzlegal.com/verto-case-study)
    - [Case Study: Kong Studios](https://spzlegal.com/kong-studios-case-study)
    - [Case Study: WindBorne](https://spzlegal.com/windborne-case-study)
    - [Case Study: Tango](https://spzlegal.com/tango-case-study)
    - [Case Study: Sown To Grow](https://spzlegal.com/sown-to-grow-case-study)
    - [Case Study: Capture6](https://spzlegal.com/capture6-case-study)
    - [Case Study: Datava](https://spzlegal.com/datava-case-study)
    - [Case Study: Voxel](https://spzlegal.com/from-scrappy-startup-to-selling-to-fortune-100)
- [Team](https://spzlegal.com/team) 
    - [About Us](https://spzlegal.com/team)
    - [Becky Mancero](https://spzlegal.com/team/becky-mancero)
    - [David De La Flor](https://spzlegal.com/team/david-de-la-flor)
    - [Elizabeth Thorne](https://spzlegal.com/team/elizabeth-thorne)
    - [Gea Kang](https://spzlegal.com/team/gea-kang)
    - [Hannah Porter](https://spzlegal.com/team/hannah-porter)
    - [Hash Zahed](https://spzlegal.com/team/hash-zahed)
    - [Jessica Sulahian](https://spzlegal.com/team/jessica-sulahian)
    - [Morgan Kasenchak](https://spzlegal.com/team/morgan-kasenchak)
    - [Paige Southworth](https://spzlegal.com/paige-southworth)
    - [Ryan Shaening Pokrasso](https://spzlegal.com/team/ryan-shaening-pokrasso)
    - [Sam Taylor](https://spzlegal.com/team/sam-taylor)
    - [Tami Gore](https://spzlegal.com/team/tami-gore)
    - [Specialists](https://spzlegal.com/our-partners)
- [Services](https://spzlegal.com/business-law-services) 
    - [Formation & Corporate](https://spzlegal.com/business-law-services/formation)
    - [Mergers & Acquisitions](https://spzlegal.com/business-law-services/mergers-acquisitions)
    - [Funding](https://spzlegal.com/business-law-services/funding)
    - [Hiring & Equity Compensation](https://spzlegal.com/business-law-services/employment)
    - [Data Privacy](https://spzlegal.com/business-law-services/data-privacy)
    - [IP Protection](https://spzlegal.com/business-law-services/ip-protection)
    - [Commercial Agreements](https://spzlegal.com/business-law-services/sales-agreements)
- [Startup Center](https://spzlegal.com/startup-center) 
    - [Formation & Corporate](https://spzlegal.com/startup-center/formation-and-corporate-topics)
    - [Mergers & Acquisitions](https://spzlegal.com/startup-center/mergers-and-acquisitions)
    - [Funding](https://spzlegal.com/startup-center/funding)
    - [Hiring & Equity Compensation](https://spzlegal.com/startup-center/hiring)
    - [IP Protection](https://spzlegal.com/startup-center/ip-protection)
    - [Data Privacy](https://spzlegal.com/startup-center/data-privacy)
    - [Commercial Agreements](https://spzlegal.com/startup-center/commercial-agreements)
- [Blog](https://spzlegal.com/blog)
- [Contact](https://spzlegal.com/contact)

- [LinkedIn](https://www.linkedin.com/company/spz-legal)

# HIPAA Requirements (Part 2)

[Data Privacy](https://spzlegal.com/blog/tag/data-privacy)

![](https://spzlegal.com/hs-fs/hubfs/25-1.png?width=760&height=428&name=25-1.png)

This is the second in a series of three posts that cover the background of the Health Insurance Portability and Accountability Act (HIPAA), HIPAA requirements, and HIPAA compliance strategies for startups and small businesses. The aim of this series is to make the privacy provisions of HIPAA accessible and understandable to startups and small businesses. In our [previous post](https://spzlegal.com/blog/data-privacy/hipaa-basics), we provided an overview of HIPAA and the type of entities and information covered by its rules. Please read that post to become familiar with the general concepts and terminology used here. In this second post, we discuss HIPAA requirements that startups and small businesses must know. 

## What Type Of Protection Does HIPAA’s Privacy Rule Require?

The cornerstone of HIPAA's requirements is that covered entities and business associates may not disclose personal health information (PHI) unless such disclosure is either (i) sanctioned by HIPAA’s privacy provisions, or (ii) specifically authorized by the individual. Under the first category of permitted disclosure, HIPAA allows disclosure without individual authorization in six different areas:

- Directly to the individual to whom the PHI belongs;
- For treatment, payment, and health care operations;
- Informal consent where the individual is granted an opportunity to agree or object to disclosure;
- Incidental disclosure that cannot reasonably be prevented, is limited in nature, and that occurs as a result of another use or disclosure that is permitted;
- Specific public interest and benefit activities; and
- Limited disclosure for the purposes of research, public health, or health care operations.

Outside of these six areas, individual authorization is required by HIPAA. The law also espouses the principle of “minimum necessary,” requiring covered entities to “develop and implement policies and procedures to reasonably limit uses and disclosures” to the minimum amount of necessary PHI. (Read [Part 1 of this series](https://spzlegal.com/blog/data-privacy/hipaa-basics) for a definition of what a covered entity means).

## What Policies Does HIPAA’s Privacy Rule Require?

HIPAA requires covered entities to make implement certain policies with regard to PHI. Some of the directed implementations include:

- The adoption of written privacy procedures (including administrative safeguards and physical and technical security);
- The designation of a company privacy officer;
- The signing of confidentiality agreements with business associates;
- The provision of written notice regarding privacy practices and information access to individual consumers;
- The chance for customers to request restrictions, accountability, and alternative methods of information sharing; and
- The establishment of a complaint resolution process.

For a detailed explanation of HIPAA’s requirements, please visit the [U.S. Department of Health and Human Services section on Health Information Privacy](https://www.hhs.gov/ocr/privacy/).

[Get Help understanding HIPAA’s requirements](https://spzlegal.com/contact)

## More In This Series

This is the second in a series of three posts that cover the background of the Health Insurance Portability and Accountability Act (HIPAA), HIPAA requirements, and HIPAA compliance strategies for startups and small businesses. The aim of this series is to make the privacy provisions of HIPAA accessible and understandable to startups and small businesses.

Read Part 1 Read Part 3

---

*DISCLAIMER: The information in this article is provided for informational purposes only and should not be construed or relied upon as legal advice. This article may constitute attorney advertising under applicable state laws.*

[![spz-legal-logo-2024](https://spzlegal.com/hubfs/logos/spz-legal-logo-2024.svg)](https://spzlegal.com/)

Categories

- [Funding](https://spzlegal.com/blog/tag/funding)
- [Incorporation](https://spzlegal.com/blog/tag/incorporation)
- [Employment](https://spzlegal.com/blog/tag/employment)
- [Contracts](https://spzlegal.com/blog/tag/contracts)
- [Data Privacy](https://spzlegal.com/blog/tag/data-privacy)
- [M&A](https://spzlegal.com/blog/tag/ma)
- [Firm Culture](https://spzlegal.com/blog/tag/firm-culture)
- [News](https://spzlegal.com/blog/tag/news)
- [Social Enterprise](https://spzlegal.com/blog/tag/social-enterprise)
- [Acquired](https://spzlegal.com/blog/tag/acquired)
- [Intellectual Property](https://spzlegal.com/blog/tag/intellectual-property)
- [Client Engagement](https://spzlegal.com/blog/tag/client-engagement)
- [Nonprofit](https://spzlegal.com/blog/tag/nonprofit)
- [AI](https://spzlegal.com/blog/tag/ai)
- [Artificial Intelligence](https://spzlegal.com/blog/tag/artificial-intelligence)

Recent Posts

- [Becky Mancero Recognized by Best Lawyers: Ones to Watch for Second Consecutive Year](https://spzlegal.com/blog/becky-mancero-best-lawyers-ones-to-watch-2026)
- [What We Fix in Diligence Over and Over Again Before a Financing or Exit](https://spzlegal.com/blog/startup-legal-issues-before-financing-exit)
- [Becky Mancero on the Melissa Widner Podcast: Cap Tables, Equity Mistakes, and AI in the Legal World](https://spzlegal.com/blog/becky-mancero-on-the-melissa-widner-podcast-cap-tables-equity-mistakes-ai-in-the-legal-world)
- [Spinning Out a Product Into a New Startup: Legal Issues Founders Need to Solve Early](https://spzlegal.com/blog/spinning-out-product-new-startup-legal-guide)
- [Converting an LLC to a Corporation: When It Makes Sense and How to Do It Without Creating a Mess](https://spzlegal.com/blog/converting-llc-to-corporation-startup-guide)
- [The Role of LOIs in M&As: Structuring Letters of Intent](https://spzlegal.com/blog/the-role-of-lois-in-mas-structuring-letters-of-intent)
- [Exit Structures: Mergers, Acquisitions, & Tax Treatment](https://spzlegal.com/blog/exit-structures-mergers-acquisitions-tax-treatment)
- [Due Diligence Best Practices: Be Prepared for M&A Success](https://spzlegal.com/blog/due-diligence-best-practices-be-prepared-for-ma-success)

Locations

**San Francisco Bay Area, California**

**Milwaukee, Wisconsin**

**Los Angeles, California**

**Denver, Colorado**

**Miami, Florida**

**Austin, Texas**

Contact Us

[Email](https://spzlegal.com/contact)

Follow Us

- [LinkedIn](https://www.linkedin.com/company/spz-legal)

Startup Topics

- [Formation](https://spzlegal.com/blog/tag/incorporation)
- [Funding](https://spzlegal.com/blog/tag/funding)
- [Employment](https://spzlegal.com/blog/tag/employment)
- [Intellectual Property](https://spzlegal.com/blog/tag/intellectual-property)
- [Data Privacy](https://spzlegal.com/blog/tag/data-privacy)
- [Commercial Agreements](https://spzlegal.com/blog/tag/contracts)
- [M&A Law](https://spzlegal.com/blog/tag/ma)

© 2026 [SPZ Legal, P.C. Startup Lawyers](https://spzlegal.com/)

- [Terms of Use](https://spzlegal.com/terms)
- [Privacy Policy](https://spzlegal.com/privacy)

[![California Chambers Spotlight 2025 Award](https://spzlegal.com/hs-fs/hubfs/ca-chamber-spotlight-2025-badge.jpg?width=300&height=300&name=ca-chamber-spotlight-2025-badge.jpg)](https://chambers.com/law-firm/spz-legal-p-c-120:23727975)

 DISCLAIMER: The information on this website is provided for informational purposes only and may not be updated over time. Nothing on this website should be construed as legal advice or relied upon in any way. No attorney-client relationship is intended to be created through this website. This website may be considered attorney advertising in some states. Prior results do not guarantee a similar outcome.

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Aaron Murphy",
    "url" : "https://spzlegal.com/blog/author/aaron"
  },
  "dateModified" : "2026-05-25T14:29:18.697Z",
  "datePublished" : "2019-08-11T03:37:59.000Z",
  "headline" : "HIPAA Requirements & Compliance Strategies for Startups",
  "image" : [ "https://spzlegal.com/hubfs/25-1.png" ],
  "mainEntityOfPage" : {
    "@id" : "https://spzlegal.com/blog/data-privacy/hipaa-requirements",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://spzlegal.com/hubfs/logos/spz-legal-logo-2024.svg"
    }
  }
}
```