Map. Encrypt. Document. Trust.

HIPAA applies to "Covered Entities" (US healthcare providers, plans, clearinghouses) and "Business Associates" that handle Protected Health Information (PHI) on their behalf. If your business, anywhere in the world, has a contract with a US healthcare provider, processes US patient data, runs telemedicine for US patients, handles US medical billing, or builds software that touches US PHI, you are a Business Associate under HIPAA and the law applies via your BAA chain. US courts and regulators take an expansive view of jurisdiction over PHI processing.

A HIPAA gap audit + technical remediation for a small telehealth or clinical research platform typically runs $2,500–$8,000 USD (₹2 lakh–₹6 lakh) depending on existing maturity. A complete HIPAA-aware build from scratch is bundled into the project cost. Annual maintenance retainer (Security Risk Analysis, training, policy updates) is $800–$2,500 USD/year (₹60,000–₹2 lakh). We work in USD, GBP, EUR and INR depending on client preference.

HIPAA penalties range from $100 to $50,000 USD per violation, with a maximum of $1.5 million USD per category per year. More importantly, HIPAA breach reports affecting 500+ individuals are published publicly on the HHS "Wall of Shame" and trigger media notification. The reputational cost typically dwarfs the fine. US healthcare clients refuse to engage with vendors with a public breach history.

HIPAA requires designated Privacy Officer and Security Officer roles, these can be the same person and can be based anywhere in the world. What matters is that the role exists, is reachable, and can respond to breach notifications and regulator inquiries within HIPAA timeframes (60 days for breach notification). For Business Associates outside the US, the practical reality is a designated point of contact for HIPAA matters with documented responsibilities.

A Business Associate Agreement (BAA) is a contract that flows HIPAA obligations down the vendor chain. If your platform handles PHI for a US Covered Entity, you need a signed BAA with them, and you need BAAs with every sub-processor of yours that touches that PHI (hosting, email, analytics, support tools). Without BAAs, the HIPAA compliance chain breaks at the first uncovered vendor, exposing your client and you.

Yes, all three offer HIPAA-eligible services with signed BAAs. AWS calls theirs the "HIPAA Eligible Services" list; Google Cloud and Azure have similar programs. You sign a BAA with the cloud provider, then use only the eligible services, and your hosting layer is HIPAA-covered. Most modern healthcare platforms we work with run on AWS or GCP under a BAA.

HIPAA is US-specific to healthcare data. GDPR is EU-wide for all personal data. DPDP is Indian for all personal data. They overlap in spirit but require separate documentation. A platform serving US, EU and Indian patients needs all three covered, HIPAA for US PHI flows, GDPR for EU users, DPDP for Indian users. There is meaningful technical overlap (encryption, access logs, breach notification) but separate policy documentation per regime. We package multi-jurisdiction engagements together for clients who need them.